Backup servers (AhsayCBS) are being broken into.

What's happening.

AhsayCBS is backup server software that managed service providers and some businesses run. One flaw lets an attacker get past the login. Another lets them run operating system commands. They can be used together, and no login is needed.

Ahsay's first patch did not fully fix the problem. It issued corrected builds on 10 and 12 October 2026, and later hardening builds.

What it means for you.

Backup servers hold copies of everything. An attacker with control of one can steal data, delete or tamper with backups so you cannot recover, or use it as a stepping stone into the network.

How to fix it.

1. Update to AhsayCBS 9.15.2.70 or 10.3.4.45 at the very least. Ahsay has since released 9.15.2.78 and 10.3.4.54 as hardening updates, so use the latest build.
2. Ahsay recommends rebuilding the server, not only patching it, if you may have been compromised. Upgrading does not undo earlier damage.
3. Look for randomly named .jsp files in the webapps folder, unexpected replication receivers and admin users you did not create.
4. Keep at least one backup copy offline or in a separate account that this server cannot change.
5. If you use a provider that runs AhsayCBS for you, ask them in writing whether they have patched.