Loading story…
A critical vulnerability tracked as CVE-2026-61500 affects Rejetto HFS versions 3.0.0 through 3.2.0, allowing unauthenticated attackers to forge administrator session cookies. The flaw stems from HFS deriving its session-cookie signing key from JavaScript's non-cryptographic Math.random() generator while also exposing outputs from that same generator during login, giving remote attackers enough information to reconstruct the generator state and recover the signing key.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A vulnerability affecting Rejetto HFS versions 3.0.0 through 3.2.0 was disclosed, describing how use of Math.random() for the session-cookie signing key and leaked RNG outputs during login could let an unauthenticated attacker forge an administrator session. The issue can lead to full administrative access and remote code execution, and the advisory references HFS 3.2.1 as the fix.
Rejetto released HFS version 3.2.1 on 2026-07-13 after multiple security vulnerabilities were found in all previous versions that could allow an attacker to gain administrative access. The release credits Zach Hanley of Horizon3.ai in collaboration with Claude and Anthropic Research.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Horizon3.ai disclosed a cryptographic weakness in Rejetto HFS that can allow an attacker to forge administrator sessions. The issue was identified with assistance from Anthropic’s Mythos, according to the disclosure and subsequent reporting. An attacker with a forged administrative session could leverage the elevated access to achieve remote code execution on the affected HFS service. No CVE identifier, affected-version range, root-cause details, patch information, exploit prerequisites, or evidence of active exploitation was provided; organizations running Rejetto HFS should monitor vendor and researcher guidance and restrict exposure of HFS instances pending remediation details.
Sep 30, 2026
Attackers have exploited **CrushFTP** authentication-bypass flaw `CVE-2025-31161` by sending a specially crafted `GET` request that impersonates a known username, including the default `crushadmin`, without supplying a password. The forged request yields an authenticated session cookie that can then be reused in a follow-on `POST` request to carry out privileged actions on the server, such as creating a new user, and researchers noted that public proof-of-concept code is available and multiple threat actors have already abused the bug in the wild. Detection guidance shows defenders can identify exploitation by correlating the initial bypass request, the subsequent privileged `POST`, and the server's success response across packets and flows. Netomize published PacketSmith Yara-X logic using `track_state` and `flow_state` to tie those stages together, giving security teams a way to hunt for successful compromise attempts rather than relying on single-request signatures alone.
Jul 7, 2026
A high-severity vulnerability in **HestiaCP**, tracked as `CVE-2026-12196`, allows a low-privileged user to take over administrator accounts by abusing the control panel's **panel cron job** feature. The flaw stems from broken authorization in cron job handling, where an undefined variable in an access-control check lets unauthorized users modify privileged jobs; the issue is compounded by missing CSRF token validation. Security reporting says the bug is remotely exploitable and carries a **CVSS 4.0 score of 8.3**. By altering a privileged cron job, an attacker can trigger HestiaCP management scripts that run with **passwordless `sudo`**, including scheduling commands to reset the admin password. Researchers said successful exploitation can lead to full administrator takeover within the application and compromise of the underlying web server, amounting to effective **remote code execution**. A manual fix was published in **GitHub pull request `#5440`**, while reports indicated a formal HestiaCP release had not yet been issued at the time of disclosure.
Jul 5, 2026