Exploitation Hits Rejetto HFS Vulnerability Discovered by AI

VulnCheck reports active exploitation attempts against a severe flaw in Rejetto's HTTP File Server (HFS), tracked as CVE-2026-61500 with a CVSS score of 9.3. The bug stems from HFS leaking outputs of its session-cookie generator to unauthenticated users during login, and using that same weak generator to derive the signing key for session cookies. By collecting a handful of login responses, an attacker can rebuild the generator's internal state, recover the signing key, and forge valid administrator session cookies — ultimately achieving remote code execution through the server_code configuration function. Notably, the vulnerability was first identified by Horizon3.ai researchers using Anthropic's Mythos AI model, which reasoned that the reversible xorshift128+ algorithm behind Node.js's Math.random() could expose the secret key used by the Koa framework for cookie signing. Rejetto shipped a fix in version 3.2.1 on July 13, but VulnCheck disclosed on October 2 that attackers, including traffic linked to a China Telecom IP, have started probing honeypot systems in Japan and the US, underscoring the urgency for unpatched HFS deployments to update immediately.