[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fouNCytefZCO1yExrB3vzjN5N1KJ41zC9Htg_re_CSRY":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"44360b64-94d7-48a1-9872-d5b5c07fc8c6","Exploitation Hits Rejetto HFS Vulnerability Discovered by AI","exploitation-hits-rejetto-hfs-vulnerability-discovered-by-ai-6dc736","CVE-2026-61500 allows attackers to recover the session-cookie signing key and gain administrative access and RCE. The post Exploitation Hits Rejetto HFS Vulnerability Discovered by AI appeared first on SecurityWeek.","A critical vulnerability (CVE-2026-61500, CVSS 9.3) in Rejetto HTTP File Server exposes the session-cookie signing key through a non-cryptographic Math.random() PRNG, allowing attackers to forge administrator cookies and achieve remote code execution. Horizon3.ai researchers discovered the flaw using Anthropic's Mythos AI model and reported it in June; patches arrived in version 3.2.1 on July 13. Active exploitation began in October 2026, with attacks originating from China Telecom targeting honeypots in Japan and the US.","CVE-2026-61500 in Rejetto HFS allows RCE via predictable session cookie signing key.","https:\u002F\u002Fwww.securityweek.com\u002Fexploitation-hits-rejetto-hfs-vulnerability-discovered-by-ai\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F11\u002FNPM-code-software-development.jpeg","2026-10-05T11:00:05+00:00","2026-10-05T12:00:16.643656+00:00",9,[17,20,23,25,27,30],{"name":18,"type":19},"Rejetto HTTP File Server (HFS)","product",{"name":21,"type":22},"Rejetto","vendor",{"name":24,"type":22},"Horizon3.ai",{"name":26,"type":22},"Anthropic",{"name":28,"type":29},"Math.random() xorshift128+ PRNG","technology",{"name":31,"type":29},"Node.js Koa framework","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[54],{"type":55,"value":56,"context":57},"cve","CVE-2026-61500","Critical vulnerability in Rejetto HFS allowing RCE via session cookie forgery",[21,24,26],{"controls":60,"vendors":144},[61,90,115],{"slug":62,"name":63,"problem":64,"products":65},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":91,"name":92,"problem":93,"products":94},"patch-management","Automated patch management","Known holes get closed in days, not months.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":91,"product_name":112,"url":113,"description":114},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":116,"name":117,"problem":118,"products":119},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[145],{"slug":146,"name":24,"logo_path":147,"roles":148},"horizon3-ai","\u002Fvendor-logos\u002Fhorizon3-ai.png",[149],"reported_by",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":166},"rejetto-hfs-prng-flaw-enables-cookie-forgery-and-rce-patch-now","Rejetto HFS PRNG Flaw Enables Cookie Forgery and RCE — Patch Now","The root cause of CVE-2026-61500 is a critical cryptographic weakness: Rejetto HFS used JavaScript's non-cryptographic Math.random() PRNG to sign session cookies, making the signing key predictable and recoverable by attackers. Once the key is exposed, adversaries can forge administrator-level cookies and achieve full remote code execution without any credentials. A patch was available on July 13, yet active exploitation did not begin until October — meaning organizations had nearly three months to remediate but many did not. This incident underscores that internet-facing file-sharing services are high-value targets and that weak cryptographic primitives in session management can collapse an entire application's security boundary.",[155,156,157,158,159,160,161,162,163,164,165],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 16: Application Software Security","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-13: Cryptographic Protection","NIST SP 800-53 AC-17: Remote Access","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","NIST CSF RS.MI-3: Newly Identified Vulnerabilities Mitigated","OWASP A02:2021 – Cryptographic Failures","ITIL Change Management: Emergency Change Procedures","NIST SP 800-44: Guidelines on Securing Public Web Servers",{}]