AI-discovered flaw in Rejetto HFS triggers active exploitation from China
Anthropic's Mythos AI model identified a critical authentication bypass in Rejetto HTTP File Server (HFS), now under active exploitation. The flaw, CVE-2026-61500, allows attackers to forge admin sessions and execute remote code by exploiting a weak random number generator. Vulnerability researchers confirmed that Mythos used advanced mathematical reasoning to reverse-engineer the session key, marking a significant shift in AI-driven security discovery. Exploitation attempts have been detected from Chinese IP addresses targeting US and Japanese hosts, prompting urgent patching to version 3.2.1.