AI-Found Rejetto HFS Authentication Bypass Draws Exploitation Attempts

Attackers started probing a critical authentication-bypass flaw in Rejetto HTTP File Server (HFS) on October 1, 2026, a day after Horizon3.ai published the technical details behind it. The flaw, tracked as CVE-2026-61500, carries a CVSS score of 9.3 and lets a remote attacker forge an administrator session on an unpatched server, then reach remote code execution. Rejetto shipped a fix in July, in version 3.2.1. A working patch existed for more than two months before the first recorded probing, and that gap is the part of the story worth watching.

Related reading: Atlassian's CVSS 9.3 File-Read Flaw Draws Exploitation Within Hours · Google Patches CVE-2026-58704, an Actively Exploited Pixel Modem Zero-Day.

Anthropic's Mythos model helped find the bug. That makes CVE-2026-61500 a clean example of two trends running at once: AI-assisted vulnerability discovery on one side, and the slow, uneven work of patching internet-facing software on the other.

HFS is a lightweight, open-source file server that an administrator runs to move files over HTTP, sometimes on a machine reachable from the public internet. That placement is what makes a session-forgery bug serious. An attacker who lands in the administrator role gets control of the server's configuration and file operations. A bare directory listing would be a much smaller problem. The server_code feature turns that control into code execution.

What the flaw lets an attacker do

The bug is a session-forgery issue with a weak random number generator at its root. HFS versions 3.0.0 through 3.2.0 derive the signing key for their session cookies from JavaScript's Math.random() function, which was never built to keep a secret. The same versions also hand outputs from that generator to unauthenticated clients during the login process. (GitHub advisory)

Those two choices together open the door. A remote attacker can collect a small number of login responses, reconstruct the generator's internal state from the leaked values, recover the cookie-signing key, and sign a valid administrator session cookie. No credential theft is required. Math.random() is a pseudorandom generator, and pseudorandom generators are deterministic: their outputs are a function of a known algorithm and an unknown seed, so enough observed outputs can reveal the state and predict the rest.

An authentication bypass of this kind is harder to defend against than a weak password. A password problem can be answered with a longer secret or a second factor; here the secret itself is derived from a predictable source, so password policy does not help. The attacker never has to guess anything a defender can strengthen.

From an administrator session, the documented server_code feature supplies the next step. That feature lets an administrator define custom endpoints that run server-side JavaScript, a legitimate way to extend HFS and, in this case, a route to remote code execution for anyone who has forged an admin session. The vulnerability is rated 9.3 on the Common Vulnerability Scoring System, a band reserved for flaws that are remotely reachable and lead to full compromise.

The root cause is a mistake that predates this incident and will outlive it. Node.js ships crypto.randomBytes() for security-sensitive randomness, and the standard advice for anyone touching HFS source is to derive keys with a cryptographically secure generator rather than Math.random().

The fix in version 3.2.1 closes the hole for HFS. The same mistake is worth checking for elsewhere: code that reaches for Math.random() to build a token, a key, or a session identifier carries the same class of flaw.

The model that found it

Horizon3.ai researcher Zach Hanley said in a disclosure published on September 30, 2026 that Anthropic's Mythos model found the vulnerability, as part of Project Glasswing, Anthropic's effort to use frontier AI to find and fix flaws in critical software. Security Affairs reported that the flaw was published through the VulnCheck CNA on July 13, 2026. TechTimes reported that the signing key was recovered using the Z3 solver. (Horizon3.ai disclosure, Security Affairs)

Z3 is a general-purpose solver used in program analysis. Applying it to the generator's output makes state reconstruction a tractable problem. Project Glasswing, Anthropic's program for pointing frontier models at critical software, is the setting for the find. The pitch behind such programs is simple: a model can read more code than an audit team and does not tire. Whether that produces a steady stream of fixed, high-severity flaws is a separate question, and VulnCheck's tallies are one of the few public ways to test it.

The AI angle invites a larger claim than the evidence supports. VulnCheck has counted 75 CVEs that mention "Anthropic", 40 of them credited to Anthropic researchers, and only one explicitly attributed to Glasswing. Those are VulnCheck's tallies, and they will move as more disclosures are filed. A single credited find is a real result. It is not yet a track record, and it does not show by itself that AI has changed how quickly critical bugs are found.

