Security Reports disagree 4 publishers 2 min read Published Oct 5, 2026, 2:41 AM PDT

China-based actor targets U.S. Rejetto HFS servers through a forgeable admin cookie

VulnCheck says a China-based actor began targeting vulnerable U.S. Rejetto HFS servers on October 1, exploiting CVE-2026-61500 to forge admin sessions. The fix shipped in July as version 3.2.1. Exposed instances that have not updated are reachable now.

The Watch · Security desk

Send a correction

What happened

HFS versions 3.0.0 through 3.2.0 derive the session-cookie signing key from the non-cryptographic Math.random() and hand outputs of the same generator to unauthenticated clients during login.
The session-forgery flaw, tracked as CVE-2026-61500, carries a CVSS score of 9.3.
A Python proof-of-concept from a researcher known as aramosf, Alejandro Ramos, went public in late September 2026.
It is the second HFS flaw to come under active exploitation, after CVE-2024-23692, which was rated 9.8.

Why it matters

Who's exposed exposure Any internet-facing HFS on the affected builds is exploitable by a remote attacker with no credentials, ending in code execution on the host.
Who has to decide decision The 3.2.1 fix has been out since July, so for exposed hosts the choice now is to update off the normal patch cycle or take them offline.
What it sets up precedent With working exploit code public, opportunistic scanning for vulnerable HFS hosts is the expected next move.

Next story · Security · Oct 9

Anthropic sends unreviewed AI bug reports with proofs of concept to open source maintainers

Confirmed6 publishers

The fix has been available for roughly three months ^[13]. Horizon3.ai researcher Zach Hanley published an analysis on September 30, 2026, and said Anthropic's Mythos model was used to find the flaw, which he described as an authentication bypass that enables arbitrary remote code execution ^[5]. Patrick Garrity of VulnCheck said the attempts came one day after Horizon3.ai published additional details ^[15].

The advisory for the flaw lays out the chain: "A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature." ^[4]

Alejandro Ramos, who published the proof-of-concept, described the same path in the browser engine's terms. "HFS generated its Koa session-cookie signing key with JavaScript Math.random() and exposed outputs from the same V8 PRNG in the unauthenticated SRP login handshake," he wrote ^[8].

Hanley traced how admin access turns into code execution. "Rejetto HFS's administrative API allows for custom endpoints that can execute arbitrary JavaScript," he said ^[6]. "Combined, this presented a clear path from unauthenticated access to administrative control, and ultimately, remote code execution." ^[7]

HFS has drawn attackers before. In July 2024, multiple threat actors weaponized CVE-2024-23692 to deliver cryptocurrency miners, trojans, and a malware named HATVIBE ^[12].

What to watch

Whether the China-based activity broadens into mass scanning now that a working proof-of-concept is public.
Whether other actors adopt CVE-2026-61500 to drop miners or malware, as happened with CVE-2024-23692 in 2024.
Whether trackers report compromise of hosts that stayed on 3.0.0 through 3.2.0 after the July fix.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence62
Adoption: Not scored
Hype gap+30
Incentives50
Confidence60

Perspective Coverage

4 publishers

Builder: Builder 43%
Operator: Operator 47%
Investor: Investor 10%

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
CVE-2026-61500, a critical flaw in Rejetto HTTP File Server, is seeing active exploitation attempts, according to VulnCheck.
Reported Supported Source: VulnCheckView cited source
[2]
CVE-2026-61500 carries a CVSS score of 9.3 and is a session-forgery flaw stemming from a weak pseudo-random number generator that can produce a predictable key.
Reported SupportedView cited source
[3]
Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login.
Reported Supported Source: advisory for the flawView cited source
[4]
A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.
Reported Supported Source: advisory for the flawView cited source
[5]
Horizon3.ai researcher Zach Hanley, in a post published September 30, 2026, said Anthropic's Mythos model was used to discover the vulnerability, which he described as an authentication bypass that facilitates arbitrary remote code execution.
Reported Supported Source: Zach Hanley, Horizon3.aiView cited source
[6]
Rejetto HFS's administrative API allows for custom endpoints that can execute arbitrary JavaScript.
Reported Supported Source: Zach HanleyView cited source
[7]
Combined, this presented a clear path from unauthenticated access to administrative control, and ultimately, remote code execution.
Reported Supported Source: Zach HanleyView cited source
[8]
HFS generated its Koa session-cookie signing key with JavaScript Math.random() and exposed outputs from the same V8 PRNG in the unauthenticated SRP login handshake.
Reported Supported Source: Alejandro RamosView cited source
[9]
A patch for the vulnerability was released in July 2026 in Rejetto HFS version 3.2.1.
Reported SupportedView cited source
[10]
A Python-based proof-of-concept exploit was publicly released in late September 2026 by a security researcher named Alejandro Ramos (aka aramosf).
Reported SupportedView cited source
[11]
CVE-2026-61500 is the second Rejetto HTTP File Server flaw to come under active exploitation, after CVE-2024-23692, which had a CVSS score of 9.8.
Reported SupportedView cited source
[12]
In July 2024, multiple threat actors weaponized CVE-2024-23692 to deliver cryptocurrency miners, trojans, and a malware named HATVIBE.
Reported SupportedView cited source
[13]
The 3.2.1 patch had been available for roughly three months before exploitation attempts began.
Derived Supported
[14]
VulnCheck said it identified an unnamed threat actor in China targeting real vulnerable hosts in the United States.
Reported Contested Source: VulnCheckView cited source
[15]
VulnCheck's Patrick Garrity said exploitation attempts were detected on October 1, 2026, one day after Horizon3.ai published additional details of the flaw.
Reported Contested Source: Patrick Garrity, VulnCheckView cited source

