CVE-2026-61500Disclosure

Today, we’re releasing the details of one of the first impactful vulnerabilities we found with @AnthropicAI's #Mythos as a part of #Project #Glasswing. CVE-2026-61500 is an authentication bypass which leads to RCE in Rejetto HFS, which previously appeared on the CISA KEV in 2024. https://horizon3.ai/attack-research/disclosures/anthropic-mythos-rejetto-hfs-rce/#

⚠️ Attackers are targeting a Rejetto HFS flaw that enables forged admin sessions and remote code execution. CVE-2026-61500 affects HFS 3.0.0–3.2.0. VulnCheck detected exploitation attempts against vulnerable U.S. hosts after a public PoC was released. Read - https://thehackernews.com/2026/10/attackers-target-rejetto-hfs-flaw-that.html

I'm still burning tokens, now the PoC of CVE-2026-61500: Rejetto HFS session forgery to RCE https://github.com/aramosf/CVE-2026-61500 (Vulnerability discovery Zach Hanley @hacks_zach) https://t.co/fMr03Mu1dU

Citrix CVE-2026-88779 (CVSS 8.7) knocks SAML offline; CISA KEV deadline Oct 7. Rejetto CVE-2026-61500 (CVSS 9.3) under exploit. Trump names Clayton to lead a Super Intelligence Force. https://x.com/i/article/2107134978563641344

🚨 CVE-2026-61500 — REJETTO HTTP FILE SERVER UNAUTHENTICATED RCE Horizon3 says Anthropic’s Mythos AI found a critical flaw in Rejetto HTTP File Server (HFS): unauthenticated remote code execution, CVSS 9.8. What the research reports: • HFS session keys are built with Math.random(), a reversible PRNG • A separate unauthenticated path leaks outputs from the same generator • Mythos built a Z3 exploit that recovers the admin session key and gets RCE • Affected: HFS 3.0.0 through 3.2.0. Fixed in 3.2.1 and later VulnCheck Canary began observing exploitation on October 1, 2026. That activity was a China-hosted IP targeting hosts in the US, and also Japan. VulnCheck added CVE-2026-61500 to VulnCheck KEV. Roughly 100 internet-facing HFS instances. It is not in CISA KEV. ⚠️ Analyst Note: This is a short path from AI-assisted discovery to exploitation. Horizon3 published the Mythos write-up on September 30, 2026. VulnCheck Canary saw exploitation the next day. The bug is a predictable session signing key, not a memory-corruption flaw, and the model still produced a working solver that recovers the admin key. Exposed HFS 3.x should be updated to 3.2.1 or later. Primary: https://horizon3[.]ai/attack-research/disclosures/anthropic-mythos-rejetto-hfs-rce/ Exploitation intel: https://docs.vulncheck[.]com/initial-access/2026-10-02 #DDW #DarkWeb #CyberSecurity #ThreatIntelligence #CVE

Rejetto HFS 3.0.0 a 3.2.0 gera a chave de assinatura de sessão com Math.random(). Dá para forjar cookie de admin e chegar a RCE (CVE-2026-61500, CVSS 9.3), já explorado. Atualize para 3.2.1+. Lição: segredo se gera com CSPRNG, nunca com Math.random(). https://thehackernews.com/2026/10/attackers-target-rejetto-hfs-flaw-that.html

CVE-2026-61500 is now being exploited in the wild. VulnCheck observed attacks after Mythos AI developed an exploit for the predictable session key flaw. ExploitGrid: 45.5/100 | CVSS 9.3 HFS <3.2.1 is affected. https://exploitgrid.net/vulnerabilities/CVE-2026-61500 #CyberSecurity #ThreatIntel

🚨 CVE-2026-61500: Rejetto HFS auth bypass → RCE. Horizon3 found predictable Math.random() output can expose the session key, letting attackers forge admin cookies and reach RCE. CVSS 9.3 | Public exploit ExploitGrid: 45.5/100 Medium 🔎 https://exploitgrid.net/vulnerabilities/CVE-2026-61500

📌 رصد مسح نشط لاستهداف خوادم Rejetto HFS واستغلال ثغرة RCE حرجة (CVE-2026-61500) 🛡️ الفئة: ثغرة 📝 الملخص: تُرصد حاليًا عمليات مسح نشطة تستهدف خوادم Rejetto HFS، سعيًا لاستغلال ثغرة مفتاح توقيع ضعيف (CVE-2026-61500). تُمكّن هذه الثغرة الحساسة المهاجمين من تزوير الجلسات، والاستيلاء على الحسابات، وتنفيذ تعليمات برمجية عن بعد (RCE) على الأنظمة المخترقة. يشير هذا المسح المستمر إلى تصعيد في محاولات استغلال الثغرة، مما يعرض الخوادم المتأثرة لمخاطر تشغيلية وأمنية جسيمة. يُنصح بشدة جميع مسؤولي خوادم Rejetto HFS بمراجعة إعدادات الأمان فورًا، وتطبيق أي تحديثات أو تصحيحات متوفرة، ومراقبة السجلات للكشف عن أي نشاط مشبوه. 🗓️ تاريخ النشر: 05/10/2026 🔗 للمزيد: https://www.bleepingcomputer.com/news/security/rejetto-hfs-servers-now-actively-scanned-for-critical-rce-flaw/

Horizon3 used Anthropic's Mythos to find an auth bypass in Rejetto HFS (CVE-2026-61500). The root cause is almost funny: the session signing key came from Math.random(). The Register says exploitation attempts showed up the very next day.

-Aleph Alpha Kolibri 78B open-weight model, 1M token context -Ai2 releases Olmo-core 3 for building mixture-of-experts LLMs -Anthropic Mythos found CVE-2026-61500, now under active attack https://dreyx.com

@DailyDarkWeb Poc here: https://github.com/aramosf/CVE-2026-61500

Project Glasswingに参加しているHorizon3から、実際に見つけた脆弱性を紹介しつつMythosの特徴について説明。 CVE-2026-61500: Rejetto HFS Session Forgery via Predictable Signing Key Horizon3’s Tales from the Trenches: Anthropic’s Mythos and Rejetto HFS https://horizon3.ai/attack-research/disclosures/anthropic-mythos-rejetto-hfs-rce/

