Cybersecurity
Attackers exploit Rejetto HFS session-forgery flaw
VulnCheck said attempts were under way against a Rejetto HTTP File Server flaw that could let an attacker forge administrator sessions and reach code execution.
- VulnCheck said it detected exploitation attempts against CVE-2026-61500 on 1 October 2026.
- The issue affected Rejetto HTTP File Server 3.0.0 through 3.2.0, where the session-cookie signing key came from JavaScript Math.random().
- According to the advisory quoted in the article, an attacker could rebuild the generator state from login responses, recover the key, forge an administrator cookie and use the server_code feature for remote code execution.
- Horizon3.ai researcher Zach Hanley said Anthropic's Mythos model helped uncover the flaw, and Alejandro Ramos later released a Python proof of concept.
The advisory said Rejetto HFS 3.0.0 through 3.2.0 used JavaScript Math.random() to create its session-cookie signing key and exposed output from the same generator during unauthenticated login. That let a remote attacker recover the key, make an administrator session cookie and use the server_code feature to run JavaScript on the server.
Horizon3.ai researcher Zach Hanley said in a post on 30 September 2026 that Anthropic's Mythos model had been used to find the flaw. He described the issue as a path from unauthorised access to administrative control and code execution.
Rejetto had released version 3.2.1 in July 2026, but a Python proof of concept appeared publicly in late September from Alejandro Ramos. Ramos said the flaw allowed an attacker to reconstruct the PRNG state, recover the signing key and forge an admin session.
Patrick Garrity of VulnCheck said exploitation attempts were detected on 1 October 2026, a day after Horizon3.ai published more details. VulnCheck said it identified an unnamed threat actor in China targeting vulnerable hosts in the United States.
Caitlin Condon, VulnCheck's vice president of research, said the activity looked like small-scale reconnaissance. She said a single China Telecom IP had probed Canary deployments in Japan and the United States.
Named in this story
People
- Zach Hanley
- Horizon3.ai researcher who described the vulnerability
- Alejandro Ramos
- published a Python proof of concept for the flaw
- Patrick Garrity
- VulnCheck staffer who gave the exploitation timeline
- Caitlin Condon
- VulnCheck vice president of research who described the activity as small-scale reconnaissance
Companies
- VulnCheck
- said it detected exploitation attempts and assessed the activity
- Horizon3.ai
- published additional details of the flaw
- Anthropic
- provided the Mythos model said to have helped find the bug
Products and systems
- Rejetto HTTP File Server (HFS)
- the affected server software
- Mythos
- the model said to have been used to discover the vulnerability
Places
- China
- where VulnCheck placed the threat actor
- United States
- where VulnCheck said vulnerable hosts were targeted
- Japan
- where Canary deployments were probed
How the source tells it
The piece was mostly straight reporting, but it opened with urgency around active exploitation and severe access outcomes.
- urgency leads with active exploitation and rapid disclosure timing
- threat frames the flaw as enabling administrator takeover and server-side code execution