Announcements

We are pleased to announce the official release of Ahsay v10.3.6.1 which now supports:

1. AhsayCBS security hardening updates
2. Enhance CBS authentication system to improve security
3. Embed CBS URL in Synology installer to streamline installation
4. MySQL 26
5. Windows 11 26H2
6. Synology DSM 7.4

Click here to view the full release notes.

As part of our ongoing commitment to enhancing the security and resilience of Ahsay solutions, we are pleased to announce the release of AhsayCBS v9.15.2.78 hotfix. This update includes significant security hardening enhancements designed to further strengthen the platform's security posture.

We strongly recommend that all partners take immediate action to apply the latest hotfix and ensure their AhsayCBS environments remain adequately protected.

AhsayCBS v9 hotfix

All partners running affected v7, v8 and v9 versions should upgrade to the latest AhsayCBS v9.15.2.78 official hotfix, available at: https://www.ahsay.com/en/hotfix-v9-partner-only (A valid Partner Portal login is required).

Alternatively, partners who prefer not to deploy the hotfix separately may wait for the upcoming AhsayCBS v9.17.0 release, which is scheduled within the next two weeks. These security enhancements will be incorporated into the official installer and available as part of the standard release.

AhsayCBS v10 hotfix update

We have also released a minor update to our v10 official hotfix to address an issue affecting license key updates in the AhsayCBS web console.

The latest v10 official hotfix version is v10.3.4.55, which is available at: https://www.ahsay.com/en/hotfix-v10-partner-only (A valid Partner Portal login is required).

As part of our ongoing commitment to enhancing the security and resilience of Ahsay solutions, we are pleased to announce the release of AhsayCBS v10.3.5.54 hotfix. This update includes significant security hardening enhancements designed to further strengthen the platform's security posture.

We strongly recommend that all partners take immediate action to apply the latest hotfix and ensure their AhsayCBS environments remain adequately protected.

Alternatively, partners who prefer not to deploy the hotfix separately may wait for the upcoming AhsayCBS v10.3.6 release, which is scheduled for next week. These security enhancements will be incorporated into the official installer and available as part of the standard release.

All partners running affected v8, v9, or v10 versions should upgrade to the latest AhsayCBS v10.3.4.54 official hotfix, available at: https://www.ahsay.com/en/hotfix-v10-partner-only

For partners who need to continue using AhsayCBS v8 or v9 due to operating system compatibility limitations, a separate official AhsayCBS v9 hotfix is expected to be available early next week.

On 9 October, 2026, we began receiving reports from partners regarding unauthorized access incidents affecting their AhsayCBS servers. From the moment the issue was identified, our team acted with urgency and focus.

• A hotfix was developed and released within 24 hours to immediately close the backdoor to prevent further exploitation.
• Partners were notified immediately and provided with guidance.

Our priority was, and continues to be, protecting our partners, and their customers.

Our short-term commitment: Complete resolution

Any newly discovered issues arising from the remediation process will be addressed as quickly as possible. We will not consider this matter closed until all identified concerns have been addressed and our partners have the confidence they need to continue serving their customers.

Our long-term commitment: Stronger security for the future

As the threat landscape continues to evolve, cybercriminals are increasingly employing AI-powered techniques to accelerate and enhance the exploitation of vulnerabilities. This is a challenge faced by software vendors across all industries, and this incident reflects that broader reality rather than an issue unique to Ahsay.

To further enhance our security posture, additional safeguards for both version 9 and 10 are already planned and will be rolled out as part of our continuous security improvement strategy. These enhancements are designed to strengthen resilience of Ahsay solutions against emerging cyber threats, including increasingly sophisticated AI-powered attacks.

Moving forward together

We always stand with our partners.

Challenges such as these serve as an important reminder that cybersecurity requires constant vigilance. By responding swiftly, learning continuously, and investing in stronger defenses, we can further strengthen our resilience and emerge even better prepared for the future.

Thank you for your continued trust, partnership, and support.

Together, we will continue to grow with greater confidence, stronger security, and a shared commitment to protecting the businesses and customers who rely on us every day.

Incident Timeline

• 9 October 2026: Ahsay began receiving reports from partners regarding unauthorized access incidents affecting their AhsayCBS server environments.
• 10 October 2026: Ahsay released hotfix v10.3.4.45 to address the identified vulnerability and notified all partners running AhsayCBS v10 to apply the hotfix immediately.
• 12 October 2026: Ahsay released hotfix v9.15.2.70 to address the identified vulnerability in AhsayCBS v9 and advised all partners using this version to apply the hotfix immediately. Partners operating AhsayCBS v8 and v7 were also advised to upgrade to AhsayCBS v9.15.0.0 and subsequently apply hotfix v9.15.2.70.
• 13 October 2026: Ahsay published guidance and step-by-step instructions to assist partners in identifying potential compromise, assessing affected systems, and performing recovery procedures where necessary .

What does the v9.15.2.70 and v10.3.4.45 hotfixes address?

The v9.15.2.70 and v10.3.4.45 hotfixes fully address the security vulnerabilities identified as CVE-2026-105133 and CVE-2026-105134.

How do I know if my AhsayCBS server has been compromised?

Your AhsayCBS server will be compromised if you observe one or more of the following:

1. Strange folders with names created on the root of your hard drives, for example ahsay_ts, ahsay_t8, ahsay_t9, ahsay_t20, ahsay_t21, srv, user, opt etc. The time stamp on the folders are typically created on same day but the time may vary.
2. In the %CBS%\webapps folder there may be multiple .jsp files with randomly generated names like 75bc584d292933ad.jsp and or folders with lower case letter and numbers such as xtj7iu, kje74x, 103y9r.
3. There are unauthorized RPS receivers added.
4. The are unauthorized AhsayCBS user accounts with “Admin” type privilege created.

If any of the above indicators are present, Ahsay recommends treating the server as compromised and follow the recommended cleanup and recovery procedures immediately to restore the environment to a known clean state.

What is the recommended cleanup and recovery procedure?

To ensure that your AhsayCBS backup server is completely free from any issues resulting from these security vulnerabilities, Ahsay strongly recommends performing a full rebuild of the backup server.

Recommended recovery steps:

1. Reinstall Windows or Linux on your backup server.
2. Install the latest version of AhsayCBS, v9.15.0.0 or v10.3.4.0 and apply the relevant hotfix version, v9.15.2.70 or v10.3.4.45
3. Restore from Auto Save by recovering a server configuration version whose timestamp predates the compromise. As a best practice, select an Auto Save version from at least one day before the timestamp of any suspicious folders or files created during the unauthorized access incident.

By following the above procedure, administrators can help ensure that the backup server is rebuilt from a known clean state and that any unauthorized modifications associated with the compromise are fully eliminated.