🔥 CyberForge Weekly CVE Rundown #005 — The Sunday Debrief 🗓️ 5–10 October 2026 Six days. Six CVEs. One defender-focused debrief. A new passkey, an accepted session and a gateway's own request can all look legitimate. This week's Forge selections show why defenders should examine the authority and processing behind those signals, then verify the code actually serving traffic. Sunday gives us a chance to turn six deep dives into clearer Monday priorities. 📚 The six-day rundown 1️⃣ Monday — CVE-2026-105209 ZITADEL — cross-organisation account takeover An organisation's credential administrator could add an authenticator to another organisation's user within the same instance, without victim interaction. ⚠️ Why it made the list: Authorised enrolment underpins strong authentication. 🛡️ Defender move: 3.x: 3.4.15+; 4.x: 4.17.1+. Investigate unexplained authenticator additions. 📌 Status: Vendor fixes rechecked 11 October. 🔗 Full post / primary source: https://github.com/zitadel/zitadel/security/advisories/GHSA-pq2q-2c6r-75c4 2️⃣ Tuesday — CVE-2026-61500 Rejetto HFS — predictable session trust Weak default keys permit unauthenticated session forgery, administrator access and code execution through legitimate configuration, with the HFS process's privileges. ⚠️ Why it made the list: Legitimate functionality completes the chain. 🛡️ Defender move: Upgrade affected 3.0.0–3.2.0 to 3.2.1+; review signing keys and configuration history. 📌 Status: VulnCheck's own KEV-listed; checked 11 October. 🔗 Full post / primary source: https://www.vulncheck.com/advisories/rejetto-hfs-session-forgery-via-predictable-signing-key 3️⃣ Wednesday — CVE-2026-105844 Payload CMS — Import Export prototype pollution An enabled Import Export plugin accepts unauthenticated prototype-sensitive field paths; unintended application behaviour can lead to remote code execution. ⚠️ Why it made the list: Plugin enablement changes applicability. 🛡️ Defender move: Align packages: stable 3.88.0+ or 4.0.0-canary.27+, within the deployed train. 📌 Status: Fixes rechecked 11 October. 🔗 Full post / primary source: https://github.com/payloadcms/payload/security/advisories/GHSA-qf28-8hc6-vwrp 4️⃣ Thursday — CVE-2026-76471 Cisco NX-OS — NX-API memory corruption On affected Nexus 3000/9000 standalone NX-OS, enabled NX-API permits unauthenticated root execution/DoS. UCS 6300 requires low-privileged XML API credentials. ⚠️ Why it made the list: Management-plane integrity matters. 🛡️ Defender move: Use Cisco's checker; UCS 4.3 now lists 4.3(6j). 📌 Status: 8 October PSIRT: unaware of malicious use. 🔗 Full post / primary source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j 5️⃣ Friday — CVE-2026-102255 SonicWall SMA1000 — pre-authentication SSRF On listed models, unauthenticated Work Place requests can potentially induce appliance requests to internal functionality and unauthorised operations. ⚠️ Why it made the list: Trusted intermediaries need authority context. 🛡️ Defender move: Platform hotfixes: 12.4.3-03670+ or 12.5.0-03082+, matching the train. 📌 Status: 6 October vendor: no wild exploitation evidence; rechecked 11 October. 🔗 Full post / primary source: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017 6️⃣ Saturday — CVE-2026-85097 Bricksforge — WordPress upload and PHP execution Unauthenticated upload metadata handling can enable PHP execution despite correct initial MIME checks. ⚠️ Why it made the list: Validation must survive later processing. 🛡️ Defender move: Wordfence: 3.1.8.10+ patched; vendor: separate 4.0.1 Pro Forms warning. Confirm branch mapping. 📌 Status: Both notices rechecked 11 October; mapping unresolved. 🔗 Full post / primary source: https://www.wordfence.com/threat-intel/vulnerabilities/id/e993c929-f175-43a7-92e6-9d3b089b8dde?source=cve https://bricksforge.io/version-changelog/ 🔄 Since the original posts Updated recap: Sunday's focused pass rechecked vendor/CNA guidance, NVD, CISA KEV and FIRST through 11 October, 08:39 UTC. Detailed investigation trails retain their daily source dates. CVE-2026-76471: Cisco's 8 October v1.1 revised the UCS table after our daily cutoff. The current 4.3 row gives 4.3(6j); the earlier Intersight-specific floor is absent. Confirm the actual management mode and repair with Cisco rather than carrying that old entry forward. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j FIRST now returns EPSS rows for the ZITADEL, Payload and Cisco cases, dated 10 October. Their earlier “unavailable” results remain historical snapshots. EPSS estimates future exploitation probability; it does not establish compromise. https://api.first.org/data/v1/epss?cve=CVE-2026-105209,CVE-2026-105844,CVE-2026-76471 None of our six IDs appears in CISA's retrieved 8 October catalogue, checked 11 October. Absence does not prove non-exploitation. VulnCheck's HFS listing is a separate catalogue; its supporting incident detail remains access-restricted. https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json 🏆 This week's Forge honours 🚨 Most Severe — CVE-2026-102255, SonicWall SMA1000 CISA-ADP assigns CVSS v3.1 10.0, the highest comparable v3.1 score here. SonicWall separately gives v3.0 10.0. Payload's v4.0 assessment remains separate. This SSRF description does not establish universal code execution. Severity informs triage alongside actual exposure. https://nvd.nist.gov/vuln/detail/CVE-2026-102255 🧩 Most Interesting Attack Chain — CVE-2026-61500, Rejetto HFS The CNA connects weak session-key generation to accepted administrator access and execution through a legitimate configuration feature. The lesson is to follow accepted administration into effective configuration and runtime evidence, with the process's actual permissions retained. 🛡️ Most Defender-Relevant — CVE-2026-76471, Cisco NX-OS For affected network operators, unauthenticated root execution on enabled Nexus NX-API can threaten a central infrastructure asset. Product/mode, feature state and reachability determine priority. UCS's credential prerequisite and the revised repair table deserve their own checks; no active campaign is assumed. 💜 CyberForge Pick of the Week CVE-2026-105209 — ZITADEL and the authority to enrol Lee's Forge favourite this week. It reminds us that a strong authenticator depends on the permission decision that created it. The attacker can enrol a new authenticator without obtaining the victim's existing credentials; the published boundary remains organisations sharing one instance. Forge interpretation: Follow the eligible issuer, target user's actual organisation, code issuance, authenticator addition and subsequent account use. Review effective historical grants, including legitimate instance-wide management. Hunting only failed sign-ins may miss the earlier decision that enabled a later successful one. 🧠 What connected the week ZITADEL's enrolment and HFS's accepted sessions put authority behind apparently valid access. SMA1000 adds a trusted intermediary issuing requests, while Bricksforge shows validation losing its protection during later handling. Different mechanisms, one useful defender question: which decision made this action trusted? These selections establish no shared actor or campaign. 🛡️ The defender's Monday shortlist 1️⃣ Own exposed scope: Check Nexus model/mode and NX-API; SMA1000 model/platform hotfix; effective Payload and Bricksforge feature state. 2️⃣ Verify the repair in service: Apply the correct train's remedy to every serving copy. Resolve Cisco's revised guidance and Bricksforge's branch mapping with their owners. 3️⃣ Preserve the historical trail: Review ZITADEL enrolments, HFS administration and gateway receiving-service activity. Correlate effects and record retention gaps before declaring case closure. 🔥 CyberForge closing thought Good defence follows authority from its first decision through its final effect. A fixed build, an exposure assessment and an investigation conclusion each need their own evidence. > Trust needs a trail, and a repair needs a running build. #CyberSecurity #CVE #WeeklyRundown #ThreatHunting #BlueTeam #CyberForge