Sources

4 independent publishers whose own reporting we read for this story.

dev.to
1 article · October 4, 2026
Rejetto HFS CVE-2026-61500 exploited a day after write-up
securityaffairs.com
1 article · October 5, 2026
Anthropic Mythos Found A Bug in Rejetto HFS. Attackers Are Now Exploiting It.
securityweek.com
1 article · October 5, 2026
Exploitation Hits Rejetto HFS Vulnerability Discovered by AI
thehackernews.com
2 articles · October 5, 2026
Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder43%

HFS signed its Koa session cookies with a key drawn from V8's Math.random(), and its login flow handed logged-out visitors outputs from the same xorshift128+ stream. Security Affairs gives the most detail: Horizon3's exploit samples an endpoint 12 times, feeds the values to the Z3 solver, and walks the generator state back to the key created at startup. The Tech AI Wire piece on dev.to turns this into advice for JavaScript developers. Use crypto.randomBytes() or crypto.getRandomValues() for keys and tokens, and check which random-looking values reach unauthenticated users.

Operator47%

HFS 3.0.0 through 3.2.0 is vulnerable, and 3.2.1 has fixed it since July 13. All four outlets say VulnCheck saw activity from China-hosted addresses within days of Horizon3's write-up. They differ on the details. The Hacker News puts the first attempts on October 1 against real vulnerable U.S. hosts. SecurityWeek says October 2 and calls it small-scale reconnaissance against canaries in Japan and the U.S. The dev.to account says October 3. That account also advises treating any internet-reachable unpatched server as possibly compromised and checking its server_code setting for entries nobody added.

Investor10%

The commercial angle here is Anthropic's Mythos model. Citing The Register, the dev.to account credits it with 286 CVEs and counts this as the second Anthropic-linked flaw exploited in the wild since Horizon3 joined Project Glasswing in July. Per Security Affairs, Horizon3 says Mythos proposed the Z3 approach and wrote a working proof of concept. Those capability claims come from a Glasswing participant describing its own results. None of our sources tested them independently.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence62: 0100
Mechanism solid, attacks thin
Four publishers quote the same VulnCheck advisory on how the bug works, and Horizon3's report adds the technical detail. The attack reporting is weaker. Every outlet relays VulnCheck telemetry secondhand, and they give three different start dates between October 1 and 3.
AdoptionNot scored: Exposure unmeasured
Our coverage does not count how many HFS servers are online or how many have moved to 3.2.1. Patch uptake and exposure can't be measured from it.
Hype gap+30: −100 understated0 aligned+100 overstated
Attack framing runs ahead
The picture of a China-based actor hitting U.S. servers rests on The Hacker News's phrase "real vulnerable hosts." SecurityWeek describes the same VulnCheck data as small-scale reconnaissance that hit canaries, which are decoy sensors. No outlet reports a confirmed compromise of a production server. The technical severity is not overstated.
Incentives50: 0100
Interested parties tell it
VulnCheck published the CVE through its own numbering authority, scored it, and supplied the only exploitation data, from its Canary Intelligence network. Horizon3 found the bug as a member of Anthropic's Project Glasswing. Both firms benefit from the account that an AI model found an exploitable chain. The technical facts check out across outlets, but the AI-capability framing comes from those firms alone.
Confidence60: 0100
Firm on the bug, loose on the attacks
I'm confident about what the flaw is, which versions it affects, and that 3.2.1 fixes it. I'm less sure about the attacks: their start date and the nature of their targets change from outlet to outlet.

Topics and entities

Topics

AI Vulnerability Discovery and Exploitation
Insecure randomness
Actively Exploited Vulnerabilities and KEV Mandates