Fixed in July, explained on Wednesday, attacked on Thursday
A flaw that Anthropic's Mythos model found in an open-source file server was patched 80 days before anyone was seen exploiting it. The attacks began the day after the researchers who found it published how the model had worked the exploit out, step by step.
Erik Mclean via Unsplash"We started detecting exploitation of CVE-2026-61500 in Rejetto HFS this evening," Patrick Garrity, a security researcher at VulnCheck, posted on LinkedIn on Thursday, according to The Register. "Our canaries detected an actor in China targeting real vulnerable hosts in the US." He told The Register that the first activity came from a single IP address in China and was aimed at servers in the US and Japan. On Friday his sensors logged four more attempts from two US addresses in the same subnet, which he said "appear to be coming from a proxy".
HFS, the HTTP File Server written by Rejetto, is an open-source program for sharing files over the web. The flaw is in its 3.x line, a rewrite in TypeScript. The public advisory says HFS 3.0.0 to 3.2.0 builds the key that signs its session cookies from Math.random(), a generator not designed for security, and then discloses other outputs of the same generator to unauthenticated clients during login. An attacker can collect a few of those, reconstruct the generator's state, recover the key and forge an administrator's cookie. The administrator can run code through a configuration feature, so the end result is remote code execution with no password. GitHub rates it 9.8 out of 10. The fix, version 3.2.1, came out on 13 July. Its release notes thank "Zach Hanley (@hacks_zach) of Horizon3.ai, in collaboration with Claude and Anthropic Research".
Eighty days passed before VulnCheck saw it exploited. The day before that, on Wednesday, Horizon3 published Hanley's account of how the bug was found. The company joined Project Glasswing, Anthropic's programme giving selected partners access to its Mythos model, in July. Its harness runs many agents in parallel, and the one looking for cryptographic weaknesses, driven by Mythos, connected three facts: the signing key is made from three Math.random() calls when the server starts; a login step puts a raw Math.random() value into a cookie the client can read; and the algorithm V8 uses for Math.random(), xorshift128+, can be run backwards. The write-up quotes the model's output, describes the proof of concept it wrote using Microsoft's Z3 solver, and lists the attack in seven steps, from checking that the admin account exists to sampling the leaking endpoint 12 times to running a command. The Register reports that Hanley also published a video of the exploit. The first attack VulnCheck saw came the next evening.
Horizon3's own reading is that this changes which bugs are worth attacking. Its researchers had spotted insecure uses of cryptography "many times before", Hanley writes, and dropped them for two reasons: a lack of mathematics and the time an exploit would take. "Mythos negates both of those reasons." The team could not recall "ever seeing an SMT solver being used to attack a cryptographic flaw like this in a real application". The write-up predicts that "the types of bug classes threat actors find viable to weaponize and exploit at scale will change."
The sequence suggests something narrower about this case. The attackers did not need Mythos. They needed the explanation. Once it was published, a flaw patched in July drew its first observed attack within about a day. Garrity's tracker, The Register says, counts 286 CVEs attributed to Mythos and Project Glasswing as of Friday. Until Thursday only one of them was known to have been exploited. This is the second.
HFS has been here before. CISA's Known Exploited Vulnerabilities catalogue already lists two HFS flaws: CVE-2014-6287, added in March 2022, and CVE-2024-23692, a template injection in the older Delphi version, added in July 2024. CVE-2026-61500 was not in the catalogue's release of 2 October, so US federal agencies have no deadline for it yet. VulnCheck has added it to its own exploited list.
Anyone running HFS 3.0.0 to 3.2.0 should move to 3.2.1 or later; the current release, 3.3.4, came out on Wednesday with further security fixes credited to a different researcher. Updating replaces the guessable key, but it does not undo what an intruder did with an administrator session before the update. A server that ran an affected version on the internet over the past few days should be checked for configuration changes it cannot account for.