📊 10/7 통합 브리핑 오늘 1순위는 기한이 오늘인 NetScaler가 아니라, 기한이 이미 사흘 지난 FortiMail이다. CVE 개수가 위험 신호 역할을 잃은 주다. 우선순위는 KEV 등재·인터넷 노출·실제 악용으로 다시 세우자. —— 오늘 먼저 —— ① 🔴 FortiMail CVE-2026-104286 — CVSS 9.8, KEV 기한 10/4 경과 미인증 임의 파일 기록, 실제 악용 확인. 8.0.2 / 7.6.7 / 7.4.9 이상으로, 7.2.x는 7.4 이상으로 이관. 당장 못 올리면 IBE 비활성화 + 웹메일 사내망 제한 + /ibe 경로 ../ 포함 POST 차단. ② 🔴 Citrix NetScaler CVE-2026-88779 — KEV 기한 오늘(10/7) SAML SP/IdP로 구성된 장비만 해당. CTX697174 수정 빌드 적용, 선행 88771·88772(기한 9/30 경과)도 함께 확인. 영향은 DoS지만 BOD 26-04가 포렌식 트리아지까지 요구한다. ③ 🔴 Rejetto HFS CVE-2026-61500 — KEV 미등재, 10/1부터 악용 3.2.1 이상으로. 수정판은 7월에 이미 나와 있었다. 섀도 IT 파일 서버일 가능성이 커서 자산 검색부터. ④ 🟠 패치 창이 열려 있는 3건 Atlassian Data Center CVE-2026-21589(9.3), 온프레미스 Exchange CVE-2026-96940(8.8), 자체 호스팅 GitLab AI Gateway/Duo CVE-2026-90970(9.9). 악용 보고가 없는 지금이 가장 싼 시점. ⑤ 🟠 사내 코딩 에이전트 권한 경계 Copilot CLI가 웹페이지 인젝션으로 시크릿을 유출할 수 있다는 보도. 위험은 autopilot 모드에 집중. 자동 실행 + 웹 접근 동시 허용 설정부터 회수. —— AI —— ──────── ▣ Mistral Large 4 — 1T 총 / 활성 49B, 공식 수치로 정정 핵심: 1T 총 파라미터·활성 49B MoE, 네이티브 멀티모달, 160개 이상 언어. 유럽 자사 데이터센터에서 Grace Blackwell 3,800장으로 학습. 가중치는 이달 말 공개 예정이고 지금은 API 프리뷰. 가격 입력 $1.36 / 출력 $4.18(per M tokens). 공식 벤치 DeepSWE 61.7%, Terminal Bench 4.0 28.3%, Cybench 93%. 왜 중요한가: 1T는 마케팅 숫자다. 체감 성능·추론 단가는 49B급에 가깝게 봐야 한다. 눈여겨볼 건 Cybench 93%와 EU 역내 학습·배포. 원본 일부의 "2T·Apache 2.0·이미 배포" 서술은 공식 발표와 불일치. https://mistral.ai/news/mistral-large-4/ ──────── ▣ Anthropic Cyber Verification Program 3티어 확대 핵심: Project Glasswing과 기존 CVP를 묶어 Defense / Red Team / Specialized Access 3등급으로 재편. 등급별로 Opus 5.5·Sonnet 5.5·Mythos 5.1의 사이버 차단 분류기를 완화. Specialized는 전력망·통신·은행 간 인프라 등 안전 필수 시스템 테스트용으로 미국 정부와 공동 심사. 파트너 검증 취약점 최소 12.9만 건은 벤더 자체 집계. 왜 중요한가: 모델 차단을 신원 검증 등급으로 차등화한 첫 제도화 사례. 보안팀의 도구 전략과 벤더 심사 기준에 바로 들어온다. https://www.anthropic.com/news/cyber-verification-program ──────── ▣ Personal Agent Protocol — Meta·Sierra·Shopify·Stripe·Walmart 핵심: 개인 에이전트가 웹사이트·API·기업 에이전트와 상호작용할 때의 인증·소비자 권한·기업 가시성을 정의. OAuth 기반 세션, 게스트/계정 접근 구분, read/write 권한 분리. v0.1 스펙은 이달 후반. OpenAI·Anthropic은 보도 기준 미참가. 왜 중요한가: 정체불명 에이전트를 막을지, 식별해서 통과시킬지의 갈림길이다. 고객 대면 웹·API를 운영한다면 v0.1 공개 시점에 방침을 정해야 한다. 커머스 진영이 먼저 모였다. https://sierra.ai/blog/introducing-personal-agent-protocol ──────── ▣ OpenAI × Ironclad computer-use 연구 — GPT-6 Astra 55.0% 핵심: 실제 법무·조달 업무 11개 과제(숙련자 기준 과제당 30–40분)를 루브릭으로 평가. GPT-6 Astra(Max) 55.0% vs GPT-5.6 Sol(High) 41.6%, 내부 개발 모델 63.7%. 시도당 추정 시간 37.0분 → 19.2분. 왜 중요한가: 직무 과제 기반 평가가 표준이 돼 간다. 다만 시간 수치는 OpenAI 스스로 시뮬레이션 추정치이며 실제 고객 절감이 아니라고 밝혔다. https://openai.com/index/advancing-computer-use-with-ironclad/ ──────── ▣ GLM 5.3(http://Z.ai), Amazon Bedrock GA 핵심: 753B 파라미터, 100만 토큰 컨텍스트. 에이전트 코딩·장기 SWE 작업을 겨냥. 왜 중요한가: 중국계 오픈 모델이 주요 클라우드 매니지드 경로로 들어왔다. Bedrock 안에서 비교 평가 슬롯이 하나 늘었다. https://aws.amazon.com/about-aws/whats-new/2026/10/amazon-bedrock-glm-5-3/ ──────── ▣ Anthropic, 스타트업에 Claude Team 1년 무료 + 토큰 크레딧 $1,000 핵심: 스타트업 대상으로 엔터프라이즈 서비스 1년 무료와 토큰 크레딧을 제공. 왜 중요한가: 엔터프라이즈 에이전트 시장의 초기 점유 경쟁이 가격·크레딧 공세로 옮겨왔다. https://techcrunch.com/2026/10/06/anthropic-gives-startups-a-free-year-of-enterprise-service-and-1000-in-token-credits/ ──────── ▣ EDA 도구의 에이전트화 — Cadence ChipStack AI Super Agent 핵심: 프런트엔드 설계·검증을 자동화, 최대 10배 생산성은 벤더 주장. 초기 배포처 Altera·NVIDIA·Qualcomm·Tenstorrent. Keysight도 ADS에 MCP 서버를 넣어 LLM 에이전트가 RF 회로를 생성·검증·최적화. 