Category: Security | Reading time: 5 min
What Was Disclosed
On 30 September 2026, Horizon3.ai researcher Zach Hanley published a technical write-up of CVE-2026-61500, a critical session-forgery flaw in Rejetto HTTP File Server (HFS) 3.x. Horizon3 discovered the issue using Anthropic’s Mythos model as part of Project Glasswing. NVD and VulnCheck rate the vulnerability CVSS 9.3. Affected releases are HFS 3.0.0 through 3.2.0; the fix shipped in 3.2.1 on 13 July 2026.
The root cause is cryptographic misuse, not a novel RCE primitive. When `COOKIE_SIGN_KEYS` is unset, HFS builds its Koa/keygrip session-cookie signing key with `Math.random()`—V8’s non-cryptographic xorshift128+ PRNG. The same PRNG stream leaks raw outputs to unauthenticated clients during the SRP login handshake. An attacker who collects a small set of those login responses can reconstruct PRNG state, recover the signing key, forge a valid administrator session cookie, and reach remote code execution through HFS’s documented `server_code` configuration feature.
Discovery Versus Containment
Horizon3’s write-up is explicit about Mythos’s role: the model chained the insecure PRNG, the login-side leak, and the admin API’s ability to run arbitrary JavaScript, then produced a working proof of concept including a Z3-based state recovery path. A patch had already been available since mid-July. What changed in late September was public technical detail and a Python PoC from researcher Alejandro Ramos (aramosf).
VulnCheck’s Patrick Garrity reported that exploitation attempts began on 1 October 2026—roughly a day after Horizon3’s detailed post. SecurityWeek and The Hacker News both cite VulnCheck canary hits originating from a China Telecom / China-based IP against real vulnerable hosts in the United States and Japan. Follow-on activity from two U.S. IPs in the same /24 was reported as likely proxy traffic. VulnCheck added the CVE to its Known Exploited Vulnerabilities set. Rejetto HFS had already appeared on CISA’s KEV list for CVE-2024-23692 in 2024; this is the second HFS flaw under active exploitation.
Discovery found the bug. A July patch existed. Public detail plus a PoC still produced exploitation within about twenty-four hours on remaining internet-facing instances—VulnCheck estimates on the order of roughly one hundred exposed HFS hosts.
Why Enterprise Buyers Should Care
HFS is a file-sharing server, not a frontier lab product. The enterprise lesson is the timeline and the evidence gap, not the product brand.
An AI-assisted research pipeline found a chain that traditional triage often drops as “too math-heavy to weaponize.” Horizon3 notes that Mythos treated PRNG invertibility as a practical attack path without requiring deep human cryptography expertise. Defenders who assume complex crypto flaws stay theoretical until a human researcher invests weeks are updating that assumption the wrong way.
More important for regulated deployers: finding and patching a vulnerability is not the same as proving what ran afterward. When an unauthenticated session can be forged and `server_code` can execute server-side JavaScript, the operational questions are ordinary. Who was authorized to change configuration. What admin sessions were issued and from where. Whether forged cookies or unexpected `server_code` changes appear in durable logs. Whether that record can be checked without trusting a vendor retrospective.
What Deployers Should Take From It
If you run Rejetto HFS 3.x, upgrade to 3.2.1 or later immediately and hunt for forged admin sessions and unexpected server-side code changes.
For teams deploying action-taking agents—or consuming research that agents produce—the Cyphrex-relevant takeaway is narrower. Discovery speed is rising. Containment still depends on independent records of what an agent or tool was allowed to do: identity, scope, systems reached, and whether a blocked step stayed blocked. A model that finds a CVE in June does not replace write-time authorization evidence when exploitation lands in October on unpatched hosts.
Source: Horizon3 — Anthropic Mythos Finds Rejetto HFS RCE · SecurityWeek · The Hacker News · NVD — CVE-2026-61500 · VulnCheck Initial Access (2 Oct 2026)