AI-Powered Vulnerability Discovery Accelerates Exploitation of Rejetto HFS Flaw

A critical authentication bypass vulnerability, CVE-2026-61500, has been discovered and rapidly exploited in the wild affecting Rejetto HTTP File Server (HFS). The flaw, which received a CVSS score of 8.8, stems from HFS deriving its Koa session signing key from `Math.random()`, a predictable pseudo-random number generator. Anthropic's Mythos AI model was instrumental in identifying this vulnerability, demonstrating the growing capability of AI in uncovering complex security weaknesses. Within 24 hours of the vulnerability's disclosure, threat actors, specifically an IP address in China, were observed actively targeting vulnerable HFS servers in the US and Japan. This incident is significant for practitioners because it dramatically shortens the window for defensive action. The speed at which this vulnerability moved from discovery by an AI to active exploitation by malicious actors sets a new precedent. It signifies that organizations can no longer rely on extended patching cycles or assume a grace period after public disclosure. The implication is that any publicly exposed service, especially those with known vulnerabilities, becomes an immediate target. This necessitates a fundamental shift in how security teams prioritize and execute vulnerability management and incident response. This event fits into a broader trend of AI accelerating various aspects of the cyberattack lifecycle. We've seen AI-assisted development leading to faster code generation, which can inadvertently introduce new vulnerabilities if not properly secured. Similarly, AI is being used in offensive security for reconnaissance, exploit generation, and even autonomous attacks. The use of AI for vulnerability discovery, as demonstrated by Mythos, is a natural progression of this trend. This isn't just about more vulnerabilities being found; it's about the increased sophistication and speed of discovery, often identifying flaws that might be missed by human researchers or traditional scanning tools. The fact that Anthropic's Mythos is considered "too powerful to release to the general public" further emphasizes the potent capabilities of these AI models. In practice, organizations must immediately prioritize patching for CVE-2026-61500, upgrading Rejetto HFS to version 3.2.1 or later. Beyond this specific vulnerability, practitioners should adopt a "zero-day mindset" for newly disclosed critical vulnerabilities, particularly those affecting internet-facing systems. This means having mechanisms in place for rapid deployment of patches, robust intrusion detection and prevention systems, and proactive threat hunting to identify any signs of exploitation immediately after a vulnerability is announced. Limiting access to the Docker API to trusted parties and running Docker in rootless mode are also recommended as temporary workarounds for similar Docker-related vulnerabilities. Furthermore, security teams should invest in advanced telemetry and behavioral analytics to detect anomalous activity that might indicate exploitation, even before a patch is available. The shrinking time-to-exploit window demands a more agile and aggressive defensive posture.