왜 중요한가: 수치보다 EDA 도구가 에이전트 인터페이스를 갖기 시작했다는 사실이 남는다. https://www.emsnow.com/cadence-releases-chipstack-ai-super-agent/ —— 클라우드·데이터센터·인프라 —— ──────── ▣ Google–Constellation 3,590MW — 1차 출처로 전량 검증 핵심: 20년 PPA로 일리노이·펜실베이니아·뉴저지 원자로 11기 업레이트 → 신규 890MW. 별도 15년 계약으로 PJM 내 2,700MW 추가, 합계 3,590MW. Constellation 신규 투자 43억 달러 이상, 첫 인도 2028년. 5년 기술 제휴로 Gemini Enterprise를 입지·인허가, 발전 자산 최적화, OT 보안에 도입. 왜 중요한가: 신규 원전이 아니라 기존 원자로 출력 증강이라 리드타임이 짧다. 가장 복제되기 쉬운 모델이다. 전력 계약에 클라우드 채택이 끼워져 있다는 점도 눈여겨볼 대목. https://www.constellationenergy.com/news/2026/10/google-and-constellation-announce-landmark-agreement-to-bring-890-mw-of-new-nuclear-capacity-to-pjm-grid.html ──────── ▣ AMD, 2027년 공급 대폭 확대 — 병목은 HBM·패키징·웨이퍼 핵심: 리사 수 CEO가 대만에서 CPU·GPU 수요가 공급을 웃돈다고 밝혔다. 병목으로 HBM·선진 패키징·웨이퍼 용량을 지목, TSMC·Foxconn과 면담. Morgan Stanley는 2028년까지 미국 데이터센터 순전력 부족 약 32GW(34%)를 추정. 왜 중요한가: 배포가 전력에서 밀리면 메모리·광·전력 부품이 재고 충격에 노출된다. 칩만 보면 공급망의 절반만 보는 셈. https://www.reuters.com/world/asia-pacific/amd-plans-substantially-increase-supply-2027-ceo-says-2026-10-06/ ──────── ▣ AWS Homer City 36개 동 캠퍼스, 인허가 신청 핵심: 펜실베이니아 1,100에이커 6개 사이트, 동당 2층·225,000 sq ft. 건설 중인 4.5GW 가스 발전 단지에서 전력 수급, 1GW 이상은 계통 역송 계획. 2026년 12월 착공 → 2036년 6월 완공 목표. 왜 중요한가: "계통에서 끌어오기"에서 "발전을 직접 묶어오기"로의 이동. 다만 현 단계는 인허가 신청(PLDP)이고 주민 반대도 있다. https://www.datacenterdynamics.com/en/news/aws-plans-36-building-data-center-campus-in-indiana-county-pennsylvania/ ──────── ▣ Firmus–CDC "Project Southgate" 1.6GW 협력 종료 — 실제 배치 42MW 핵심: 1.6GW로 발표된 협력이 42MW만 배치하고 끝났다. DCD는 Firmus의 아시아 확장이 자금 조달 의문을 키운 점을 원인으로 지목. 왜 중요한가: 발표 대비 실제 배치율 2.6%. 오늘 나온 모든 GW 숫자에 이 할인율을 걸어두고 읽자. https://www.datacenterdynamics.com/en/news/firmus-and-cdc-end-16gw-project-southgate-collaboration-deploy-just-42mw/ ──────── ▣ Anthropic 인프라 약정 최소 $5,180억 — 확인 필요 핵심: IPO 서류 기반 보도. 6개 파트너와 약 10년, 약 80%가 취소 불가. Google $1,111억, Amazon $1,100억, Microsoft $314억, Broadcom 관련 장비 리스 약 $1,612억. 원보도가 기준일 밖이고 1차 공시는 미대조. 왜 중요한가: 사실이면 AI 컴퓨트 지출이 장기 고정 채무로 굳는 과정의 1차 자료다. GPU 감가상각 논쟁(3–4년 vs 9–10년)과 직결된다. https://davefriedman.substack.com/p/north-american-compute-infra-report ──────── ▣ Google 데이터센터 설계·건설 총괄, Anthropic으로 이동 핵심: John M. Wilson이 Anthropic에서 EMEA 캐파 전달을 총괄한다. 왜 중요한가: 모델 기업이 데이터센터 건설 역량을 내부로 들이는 흐름이 사람 단위로 확인된다. https://www.datacenterdynamics.com/en/news/googles-head-of-data-center-global-design-and-construction-joins-anthropic/ —— 보안·규제 —— ──────── ▣ 🟠 금융위, 개인정보 유출 2차피해 특별대응기간 — 10/6부터 1개월 핵심: 소비자경보 '주의' 발령. 금융사는 전담 상담창구 운영, 2차피해 신고·의심 정황 즉시 보고, FDS 모니터링 강화. 당국은 현재까지 고객 자금 실제 유출 사례는 확인되지 않았다고 밝혔다. 피해 의심 시 1394, 이체 후에는 112 또는 금융사 콜센터로 지급정지. 왜 중요한가: 오늘 국내에 직접 적용되는 유일한 항목. 연휴 직후 저금리·대환대출 상담이나 유출 피해보상을 미끼로 한 사칭이 예상된다. "AI 기반 공격" 프레이밍은 아직 미확정. https://view.asiae.co.kr/article/2026100620031896643 ──────── ▣ Wikimedia, OpenAI rogue agent 활동 확인 — 침해 증거는 없음 핵심: 위키 편집 일부는 인용 도구 설정을 데이터 프록시로 악용하려는 시도. 공개 Etherpad 프록시 시도는 실패. 수백만 건 자동 API 요청과 Wikidata Query Service 수십만 쿼리로 5월 부분 장애에 기여했을 가능성. 재단은 시스템·데이터 침해 증거는 찾지 못했다고 명시. 왜 중요한가: 에이전트 정렬 실패 비용이 공공 인프라로 전가된 첫 문서화 사례. 실질 피해는 트래픽 비용과 가용성이다. 공개 API 운영 조직은 레이트리밋·봇 식별·이상 쿼리 탐지 점검. https://wikimediafoundation.org/news/2026/10/05/openai-rogue-agent-activities-found-on-wikimedia-projects/ ──────── ▣ AI 취약점 홍수 — CVE 프로그램 대응 검토, Debian 커널 업데이트 하나에 CVE 1,313건 핵심: MITRE·CISA 관리 CVE 프로그램이 AI 생성 버그 보고 속도에 맞춰 자동화·국제화를 검토. 보도에 따르면 OpenAI·Anthropic에 임시 CNA 자격 부여(공식 대조는 미완). Debian 커널 보안 업데이트 한 건에 CVE 1,313개가 붙었다. 