Backup Software Exploited, Personalised Hotel Phishing, and Email Authentication Crackdown

Today’s threat briefing covers three critical issues affecting UK small businesses. First, AhsayCBS cloud backup software has been actively exploited since 7 October 2026 through two chained vulnerabilities allowing unauthenticated remote code execution. The product sits in MSP infrastructure stacks, meaning businesses often don’t know they’re exposed. Second, a sophisticated phishing campaign targets hospitality customers with fake booking pages containing genuine reservation details including hotel names, dates, prices, and guest information. The personalisation defeats standard phishing detection advice. Third, Microsoft’s stricter email authentication enforcement is bouncing legitimate mail from domains with missing or misconfigured SPF, DKIM, and DMARC records. All three items share a common thread: they exploit infrastructure components that receive minimal scrutiny because they’re assumed to work correctly. Mauven provides specific, actionable steps for each threat, including questions to ask IT providers, staff briefing points, and DNS configuration checks using MXToolbox.

Chapters

• Introduction Mauven opens with a provocation: backup software in MSP supply chains has been actively exploited since 7 October 2026, and most affected businesses don’t know. Today’s episode covers three threats targeting overlooked infrastructure components.
• AhsayCBS Exploited for Unauthenticated Remote Code Execution Two critical vulnerabilities in AhsayCBS cloud backup management platform have been actively exploited since 7 October 2026. The chained vulnerabilities (CVE-2026-105133 and CVE-2026-105134) require no credentials and provide SYSTEM-level access. Attackers deploy JSP webshells and cryptominers. Mauven explains why this specifically affects UK small businesses through MSP relationships and provides specific questions to ask IT providers.
• Call to Action Mauven encourages listeners to follow the show and share it with colleagues who need threat intelligence briefings.
• Hospitality Phishing with Personalised Fake Booking Pages A sophisticated phishing campaign documented by Netcraft uses genuine reservation data to create fake hotel booking pages. The lures include accurate hotel names, dates, prices, and guest information, defeating standard phishing detection advice. The operation includes 3D Secure bypass capabilities and targets multiple languages. Mauven addresses both hospitality businesses and organisations that book staff travel, explaining the specific payment-request red flag.
• Microsoft Email Authentication Crackdown Microsoft’s stricter enforcement of email authentication standards is bouncing legitimate mail from domains with missing or misconfigured SPF, DKIM, and DMARC records. Mauven explains what these authentication methods do, why the enforcement is correct policy, and provides step-by-step guidance for checking DNS records using MXToolbox, including warnings about forgotten sending services.
• Conclusion Mauven identifies the common thread: all three threats target infrastructure components that receive minimal attention because they’re assumed to work correctly. The AhsayCBS exploitation has been active for over a month against systems meant to be safety nets. Specific actions are summarised for each threat.

Links

• https://www.huntress.com/blog/ahsaycbs-exploited-cve-2026-105133-cve-2026-105134
• https://www.netcraft.com/blog/hospitality-phishing-campaign-booking-impersonation/
• https://www.theregister.com/2026/11/09/microsoft-email-authentication-enforcement/
• https://www.ncsc.gov.uk/guidance/email-security-and-anti-spoofing
• https://mxtoolbox.com/
• https://www.actionfraud.police.uk/