Hackers scanning for critical Rejetto HFS flaw allowing full server takeover
Attackers are actively scanning for a critical vulnerability in Rejetto HTTP File Server (HFS) that could allow remote attackers to forge admin sessions and execute arbitrary code, security researchers warn. The flaw, tracked as CVE-2026-61500, affects HFS versions 3.0.0 through 3.2.0 and was discovered by Horizon3 using Anthropic's Mythos AI model. The vulnerability has been patched in version 3.2.1, and users are urged to upgrade immediately.