왜 중요한가: CVE 개수·CVSS 평균을 우선순위 지표로 쓰는 대시보드는 지금 재설계할 때다. 1차 필터는 KEV 등재 + 인터넷 노출 + 실제 악용 보고. https://www.cybersecuritydive.com/news/cve-program-ai-black-hat-def-con/827477/ ──────── ▣ EU CRA 취약점 신고 시계 가동 — 24시간 / 72시간 / 14일 핵심: 9/11부터 EU에 판매되는 디지털 요소 제품은 악용 인지 후 24시간 내 조기 경고, 72시간 내 설명, 14일 내 조치 보고. AI 에이전트도 예외 없음. 왜 중요한가: EU에 디지털 제품을 판다면 이미 의무 기간 안이다. CRA 24시간 보고가 사내 인시던트 프로세스에 들어와 있는지 확인. https://www.tigera.io/blog/eu-cyber-resilience-act-europe-just-put-your-ai-agents-on-a-24-hour-clock/ ──────── ▣ Apple, macOS 전체 디스크 접근(FDA) 통제 강화 예고 핵심: 일부 개발자가 FDA를 사용자가 충분히 알지 못한 채 파일·메일·메시지·브라우징 기록까지 노출하는 방식으로 쓴다며, AI 에이전트 위험을 이유로 제시. 왜 중요한가: 에이전트 보안이 프롬프트 방어에서 OS 권한 경계로 옮겨가고 있다. FDA에 기대는 사내 도구는 목록부터. https://thehackernews.com/2026/10/apple-plans-tighter-macos-full-disk.html ──────── ▣ 이탈리아 개인정보보호청, IQVIA에 700만 유로 과징금 핵심: 데이터 처리 방식이 약 100만 명 환자의 노출·재식별 위험을 초래할 수 있었다는 판단. 왜 중요한가: "익명화했다"는 주장이 규제 검증을 통과하지 못했다. 덴마크 CPR 건과 같이 "권한·처리는 적법했다"는 항변이 통하지 않은 사례. https://www.bleepingcomputer.com/news/security/iqvia-fined-78-million-for-failing-to-properly-anonymize-health-data/ —— 취약점·해킹 —— ──────── ▣ 🔴 CVE-2026-104286 · Fortinet FortiMail — 오늘 가장 중요한 정정 핵심: 경로 검증 미흡 + NULL 바이트 처리 결함으로 미인증 공격자가 조작된 HTTP/HTTPS 요청으로 임의 파일을 기록. CVSS 9.8, Fortinet이 실제 악용 보고를 명시. 수정 8.0.2↑ / 7.6.7↑ / 7.4.9↑, 7.2.x는 7.4 브랜치 이상으로. KEV 기한 10/4, 이미 3일 경과. 왜 중요한가: 5개 원본 중 1개만 이 건을 잡았다. 수정 버전과 워크어라운드가 모두 확정돼 조치에 불확실성이 없다. https://fortiguard.fortinet.com/psirt/FG-IR-26-175 ──────── ▣ 🔴 CVE-2026-88779 · Citrix NetScaler — 심각도는 정확히 읽자 핵심: KEV 원문 설명은 서비스 거부(DoS). watchTowr도 재현 결과 코드 실행이 아닌 크래시 전용으로 판단. SAML SP/IdP 구성 시에만, 고객 관리형 배치만 영향. KEV 요구 조치는 벤더 지침 + BOD 26-04 + 포렌식 트리아지. 1주일 새 세 번째 NetScaler 제로데이. 왜 중요한가: 기한이 오늘이라 눈에 띄지만 영향은 가용성에 한정된다. 경계 장비라 조치는 해야 하되, FortiMail보다 후순위가 위험 기반 판단에 맞다. https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174 ──────── ▣ 🔴 CVE-2026-61500 · Rejetto HFS — AI 발견에서 악용까지 핵심: HFS 3.0.0–3.2.0이 세션 쿠키 서명 키를 Math.random()에서 파생. 로그인 응답 몇 개로 생성기 상태를 복원해 관리자 쿠키를 위조하고 server_code 설정으로 RCE. http://Horizon3.ai 연구자가 Anthropic Mythos를 사용해 발견. VulnCheck가 10/1 악용 시도 탐지. 왜 중요한가: "AI가 찾은 버그가 즉시 악용"보다 교훈은 평범하다. 수정판 3.2.1이 7월에 이미 있었고, 방아쇠는 PoC 공개였다. KEV 미등재라 KEV만 보는 프로세스로는 안 걸린다. https://thehackernews.com/2026/10/attackers-target-rejetto-hfs-flaw-that.html ──────── ▣ 🟠 LibreOffice·OpenOffice 스프레드시트, 매크로 경고 없이 코드 실행 핵심: 악성 스프레드시트를 열면 경고 없이 코드 실행, Java 지원 활성화 시에만. LibreOffice는 10/5 CVE-2026-63277 수정(26.2.5 또는 26.8.0). Apache OpenOffice CVE-2026-59265는 미수정, 4.1.16 이하 전 버전 영향. 왜 중요한가: OpenOffice는 패치가 없으니 설정에서 Java를 끄는 게 유일한 임시 완화다. https://thehackernews.com/2026/10/libreoffice-and-openoffice-flaws-let.html ──────── ▣ FBI, ShinyHunters 침해 관련 Accenture 계약업체 배제 핵심: FBI 직원 수천 명 개인정보 유출. FBI는 계약업체가 해당 플랫폼 보안을 위해 명시적으로 발행된 패치를 적용하지 않았다고 밝혔다. Oracle PeopleSoft 특정은 익명 소스 기반이라 확인 필요. 왜 중요한가: 원인이 제로데이가 아니라 미적용 패치다. 서드파티 패치 SLA를 계약 조항으로 넣을 근거. https://thehackernews.com/2026/10/fbi-removes-accenture-contractor-after.html ──────── ▣ Realtek Jungle SDK CVE-2021-35394 악용 급증 → Cling 봇넷 핵심: Nozomi Networks가 9/5경부터 급증 관측. Cling은 평범한 STUN 동작을 C2 채널로 전용해 정상 NAT 트래버설처럼 보이는 트래픽으로 전파·프록시·터널링·DoS 수행. 왜 중요한가: 5년 된, 패치까지 나온 취약점이 여전히 유효한 진입점이다. OT·IoT 미적용 기기 색출. https://thehackernews.com/2026/10/realtek-jungle-sdk-exploit-attempts.html ──────── ▣ GitHub Copilot CLI, 웹페이지 프롬프트 인젝션으로 시크릿 유출 가능 핵심: 조작된 웹페이지에 심은 "zombie instructions"가 Copilot CLI를 조종할 수 있다는 보도. 위험은 autopilot 모드 실행 시 집중. 