Rejetto HFS CVE-2026-61500: Patch to 3.2.1 Now
A critical flaw in Rejetto HFS lets an unauthenticated attacker forge an admin session and run code. It affects 3.0.0 to 3.2.0, and 3.2.1 fixes it.
CVE-2026-61500 is a critical flaw in Rejetto HFS, the free HTTP File Server, that lets an unauthenticated attacker forge an administrator session and take over the server. It affects HFS 3.0.0 through 3.2.0 and is fixed in 3.2.1. Attackers were seen exploiting it within a day of the 30 September disclosure, so if you run HFS, update first and finish reading afterwards.
What happened
Horizon3 published the disclosure on 30 September. The bug was found with Anthropic's Mythos model, working under Project Glasswing, the programme Horizon3 says launched in July 2026.
The Register reports that VulnCheck researcher Patrick Garrity saw the first attacks from an IP address in China, aimed at vulnerable servers in the US and Japan. Further hits followed from addresses that look like a proxy. The same report says Glasswing has now turned up 286 CVEs, and this is the second one seen exploited in the wild.
How the bug works
You do not need to follow the maths to understand the failure. HFS signs its login session cookies with a secret key. Horizon3 says that key was generated with Math.random(), which is not designed to be unpredictable, and that the application also leaked raw Math.random() outputs to anyone who asked.
The attacker requests the login endpoint a handful of times and collects the leaked values.
A constraint solver works backwards from those values to the generator's internal state.
With the state recovered, the attacker predicts the signing key.
The attacker signs a cookie that says "administrator", and the server accepts it.
From the admin interface, a built-in feature gives them code execution on the host.
Horizon3 says the researchers had not seen this kind of solver-based attack on a real target before. The underlying mistake is old, though: using a predictable random source for something that must not be predictable.
What to do now
Check your HFS version. If it is 3.0.0 to 3.2.0, update to 3.2.1 or later.
If the admin interface is reachable from the internet, close it off or put it behind a VPN until the update is done.
Look for signs of tampering since 30 September: admin accounts or configuration changes you did not make, and unfamiliar files.
If you find any, treat the host as compromised and rotate every credential it could reach.
Subscribe to release notifications on any self-hosted tool you run. Make a habit of reading release notes weekly.
Why it matters if you build with AI
This is the second story in a week about AI models finding real security flaws. Last week's GitLab AI Gateway flaw was a different bug class, and the Ray framework entry in CISA's exploited list showed the same pattern of fast exploitation after disclosure.
The practical lesson for builders is the gap between disclosure and attack. Here it was about a day. If your patch routine runs monthly, it does not cover this kind of bug. For what AI bug-finding can and cannot do for your own code, see can AI find security vulnerabilities in your code, and for the wider picture, the AI risks guide.
How did this land?
About the author
Senior Editor, AI & Product
Cecilia leads the Swarmz editorial desk. She has spent a decade turning complex AI and product topics into writing people actually finish, and she owns the blog's quality bar.
