VulnHub

Real-time Cybersecurity News

Critical

Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE

The Hacker News
Actively Exploited
CVEVulnerabilityRCECritical

Overview

A serious security vulnerability in Rejetto's HTTP File Server (HFS), tracked as CVE-2026-61500, is currently being exploited by attackers. This flaw, which has a CVSS score of 9.3, arises from a weak pseudo-random number generator that allows for session forgery. Essentially, this means that an attacker can predict the session key, granting them unauthorized access to the server. The vulnerability poses a significant risk to users of HFS, as it can lead to remote code execution, allowing attackers to execute commands on the server. Organizations using this software need to take immediate action to protect their systems from potential exploitation.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Rejetto HTTP File Server (HFS)
  • Action Required: Users should update to the latest version of Rejetto HFS as soon as possible.
  • Timeline: Newly disclosed

Original Article Summary

A critical security flaw impacting Rejetto HTTP File Server (HFS) is witnessing active exploitation attempts, according to VulnCheck. The vulnerability in question is CVE-2026-61500 (CVSS score: 9.3), a case of session forgery stemming from the use of a weak pseudo-random number generator (PRNG) that can lead to a predictable key, which an attacker can then use to gain unauthorized access and

Impact

Rejetto HTTP File Server (HFS)

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should update to the latest version of Rejetto HFS as soon as possible. Additionally, consider implementing stronger security measures, such as using a more secure random number generator or limiting access to the server to trusted IP addresses.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Vulnerability, RCE, and 1 more.

Read Original Article

Related Coverage

IQVIA fined $7.8 million for failing to properly anonymize health data

BleepingComputer

IQVIA, a healthcare data analytics company, has been fined €7 million (about $7.8 million) by Italy's Data Protection Authority for failing to adequately anonymize health data. The GPDP reported that this lapse in data processing practices potentially exposed the personal information of around one million patients, raising serious concerns about privacy and data security. The fine signals a growing scrutiny on companies handling sensitive health information and emphasizes the need for robust data protection measures. In an era where personal data is increasingly vulnerable to breaches, this incident serves as a reminder for organizations to prioritize compliance with data protection regulations to safeguard patient information. The implications of this case could lead to stricter enforcement of data privacy laws across Europe and beyond.

Oct 5, 2026

Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes

The Hacker News

Microsoft has issued urgent security updates to fix a serious vulnerability in Microsoft Exchange Server, identified as CVE-2026-96940. This flaw allows attackers who already have access to the server to gain elevated privileges, potentially enabling them to access other users' mailboxes. Rated 8.8 on the CVSS scale, this vulnerability poses a significant risk to organizations using affected versions of Exchange Server. Companies need to apply the updates promptly to protect sensitive information and maintain user privacy. Failing to address this issue could lead to unauthorized access and data breaches.

Oct 5, 2026

⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests

The Hacker News

This week, several cybersecurity threats have emerged, particularly involving vulnerabilities in NetScaler and FortiMail. These zero-day vulnerabilities are actively exploited, allowing attackers to gain unauthorized access to systems. Additionally, there are concerns regarding AI coding leaks that could expose sensitive information, alongside ongoing issues with Spectre v2 vulnerabilities that affect various processors. Law enforcement has also made strides in tackling ransomware, leading to arrests that could disrupt ongoing attacks. Organizations using affected systems need to prioritize patching and enhancing their security measures to mitigate these risks.

Oct 5, 2026

Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

The Hacker News

Researchers have reported that attackers are trying to exploit a serious vulnerability in the Realtek Jungle software development kit (SDK). This flaw has already been patched, but the exploitation attempts aim to deploy a malware botnet named Cling. What makes Cling notable is its use of standard STUN (Session Traversal Utilities for NAT) protocols to create a command-and-control channel, which is an unusual method for botnet communication. This situation raises concerns for companies using the affected SDK, as it emphasizes the need for timely updates and vigilance against emerging threats. Users and organizations should ensure they have applied all relevant security patches to prevent potential exploitation.

Oct 5, 2026

Google halts open-source bug bounty program amid AI spam surge

BleepingComputer

Google has paused its Open Source Software Vulnerability Rewards Program (OSS VRP) due to a surge in AI-generated spam reports. This program was designed to reward individuals who identify vulnerabilities in open-source software. The influx of low-quality, AI-generated submissions overwhelmed the review process, prompting Google to halt new entries. This decision affects researchers and developers who rely on the program to report genuine vulnerabilities and earn rewards. It raises concerns about the effectiveness of bug bounty programs in the face of advanced AI tools that can generate misleading or irrelevant reports.

Oct 5, 2026

Another OpenAI Safety Expert Quits and Raises New AI Safety Concerns

Security Affairs

David Robinson, a safety veteran at OpenAI, has resigned and voiced concerns about the company's culture and its rapid pace of AI development. In his resignation essay, he expresses worries that the current environment at OpenAI could lead to significant risks in AI safety, suggesting that the company's drive for innovation may overlook critical safety measures. Robinson's departure is notable because it reflects broader concerns within the AI community about the implications of fast-tracked AI advancements. His comments may resonate with other experts who fear that without a strong focus on safety, the potential for misuse or unintended consequences of AI technologies could increase. This situation raises questions about how companies balance innovation with ethical considerations and safety protocols.

Oct 5, 2026