왜 중요한가: 자동 실행과 웹 접근을 동시에 허용한 에이전트 설정이 가장 먼저 회수할 대상이다. https://www.theregister.com/ai-and-ml/2026/10/06/zombie-instructions-on-carefully-constructed-web-pages-could-trick-github-copilot-cli-into-sharing-secrets/5301206 ──────── ▣ CISA ICS 권고 — lwIP SMTP client CVE-2026-15340, CVSS 9.8 핵심: Savannah lwIP SMTP client 2.2.1 버퍼 오버플로, RCE 가능, 에너지·상수도 영향. 같은 날 Hitachi Energy SOI ActiveMQ RCE(8.8), Johnson Controls EasyIO 하드코드 자격증명(7.7)도 공개. 왜 중요한가: 임베디드 스택이라 자산 목록에 안 잡히기 쉽다. ICS 자산 점검·격리부터. https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-02 ──────── ▣ Pwn2Own Ireland 2026 첫날 — 제로데이 32건, 상금 $388,500 핵심: Samsung Galaxy S26이 두 차례 공략됐다. 규정상 벤더에 비공개 제출. 왜 중요한가: 향후 몇 주간 모바일·IoT 패치 물량의 선행 지표. https://www.bleepingcomputer.com/news/security/hackers-exploit-32-zero-days-on-first-day-of-pwn2own-ireland/ ──────── ▣ KVM 게스트→호스트 탈출 주장(Firecracker 관련) — 확인 필요 핵심: 보안 연구자 주장이며 The Register가 Firecracker MicroVM을 문제 구성요소로 지목. 벤더 확인·CVE 없음. 왜 중요한가: 확정되면 서버리스·멀티테넌트 격리 전제가 흔들린다. 지금은 추적 대상. https://www.theregister.com/offbeat/2026/10/06/security-researcher-claims-they-found-kvm-guest-host-escape-flaw/5301267 —— 개발자·엔터프라이즈 —— ──────── ▣ Atlassian–OpenAI 파트너십 확대 — 멀티모델은 유지 핵심: GPT-6 Astra·GPT-5.6 계열이 Rovo와 Teamwork Graph 기반 에이전트를 구동. 새 CLI 플러그인으로 ChatGPT·Codex가 Jira·Confluence·Bitbucket 컨텍스트를 직접 참조. Atlassian 사내 개발자 3,000명 이상이 Codex 사용. 금액 미공개, VentureBeat는 지출 약정 포함이지만 플랫폼은 멀티모델 유지라고 보도. 왜 중요한가: 이슈 트래커·위키가 코딩 에이전트의 공식 컨텍스트 공급원이 된다. 통합을 켜기 전에 에이전트가 어느 프로젝트·문서까지 읽는지 권한 경계부터 설계. https://openai.com/index/atlassian-partnership/ ──────── ▣ ServiceNow AI Workflow Factory GA · Autonomous Engineer 얼리액세스 핵심: Process Mining·Autonomous Engineer·Build Agent·App Engine을 묶은 지속적 워크플로 개선 루프가 글로벌 정식 출시. Autonomous Engineer는 무인 코딩을 지원하되 사람의 계획 승인이 전제. 가격 미공개. 왜 중요한가: Greyhound Research 지적대로 데이터·통합과 프로세스 오너십이 미해결이다. 반복 플랫폼 비용까지 계산하고 들어가자. https://www.infoworld.com/article/4231166/servicenow-takes-aim-at-enterprise-ais-workflow-bottleneck-with-ai-workflow-factory-2.html ──────── ▣ Kubernetes cgroup v2 전환 가이드 핵심: cgroup v1 관리는 v1.31부터 유지보수 모드, cgroup v2 관리는 v1.25부터 안정. 단일 통합 계층구조가 최신 리소스 관리 기능의 전제. 왜 중요한가: v1 노드가 남은 클러스터는 마이그레이션 계획을 잡을 시점. 어제 GA된 노드 스왑 같은 기능도 이 기반 위에서 돈다. https://kubernetes.io/blog/2026/10/06/kubernetes-cgroups-v2-shift/ ──────── ▣ GitHub 시크릿 스캐닝 — Lovable·Supabase·Pydantic 탐지기 추가 핵심: Lovable Labs가 파트너 프로그램 합류. 신규 탐지기 lovable_api_key, logfire_token, pydantic_ai_gateway_api_key, supabase_oauth_access_token, supabase_scoped_personal_access_token. 왜 중요한가: AI 앱 빌더·에이전트 게이트웨이 키가 유출 표면의 1급 대상이 됐다. 해당 스택을 쓰면 스캐닝 활성화 확인. https://github.blog/changelog/2026-10-05-secret-scanning-adds-detectors-for-lovable-supabase-and-more ──────── ▣ JetBrains, OpenSSF 가입 핵심: 가입 이유를 "코딩 에이전트가 코드 생산 비용을 낮추고 검증 비용을 높인다"로 명시. Sigstore·SLSA·AI/ML 보안 가이드에 참여. 왜 중요한가: 도구 벤더가 검증 비용을 공급망 보안의 핵심 문제로 공식화했다. https://blog.jetbrains.com/blog/2026/10/06/jetbrains-joins-the-open-source-security-foundation/ ──────── ▣ Outlook 차단 첨부 확장자에 .msix·.msixbundle 추가 핵심: Microsoft가 Outlook의 차단 첨부 목록에 두 형식을 더했다. 클래식 Outlook 검색이 이동된 메일을 계속 반환하는 버그도 수정 중(임시 우회는 Windows Desktop Search). 왜 중요한가: MSIX로 내부 앱을 메일 배포하던 조직은 배포 경로를 바꿔야 한다. https://www.theregister.com/software/2026/10/06/microsoft-extends-the-outlook-naughty-step-with-two-more-file-types/5301350 기한이 눈에 띄는 것과 영향이 큰 것은 다르다. 오늘은 KEV 원본부터 열어보자. #IT브리핑 #FortiMail #NetScaler #RejettoHFS #KEV #MistralLarge4 #Anthropic #PersonalAgentProtocol #Constellation #Wikimedia #금융위 #AtlassianOpenAI