Why a July fix did not stop October probing

The window between the patch and the first exploitation attempts is where the incident grows uncomfortable. Rejetto shipped the fix in version 3.2.1 in July 2026, and Security Affairs reported the flaw was published through the VulnCheck CNA on July 13. Public exploitation help arrived in late September, when security researcher Alejandro Ramos, known as aramosf, released a Python proof-of-concept. (aramosf proof-of-concept)

That sequence is routine for internet-facing software. A fix exists, but an operator has to apply it. Disclosure and a working proof-of-concept lower the skill needed to attack, and a server that was patched stays safe while one that was not gets easier to hit with each passing week. Because a proof-of-concept appeared before the first recorded probing, the tooling to exploit the flaw was public before the attempts began.

The dates do not describe a misstep in coordinated disclosure. The flaw was published through a CVE numbering authority in July, the same month the fix shipped, and Horizon3's technical write-up followed in late September. What changed in early October was reach: a public write-up and a working proof-of-concept let a much larger group of people try the flaw.

What VulnCheck has actually seen

The exploitation telemetry belongs to VulnCheck, and its scale deserves to stay in proportion. The firm detected exploitation attempts on October 1, 2026, a day after Horizon3 published more details, and added CVE-2026-61500 to its own known-exploited list. VulnCheck's Caitlin Condon said the activity so far looked like small-scale reconnaissance. A single China Telecom IP address probed Canary deployments in Japan and the United States. VulnCheck's Target Intelligence service identified roughly 100 internet-facing HFS instances. (The Hacker News)

VulnCheck's Canary deployments are decoys the firm operates to observe attacks, so the systems in its report are decoys, not customer servers. The roughly 100 figure comes from its Target Intelligence scanning and counts internet-facing instances, not confirmed-vulnerable ones.

Those figures describe testing, not a wave of compromised servers. Reconnaissance can be the first stage of an attack, and a flaw that yields full administrative access is not one to leave exposed. But the accurate label for what VulnCheck observed in early October is probing. Roughly 100 reachable instances is a small population, and Canary deployments are decoys rather than production systems, so a single source address hitting them reads closer to a scan than to a campaign.

This is also the second time HFS has drawn attackers. CVE-2024-23692, a 9.8-rated flaw, was weaponized in July 2024 to deliver cryptocurrency miners, trojans, and malware that researchers named HATVIBE. The repeat suggests the pool of exposed HFS servers that drew attackers two years ago is still reachable.

The AI discovery adds a newer wrinkle, and it cuts both ways. A model that reads code and spots a key-derivation flaw can find a bug faster than defenders might. The same publication pipeline then feeds public advisories and proof-of-concepts, which shorten the time attackers need to exploit whatever stays unpatched. Discovery speed and patch speed are different problems. Only one of them improved here.

Caveats

The exploitation figures come from VulnCheck's telemetry, not from Rejetto or Anthropic, and they describe what one monitoring network saw. The 75-CVE and single-Glasswing counts are VulnCheck's tallies and will change. Horizon3's account of Mythos finding the flaw comes from the firm's own disclosure, and independent verification of a model's contribution to a specific discovery is hard; Anthropic has not published a full list of Glasswing results.

It is also not clear how many of the roughly 100 internet-facing instances run a vulnerable version, how many have been patched since July, or whether any of the probing led to a successful intrusion. VulnCheck's description points to reconnaissance, and no source in this story reports a confirmed compromise of a named victim.

VulnCheck's telemetry shows small-scale reconnaissance, a single source IP probing Canary decoys, and about 100 internet-facing instances, which is a low base for a mass campaign.

What to watch

Three things will show whether this stays a probing story. First, whether VulnCheck or other monitoring networks report additional source addresses or successful intrusions, which would move the activity from reconnaissance to exploitation. Second, whether HFS operators upgrade, since an exposed and unpatched instance keeps the flaw useful no matter how the bug was found. Third, whether Project Glasswing produces more credited finds, which would turn a single example into evidence about how much AI changes vulnerability research.

The flaw itself is unremarkable: a security key built from a generator that was never meant to hold a secret. What makes CVE-2026-61500 worth tracking is the timing. An AI model found it, developers fixed it in July, and attackers only began testing it in October, after the details and a proof-of-concept were out.

Cover image: rejetto, Wikimedia Commons, CC BY-SA 3.0.