VulnCheck says a China-based actor began targeting vulnerable U.S. Rejetto HFS servers on October 1, exploiting CVE-2026-61500 to forge admin sessions. The fix shipped in July as version 3.2.1. Exposed instances that have not updated are reachable now.
Perspective Coverage
4 publishers
- Builder
- Builder 43%
- Operator
- Operator 47%
- Investor
- Investor 10%
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+30
- Incentives50
- Confidence60
buildOne report1 publisher A Z3 solver found an AWS deny policy covered four of nine compute-launch privesc paths
Bala Paranj ran a 2022 AWS privilege-escalation case through a Z3 solver and found its six-action deny policy blocked four of nine compute-launch vectors. Expanding the list to all nine leaves a residual, because each new compute service AWS ships opens a fresh bypass path.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+35
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher A starts-with key condition lets one signed S3 upload write anywhere under the prefix
Four HackerOne reports cited in a dev.to analysis trace to S3 write scope set wider than the one object an upload needs. Only one of them is the starts-with key condition that turns a signed upload form into write access across a whole prefix.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+25
- Incentives35
- Confidence55
buildOne report1 publisher A week to prove zlib: verification starts looking like a line item, not a luxury
An interview with Lean's founder says an AI translated C zlib into Lean and proved compress-then-decompress round-trips in about a week. The remaining work is optimization without breaking the proof.
Reality
- Evidence25
- Adoption35
- Hype gap+40
- Incentives65
- Confidence30
buildOne report1 publisher Scoping iam:AttachUserPolicy to the caller's own ARN hands out AdministratorAccess
A policy that lets users read and manage their own IAM profile usually carries iam:AttachUserPolicy scoped to ${aws:username}. That scope is enough to attach AdministratorAccess to yourself in a single call.
Reality
- Evidence66
- Adoption
- Not scored
- Hype gap+20
- Incentives70
- Confidence56
buildOne report1 publisher Seven calls to a secret, with zero Secrets Manager permissions on paper
A CloudGoat walkthrough moves an API key through SNS into API Gateway and back out of Lambda. Access Analyzer and PMapper both report the user has no access.
Reality
- Evidence52
- Adoption
- Not scored
- Hype gap+34
- Incentives72
- Confidence46