Digest · Sunday

Security digest: October 4, 2026

1 editorial brief and 1 known exploited (cisa kev) addition.

All digests · RSS · Markdown

Take stock

Act now: AhsayCBS: Exploited Pre-Auth RCE Chain in Backup Server. MSPs, system integrators and companies running AhsayCBS v7 through v10 below 10.3.4.45 or 9.15.2.70, including servers that already applied 10.3.4.0 or 9.15.2.59.
Do you run any of these? Citrix NetScaler. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-07.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

Oct 4, 2026 · Vulnerability · CVE-2026-105133, CVE-2026-105134

AhsayCBS: Exploited Pre-Auth RCE Chain in Backup Server

If you or your MSP run an AhsayCBS backup server, install the October 12 hotfix today and hunt for webshells: the chain is unauthenticated, runs as SYSTEM, is being exploited by several actors, and the August patch did not fix it.

Must act: MSPs, system integrators and companies running AhsayCBS v7 through v10 below 10.3.4.45 or 9.15.2.70, including servers that already applied 10.3.4.0 or 9.15.2.59.

Can relax: Organizations that do not operate an AhsayCBS server; backup customers of a provider that uses Ahsay should still get written confirmation that the provider has patched and checked for compromise.

Check the build in the AhsayCBS web console under System Settings > License > Update License (Product Version).
Apply hotfix 10.3.4.45 (v10) or 9.15.2.70 (v7-v9) from Ahsay's partner portal, then reboot the server.
Restrict the management web interface to trusted admin IPs or a VPN.

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2026-88779	Citrix NetScaler Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability	2026-10-07

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.