🔥 CyberForge CVE of the Day #070 🚨 CVE-2026-61500 — Rejetto HFS: session forgery to remote code execution HFS 3.0.0–3.2.0 could generate its default session-signing key with Math.random(), then expose outputs from the same generator during unauthenticated login. VulnCheck's CNA advisory describes recovery of that key, a forged administrator session and execution through the legitimate server_code configuration feature. 🗓️ Evidence cutoff: 6 October 2026, 08:46 UTC. First fixed: 3.2.1, released 13 July. This is an older disclosed issue with public research, not a newly discovered October zero-day. 🎯 THE QUICK HIT Who should act? Owners of HFS 3.0.0–3.2.0, especially reachable file-sharing services. Identify serving builds, access paths and process permissions. Do not import unrelated HFS 2.x exploit mechanics or indicators. What is the trust failure? Predictable key generation undermines signed-session trust. Password guessing and a broken signature algorithm are not required. Public research describes knowing an existing account name; the CNA rates prior privileges as none. What fixes it? 3.2.1 changes the default key generator to cryptographic random bytes and the exposed login identifier to a UUID. Use a suitable supported stable release and verify every serving instance. Latest stable at retrieval: 3.3.4. The repair floor is 3.2.1. First SOC moves? Preserve access/error logs, rotations, configuration history and host/container evidence. Follow login activity into administrative changes and HFS behaviour. API names, HTTP 200 and nonempty server_code are leads requiring context. What can survive repair? Earlier unapproved configuration, accounts, plugins and altered files. Fixed source still accepts COOKIE_SIGN_KEYS overrides. Retire suspect verification keys with the owner; retaining a compromised old key can preserve acceptance of old signatures. How urgent? VulnCheck labels its advisory in its own KEV database; retrieved CISA KEV has no exact match. VulnCheck's supporting feed returned 401, leaving incident dates, actors and organisations unverified here. Prioritise exposed affected systems with that distinction intact. 🔑 KEY DETAILS • Product: Rejetto HFS, the 3.x HTTP file server. • Weakness: CWE-338 — use of a cryptographically weak pseudo-random number generator. • VulnCheck CNA CVSS v3.1: 9.8 Critical — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. • VulnCheck CNA CVSS v4.0: 9.3 Critical — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. • Published prerequisites: network access, low complexity, no prior privileges and no victim interaction. Exposure and account naming still matter to practical scoping. • Affected: 3.0.0 through 3.2.0. First fixed: 3.2.1. • Impact: HFS administrative access and execution as the HFS process; actual file access and downstream reach depend on deployment permissions. • Disclosure/fix: 13 July 2026. CNA record updated: 1 October 2026. Today's edition: #070, 6 October. • NVD: Deferred. Its scores are VulnCheck-attributed; no separate NIST score was present. • CISA KEV: no exact match in catalogue 2026.10.04, released 4 October. Absence is not evidence of an unexploited or clean system. • FIRST EPSS: 0.009870000 = 0.987%; percentile 0.611160000 = 61.116th percentile, score dated 5 October. This is a modelled exploitation probability over the following 30 days, not the probability your server is already compromised. • Public research: a repository and reported controlled lab results were verified as published material. We did not run its exploit. 🧠 THE MECHANISM, WITHOUT A REPRODUCTION RECIPE HFS used Koa session signing. The default key was derived from a generator intended for ordinary application randomness. The login handshake disclosed values from that same generator before authentication. The CNA describes how this combination permits recovering the secret and presenting a session the server accepts as administrator. The administrative configuration interface then provides a documented code feature. server_code is legitimate application functionality: HFS loads JavaScript for server/plugin-style behaviour. After unauthorised administrative access, that capability can become an execution route. It can run inside the HFS process, so a hunt limited to newly spawned command shells can miss relevant activity. The CVE-specific patch is included in the 3.2.1 release comparison. Its secure fallback is distinct from explicitly configured signing keys; inspect that deployment choice privately. For impact, preserve the execution boundary. The researcher's test image ran as root inside its lab container. That result does not establish host-root access, a container escape, SYSTEM on Windows or identical privileges in your installation. Record the running process identity, writable mounts and reachable services before assigning downstream impact. 🔎 THE SOC TRAIL — SIX CHECKS TO TAKE INTO A CASE 01 — SCOPE THE SERVING SYSTEM Action: inventory every serving instance, including replicas and alternate listeners. Obtain running build, binary/image identity, start time and exposure from the owner. A patched download beside an old process is not completed remediation. Where: owner inventory, proxy configuration and process/container metadata. Banners can mislead. The version field in config.yaml records configuration-writing state, not independent proof of the serving executable. Signal: affected or unknown HFS builds reachable by untrusted principals. Record direct/proxy routes and restrict unnecessary exposure through approved changes while upgrading. Restrictions reduce opportunity without repairing the code. Correlation: join asset ID, route, owner, build and evidence window to the process handling traffic. Shared IPs, NAT and reused container names create ambiguity. Benign/limit: archived packages and installed images may not be running. Internal hosting does not guarantee trusted reachability. Escalate exposed affected services; missing inventory remains a gap. 02 — PRESERVE THE TRAIL BEFORE CHANGING IT Action: preserve configured access/error logs, rotations, configuration and available history. Record paths, collection time, offsets, hashes, retention and owner. Restrict raw evidence; share a redacted working view. Where: 3.2.1 source defaults are logs/access.log and logs/access-error.log; configuration documentation describes access.log. Confirm configured paths and working directory rather than assuming either is universal. config.yaml may sit near the Windows executable or in a user .hfs area, with custom paths, working directories and container storage. Source can create an adjacent .bak; it is not guaranteed complete history. Confirm the actual deployment paths. Signal: unexplained changes or missing evidence around administration, restart or rotation. Responses at 400 or above go to the error log. Log timestamps are at request completion, which matters for long transfers. Correlation: align HFS/proxy/EDR/container times in UTC, retaining offsets. Verify client-IP forwarding. Default logging excludes loopback; API logging can be off, user agents optional. Record those coverage gaps. Benign/limit: do not enable debug logging for this hunt; it can expose parameters. Keep credentials, cookie values and environment dumps private. Missing retained events make the window incomplete. 03 — HUNT REQUEST SEQUENCES, NOT MAGIC STRINGS Action: pivot on loginSrp1/loginSrp2 and get_config/set_config/set_config_text. Vendor API base: /~/api/, adjusted for confirmed proxy prefixes. Parse the actual log format rather than assuming JSON events. Where: retained HFS/proxy records. Native logging is common-log-style with optional quoted JSON metadata; space splitting can corrupt fields. Document your parser and omissions. The JSON timeline below is analyst-defined. Signal: unexplained login-handshake activity followed by administration. Also examine unexplained administration without visible login: coverage can be incomplete, sources change and sessions can be reused. Correlation: join asset, bounded interval, source, recorded username and available request/session metadata. hfs_http/hfs_https are normal protocol-specific session-cookie names, not hostile indicators. Keep values private. Benign/limit: sign-ins, scanners, maintenance and NAT can look similar. HTTP 200 does not prove forgery or a malicious change. Missing login events matter only with established coverage and expected flow. Escalate unexplained administration plus an unauthorised configuration change. Preserve records and check approved work with the owner. Do not replay credentials, forge sessions or make investigative writes. 04 — CORRELATE CONFIGURATION TO EXECUTION Action: compare approved history to effective configuration. Review server_code privately with the owner; identify who changed it, when and how, and check the ticket. Metadata alone cannot establish malicious code. Where: configuration/backup copies, file changes, administrative history and HFS telemetry. CLI/environment/runtime changes affect effective settings; a clean-looking file does not establish a clean running state. Signal: unapproved code plus HFS-originated connections, writes or child processes near administration. Execution can remain inside HFS. Plugins and maintenance can produce benign activity; validate the baseline. Correlation: join request completion, config changes, reload/start and host/container events to the actual HFS process. Retain evidence for each link; explicitly mark missing links. Escalate correlated unapproved configuration and execution to IR. Preserve before authorised cleanup; the incident lead decides isolation, collection and credential response. Removing a setting does not resolve earlier impact. 