Attackers target Rejetto HFS flaw CVE-2026-61500 for server access

A weak pseudo-random number generator can make the session-cookie signing key predictable, allowing attackers to forge sessions, gain administrative access and execute code remotely. VulnCheck has observed exploitation attempts, according to The Hacker News. Security Affairs reports that researchers discovered the vulnerability with help from Anthropic’s Mythos AI model.

• The vulnerability has a CVSS severity score of 9.3.

Covered by 4 publishers within 12 hours of the first report.

• BleepingComputer: Rejetto HFS servers now actively scanned for critical RCE flaw

Reporting4

THN The Hacker News Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE · info@thehackernews.com (The Hacker News) 4:09 AM

SW SecurityWeek Exploitation Hits Rejetto HFS Vulnerability Discovered by AI · Ionut Arghire 7:00 AM

SAF Security Affairs Anthropic Mythos Found A Bug in Rejetto HFS. Attackers Are Now Exploiting It. · Pierluigi Paganini 2:15 PM

BC BleepingComputer Rejetto HFS servers now actively scanned for critical RCE flaw · Bill Toulas 4:20 PM

Related

QZ Jamie Dimon warns cyberattack risks rose tenfold after Anthropic Mythos October 6

THN Phishing operators use fake ChatGPT and Gemini ad sites to steal logins October 6

BL Anthropic broadens Claude access through three cybersecurity tiers October 6

TC Anthropic adds free Claude Team access and $1,000 in credits for startups October 6

Topics Anthropic