[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJKwPJhuOeGiWxcOxtf5Ycqeg7rn2Z-284I6QIHfoUOs":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":57},"5ae77211-a787-48a5-b571-39cd5d1e3742","rejetto-hfs-prng-flaw-enables-cookie-forgery-and-rce-patch-now","44360b64-94d7-48a1-9872-d5b5c07fc8c6","Rejetto HFS PRNG Flaw Enables Cookie Forgery and RCE — Patch Now","The root cause of CVE-2026-61500 is a critical cryptographic weakness: Rejetto HFS used JavaScript's non-cryptographic Math.random() PRNG to sign session cookies, making the signing key predictable and recoverable by attackers. Once the key is exposed, adversaries can forge administrator-level cookies and achieve full remote code execution without any credentials. A patch was available on July 13, yet active exploitation did not begin until October — meaning organizations had nearly three months to remediate but many did not. This incident underscores that internet-facing file-sharing services are high-value targets and that weak cryptographic primitives in session management can collapse an entire application's security boundary.","**Immediate actions:**\n- Upgrade all Rejetto HFS installations to version 3.2.1 or later immediately, as this is the only remediation for CVE-2026-61500.\n- Take unpatched HFS instances offline or block external access via firewall rules until patching is complete.\n- Rotate all existing session tokens and administrator credentials on affected systems after applying the patch.\n\n**Long-term improvements:**\n- Enforce a cryptographically secure PRNG (e.g., crypto.getRandomValues() or equivalent) in all session-token and secret-key generation through secure coding standards and code review gates.\n- Maintain a continuously updated inventory of all internet-facing services and apply critical patches within 72 hours of vendor release.\n- Implement network segmentation so that file-sharing services are isolated from core infrastructure, limiting lateral movement if exploitation occurs.\n\n**Detection measures:**\n- Deploy honeypots or canary tokens on file server endpoints to generate early-warning alerts for reconnaissance and exploitation attempts.\n- Monitor authentication logs for anomalous administrator session activity, particularly sessions originating from unexpected geographies or IP ranges.\n- Integrate threat intelligence feeds covering known malicious infrastructure (e.g., China Telecom ASNs flagged in this campaign) into SIEM alerting rules.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 16: Application Software Security","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-13: Cryptographic Protection","NIST SP 800-53 AC-17: Remote Access","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","NIST CSF RS.MI-3: Newly Identified Vulnerabilities Mitigated","OWASP A02:2021 – Cryptographic Failures","ITIL Change Management: Emergency Change Procedures","NIST SP 800-44: Guidelines on Securing Public Web Servers",{},"published","2026-10-05T12:20:56.387734+00:00","2026-10-05T12:20:56.256+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fwww.securityweek.com\u002Fexploitation-hits-rejetto-hfs-vulnerability-discovered-by-ai\u002F","exploitation-hits-rejetto-hfs-vulnerability-discovered-by-ai-6dc736","Exploitation Hits Rejetto HFS Vulnerability Discovered by AI",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":45,"name":46,"slug":47,"description":48,"color":49},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[51],{"id":52,"date":53,"edition":54,"title":55,"audio_url":56},"834c2b80-562e-449d-86fe-ae6eaab39f47","2026-10-05","afternoon","ThreatNoir Afternoon Brief — October 5","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-05\u002Fthreatnoir-afternoon-brief-2026-10-05.mp3",[58,61,64],{"slug":35,"name":59,"problem":60},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":47,"name":62,"problem":63},"Automated patch management","Known holes get closed in days, not months.",{"slug":65,"name":66,"problem":67},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]