Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE

A critical flaw in Rejetto HTTP File Server stems from the use of a cryptographically weak Pseudo-Random Number Generator (PRNG) to sign session cookies, allowing attackers to mathematically recover the signing key and forge administrative sessions. Once admin access is obtained, attackers can achieve full Remote Code Execution on the host system. A patch was available in July 2026, yet active exploitation was not detected until October 2026 — a three-month window during which unpatched systems remained exposed. This incident highlights the danger of deploying internet-facing file-sharing services without rigorous patch cadence and cryptographic hygiene. The use of weak PRNGs in security-sensitive operations like session management is a foundational design flaw that should be caught during development and code review.