---
title: Tip: AhsayCBS — verify build is 10.3.4.45 / 9.15.2.70+, reboot, then hunt webshells and OpenSSH (Bitdefender MDR) | ctxsec
url: https://ctxsec.com/items/tip-ahsay-verify-hotfix-build
description: ""
status: "how-to"
published: 2026-10-15
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-ahsay-verify-hotfix-build.md)

how-to

2026-10-15

### Tip: AhsayCBS — verify build is 10.3.4.45 / 9.15.2.70+, reboot, then hunt webshells and OpenSSH (Bitdefender MDR)

Bitdefender MDR's Oct 15 advisory (three customer incidents since ~Oct 7) stresses that v10.3.4.0 and v9.15.2.59 did **not** fully fix CVE-2026-105133/105134. In the console: System Settings → License → Update License and compare the full four-part Product Version. Patch, reboot, then assume prior compromise on any internet-reachable box since NVD publication (Oct 4): new/changed JSP under the Ahsay web root, java spawning powershell/cmd, .cmd drops in `C:\Users\Public`, unexpected OpenSSH installs, privilege changes, and outbound to staging like captcha-eyw[.]pages[.]dev or C2s MDR listed (e.g. 38.60.252[.]110). Patch closes the hole; it does not remove planted access. Federal KEV due date is Oct 17.

Sources: [Bitdefender: AhsayCBS exploitation chain](https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134)