Cybersecurity
Rejetto HFS servers face scans for RCE flaw
VulnCheck said its honeypots saw probes for CVE-2026-61500, while the flaw’s disclosure, proof-of-concept code and upgrade advice centred on Rejetto HFS versions before 3.2.1.
- Caitlin Condon of VulnCheck said Canary Intelligence honeypots had seen probes for CVE-2026-61500.
- She said the activity appeared to come from one China Telecom IP address and to target systems in Japan and the United States.
- The NIST NVD said Rejetto HFS 3.0.0 through 3.2.0 was affected and that version 3.2.1 fixed the issue.
- Horizon3 said its researchers found the flaw with Anthropic's Mythos model and published further details and a proof of concept on 30 September 2026.
- VulnCheck said it had not shared details of any successful exploitation or follow-on activity.
Caitlin Condon of VulnCheck said Canary Intelligence honeypots had seen probes for CVE-2026-61500. She said the activity looked like limited reconnaissance and appeared to come from one China Telecom IP address.
Condon said the scans were aimed at deployments in Japan and the United States. The article said the technical disclosure may have prompted the activity.
The NIST NVD description said Rejetto HFS versions 3.0.0 through 3.2.0 used Math.random() to derive a session-cookie signing key and exposed outputs from the same generator during login. It said an attacker who gathered enough responses could recover the key, forge an administrator cookie and gain remote code execution through the server_code feature.
Horizon3 said its researchers found the issue with Anthropic's Mythos model. The company said it later published more details and a proof of concept on 30 September 2026, and VulnCheck said it had not reported successful exploitation.
Named in this story
People
- Caitlin Condon
- posted the honeypot findings on LinkedIn
Companies
- VulnCheck
- its research vice-president reported the probe activity
- China Telecom
- an IP address from its network was linked to the probing
- Horizon3
- its researchers found the flaw and published a proof of concept
- Anthropic
- its Mythos model helped identify the weakness
Organisations
- NIST NVD
- published the flaw description
Products and systems
- Canary Intelligence
- its honeypots observed the probes
- Rejetto HFS
- the file-sharing server affected by the flaw
- CVE-2026-61500
- the flaw that was being scanned and described
- Mythos
- the model used in the discovery
Places
- Japan
- one of the places probed
- United States
- another place probed
How the source tells it
The article read as a security update with a noticeable sense of urgency, driven by live-scan reporting and advice to patch at once, with some speculation about what may have prompted the activity.
- urgency built around active probing reports and immediate upgrade advice
- speculation used tentative wording when linking the technical disclosure to the scans and listing possible attack paths