Attackers exploit AI-found flaw in Rejetto file server within a day

A critical authentication-bypass bug in Rejetto HTTP File Server (HFS), an open source web file server, came under active attack within a day of being disclosed, according to a report published by The Register on 3 October 2026. The flaw, tracked as CVE-2026-61500, can give an attacker full admin access and remote code execution on affected servers. Rejetto has fixed it in version 3.2.1, which also addresses other security issues.

The bug was found using Mythos, Anthropic's bug-hunting model, which the company says is too powerful to release publicly. Zach Hanley, a researcher at AI pen-testing firm Horizon3, published the find on Wednesday along with a video showing how to exploit HFS and run code remotely on the server. Hanley said Horizon3 has used Mythos in its vulnerability research since joining Project Glasswing, Anthropic's programme giving selected partners access to the model, in July.

Exploitation followed quickly. "We started detecting exploitation of CVE-2026-61500 in Rejetto HFS this evening," VulnCheck researcher Patrick Garrity posted on LinkedIn on Thursday. Garrity said VulnCheck's canaries, decoy systems used to spot attacks, detected an actor in China targeting real vulnerable hosts in the US. He told The Register the Thursday night activity came from a single IP address in China and hit vulnerable servers in the US and Japan. By Friday he had seen four more hits, this time from two addresses in the same US subnet that "appear to be coming from a proxy". The Register noted that China-linked intruders routinely route traffic through compromised devices, and that a ten-country advisory in April warned of China-nexus operators using proxy networks at scale. No attribution has been confirmed.

Garrity has been tracking CVEs attributed to Mythos and Project Glasswing since shortly after the programme was announced in April. As of Friday his tracker counted 286 CVEs from the effort, of which only one had previously been exploited in real-world attacks. HFS itself already has a history as a target: an earlier flaw in the product appeared on the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog in 2024.

The technical cause sits in how HFS handles sessions. According to Hanley's write-up, HFS generates a random value using JavaScript's Math.random() and passes it to Koa, the Node.js web framework it is built on. Koa uses the keygrip library to sign session cookies with that value. If an attacker can work out the signing key, they can forge valid session cookies. That should be impossible if Math.random() used a secure pseudo random number generator, but the V8 engine's implementation did not. Hanley said Mythos found that the output of the xorshift128+ algorithm behind it is fully reversible, and that the application leaked raw Math.random() outputs through a separate code path. The model's analysis proposed using Z3, Microsoft's publicly available SMT solver, to recover the generator's seed.

Hanley said Horizon3's researchers could not recall seeing an SMT solver used this way to break a cryptographic flaw in a real application and bypass authentication. What stood out, he wrote, was that the model did not just flag the weak random number generator in isolation but recognised the leak and the weakness as a chain that made state recovery feasible. Users of Rejetto HFS are advised to update to v3.2.1 or later.