Discovered by Claude Mythos, a Rejetto HFS vulnerability has been exploited from China since the day after it was disclosed

Anthropic’s model demonstrated that it was possible to reconstruct the file server’s session keys from the output of Math.random(). Attacks followed within 24 hours.

The CVE-2026-61500 vulnerability affects Rejetto HTTP File Server (HFS), a popular file sharing server. It can be used to bypass authentication, gain administrator rights, and then execute code remotely. It was discovered by Zach Hanley, a researcher at Horizon3, with the help of Mythos, Anthropic's bug-squashing model. Version 3.2.1 fixes the problem.

A problem of mathematics above all

HFS signed its session cookies with keys taken from Math.random() in V8, which is based on the xorshift128+ algorithm. Mythos established that this algorithm is fully reversible and that the application leaked some of its raw outputs: by reconstituting the seed with Microsoft's Z3 solver, an attacker can make valid session cookies.

The flaw was made public on October 2. As early as the 3rd, Patrick Garrity, of VulnCheck, observed attempts from an infrastructure hosted in China targeting servers in the United States and Japan, then four others on October 4 from American addresses, presumably relays. Of the 286 CVEs attributed to Mythos and the Glasswing project, this is only the second one exploited in the wild.