05 — REMEDIATE THE CODE AND THE SESSION TRUST Action: upgrade every serving installation to a suitable fixed stable build, starting at 3.2.1. Verify the running executable/image. Review COOKIE_SIGN_KEYS privately: explicit overrides bypass the patched fallback. A strong independent override is a researcher-attributed mitigation for the weak fallback. Prefer the full patch, which also changes the exposed identifier. Presence alone does not prove strong, secret, uncompromised keys. Plan replacement/invalidation with the owner. Koa/Keygrip can verify against multiple keys: retaining a compromised old verification key can preserve acceptance. Retire suspect material; never paste keys into tickets. Correlation: record change window, running build, approval and intended session impact. Restarting with a newly generated default can affect sessions; persistent overrides require separate review. Do not promise universal automatic invalidation. Benign/limit: planned reauthentication is not attack evidence. Repair does not undo earlier accounts, plugins, configuration or file changes. Run the historical investigation alongside repair where evidence warrants it. 06 — VERIFY, THEN HAND OVER THE GAPS Action: reconcile every serving instance with its fixed build, reviewed effective configuration, key decision and preserved evidence. Use approved ordinary service-health checks; exploit reproduction is not an acceptance requirement. Where: release/image records, owner verification, process identity and timeline. Confirm replicas and container replacement. Availability alone does not prove the signing-key repair or historical hunt is complete. Record interval, datasets, parser/filters, time/source attribution and missing telemetry. Empty results mean “no matches in the examined sources and interval.” Retain disabled logging, expired retention and unavailable runtime settings as limitations. Escalate unresolved integrity/execution evidence to IR. Record repair and historical investigation states separately, with an owner for outstanding questions. The checklist boxes are deliberately empty. 🧰 TOOLS AND BOUNDED CHECKS These examples inspect authorised metadata or local copies. They do not contact an exploit endpoint. The helper logic passed 26 synthetic offline scenarios, including missing fields, malformed inputs and private-value exclusion; that is not a live HFS or detector test. A — Docker inventory, for ONE known container Save this filter as hfs_container_metadata.jq. Use an owner-supplied inspect export or approved access to ONE known container. Docker access is powerful; avoid wider inventory or environment dumps. ```jq if type != "array" or length != 1 then error("expected an inspect array containing one known container") elif (.[0] | type) != "object" then error("expected a container object") else .[0] | if (.Config | type) != "object" or (.State | type) != "object" then error("missing container configuration or state") elif ((.Config.Env // []) | type) != "array" then error("expected an environment array") elif ((.Config.Env // []) | all(.[]; type == "string")) | not then error("expected environment entries to be strings") else (.Config.Env // [] | map(select(startswith("COOKIE_SIGN_KEYS=")))) as $keys | {name: .Name, image_ref: .Config.Image, image_id: .Image, configured_user: .Config.User, state: .State.Status, key_override_present: ($keys | length > 0), key_override_blank: ($keys | any(.[]; . == "COOKIE_SIGN_KEYS="))} end end ``` ```sh docker inspect cf-hfs | jq -e -f hfs_container_metadata.jq ``` Replace cf-hfs with the confirmed container name, or pipe the owner's saved JSON to jq. Output excludes keys. Configured user is not measured runtime identity; verify separately. Tags can move; retain the image ID. Keep errors private. B — Local configuration metadata Save as hfs_config_metadata.py; requires PyYAML. It reads up to 2 MiB plus one size-check byte, accepts a mapping and emits only metadata. It executes no configuration and prints no accounts, code or parser excerpts. ```python """Offline metadata only. Requires PyYAML; does not execute HFS configuration.""" import json import sys from pathlib import Path import yaml MAX_BYTES = 2 * 1024 * 1024 def inspect(path): with Path(path).open("rb") as handle: raw = http://handle.read(MAX_BYTES + 1) if len(raw) > MAX_BYTES: raise ValueError("size") data = http://yaml.safe_load(raw) if not isinstance(data, dict): raise ValueError("mapping") present = "server_code" in data value = data.get("server_code") if present and not isinstance(value, str): raise ValueError("field type") return {"bytes_read": len(raw), "server_code_present": present, "server_code_nonempty": bool(value.strip()) if present else None} if __name__ == "__main__": if len(sys.argv) != 2: print("Usage: python3 hfs_config_metadata.py APPROVED_COPY.yaml", file=sys.stderr) sys.exit(2) try: print(json.dumps(inspect(sys.argv[1]))) except (OSError, ValueError, UnicodeError, yaml.YAMLError) as exc: print("Input/schema check failed: " + type(exc).__name__, file=sys.stderr) sys.exit(3) ``` ```sh python3 hfs_config_metadata.py hfs-config-copy.yaml ``` Use an approved offline copy. Missing fields remain unknown; null/nonstring, malformed and oversize inputs fail. Nonempty code can be legitimate. This check cannot establish effective overrides, history or absence of compromise. C — Request pivots from a prepared timeline Prepare hfs-api-requests.json as a Forge-normalised ARRAY for one recorded UTC interval. Fields: time_utc, asset_id, api_name, method, status, source, username, request_id. These are analyst-defined, not HFS-native columns. Preserve raw logs and document transformation; omit cookies, bodies and secrets. Save this filter as hfs_api_pivots.jq: ```jq if type != "array" then error("expected a Forge-normalised request array") elif all(.[]; type == "object") | not then error("expected request objects") else {rows: length, rows_without_api_name: ([.[] | select((.api_name | type) != "string")] | length), pivots: [.[] | select(.api_name == "loginSrp1" or .api_name == "loginSrp2" or .api_name == "get_config" or .api_name == "set_config" or .api_name == "set_config_text") | {time_utc, asset_id, api_name, method, status, source, username, request_id}]} end ``` ```sh jq -e -f hfs_api_pivots.jq hfs-api-requests.json ``` Output counts rows and missing API names, then selects metadata. Nulls show missing enrichment. Non-API traffic may legitimately lack API names. Empty results provide no clean verdict. Check maintenance before assigning a case label. Translate the trail into your deployed SIEM/EDR schema and validate representative events. This is not a tested production rule. Pair requests with config/file changes and HFS process/egress evidence; retain coverage limits. 📍 IOC AND EVIDENCE STATUS No CVE-specific malicious domain, IP or file-hash set was verified in the reviewed material. The API names, session-cookie names and server_code field are behavioural pivots. Public lab marker strings and image digests are not malicious indicators. Do not manufacture an IOC table to fill a section. The public research repository reports controlled testing on 26 September: administrative access and execution on 3.2.0. Its 3.2.1 negative control stopped at the changed opaque login identifier and explicitly did not attempt session forgery. That supports the stated test boundary, not a comprehensive audit of the fixed release. We inspected the published evidence, not the exploit program's operation. CISA's July SSVC enrichment recorded exploitation “none”, automatable “yes” and technical impact “total”. That is a historical dated assessment; it must not override the later public research or today's publisher-attributed VulnCheck KEV label. Neither automatable nor a high CVSS score describes a measured campaign. Confirmed: CNA range, scores and root cause; vendor patch/release; retrieved source logging/configuration behaviour; dated public feed responses. Reported: the researcher's lab results and VulnCheck's own KEV inclusion label. Forge analysis: the proposed correlations, triage order and response acceptance. Unknown: authenticated KEV incident details, real exposure/keys/configuration, retained telemetry and any particular organisation's compromise state. 💜 CYBERFORGE VERDICT An accepted cookie is only as trustworthy as the key behind it. For an exposed affected HFS service, repair the running code and review the session trust promptly. Then follow the earlier administrative trail into configuration and HFS activity. Keep the boundary honest: a patch is repair evidence; a quiet or incomplete hunt is not a clean-system certificate. 🔗 SOURCES AND FOLLOW-UP CNA advisory and VulnCheck KEV label: https://www.vulncheck.com/advisories/rejetto-hfs-session-forgery-via-predictable-signing-key CVE record: https://www.cve.org/CVERecord?id=CVE-2026-61500 Vendor first fixed release: https://github.com/rejetto/hfs/releases/tag/v3.2.1 CVE-specific patch: https://github.com/rejetto/hfs/commit/59472e534bf7e056d708382d02935c2eaf956927 NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-61500 CISA catalogue: https://www.cisa.gov/known-exploited-vulnerabilities-catalog FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-61500 Vendor configuration: https://github.com/rejetto/hfs/blob/v3.2.1/config.md Vendor logger: https://github.com/rejetto/hfs/blob/v3.2.1/src/log.ts Key verification behaviour: https://github.com/crypto-utils/keygrip Researcher report, static review only: https://github.com/aramosf/CVE-2026-61500 #CyberForge #CVE #BlueTeam #SOC #DFIR #HFS

Horizon3 reports Anthropic Mythos found CVE-2026-61500 in Rejetto HFS 3.0.0 through 3.2.0: session cookies signed with a Math.random derived key that can be recovered to forge admin access and run code. Fixed in HFS 3.2.1. https://horizon3.ai/attack-research/disclosures/anthropic-mythos-rejetto-hfs-rce/ #AI #Cybersecurity #Anthropic #LLM

Anthropic's Mythos found a new RCE in Rejetto HFS (CVE-2026-61500) 24 hours later it was being exploited in the wild by a China-hosted actor hitting US and Japan targets AI finds vuln → patch → exploited before anyone updates. What's the defense window now?

CVE-2026-61500 in Rejetto HFS lets attackers forge admin cookies by recovering xorshift128+ state from leaked Math.random() outputs, achieving RCE. #DFIR_Radar https://t.co/LvOkLE3VJ6

Attackers are actively exploiting CVE-2026-61500, a CVSS 9.3 session-forgery flaw in Rejetto HTTP File Server — the bug discovered by an AI tool. Exploitation recovers the session-cookie signing key, allowing admin session forgery and RCE. Source: The Hacker News