Critical CVE-2026-61500 in Rejetto HFS Allows Admin Session Forgery Leading to Remote Code Execution
A critical vulnerability identified as CVE-2026-61500 is being actively exploited in Rejetto HTTP File Server (HFS), allowing remote attackers to forge administrator sessions and achieve remote code execution without authentication.
The issue affects HFS versions 3.0.0 to 3.2.0 inclusive and has been fixed in version 3.2.1. Security teams are urged to prioritize updates for any instances exposed to the internet, as the flaw carries a CVSS 4.0 score of 9.3 and a CVSS 3.1 score of 9.8, and is associated with CWE-338 (use of a cryptographically weak PRNG).
The root cause stems from how HFS generates the signing key for session cookies. Instead of using a cryptographically secure random number generator, the software relies on JavaScript Math.random(), which is intended for general-purpose use rather than security applications. The login flow exposes enough outputs from this generator that a patient attacker can reconstruct its internal state after observing only a few responses.
With the reconstructed state, the attacker can forge valid session cookies granting full administrator privileges. From there, the attacker can abuse the server_code configuration option to execute arbitrary JavaScript on the server side, turning session forgery into a straightforward case of remote code execution.
A Python proof-of-concept exploit was publicly released in late September 2026. On October 1, 2026, exploitation attempts were detected against vulnerable systems in the United States, with activity linked to an unidentified actor operating from China.
Administrators should immediately update to HFS 3.2.1 or later. Prior to patching, organizations are advised to identify all internet-facing instances running versions 3.0.0–3.2.0, restrict administrative interfaces to trusted networks, implement network segmentation, and monitor logs for suspicious activity involving the get_config and set_config endpoints.
As a temporary mitigation, administrators may configure robust signing keys via COOKIE_SIGN_KEYS, although this does not replace the official patch. In cases of suspected compromise, simply applying the update is insufficient; credentials must be rotated, system integrity verified, and configuration changes reviewed.
Related articles
Researcher Develops Kernel Exploit for TP-Link EAP770 to Disable Faulty Qualcomm SFE Offload
A user who purchased the TP-Link EAP770 v1 Wi-Fi 7 access point in 2023 discovered persistent data corruption during large file transfers over Wi-Fi. The root cause was a DMA cache coherency bug in the Qualcomm qca-nss-dp driver combined with SFE/PPE hardware offload that recalculated TCP checksums on corrupted packets. TP-Link ended support for the v1 model before release and provided no firmware updates, while the device's restricted shell prevented the required sysfs writes. The researcher chained CVE-2022-0185 with pipe buffer manipulation to achieve root access, disable the offload features, and stop the corruption without bricking the device. The exploit was developed and tested first in QEMU using the closest available GPL kernel sources from the EAP783 model before being adapted to the live hardware. A separate unrelated bug was also found in the client Wi-Fi card firmware causing connection drops.
Apple iOS Security Architecture: From Power Button to App Launch in Modern Devices
The article examines the complete boot and trust chain in modern iPhones, starting from the immutable BootROM and progressing through iBoot, the XNU kernel, and the Secure Enclave. It explains how Secure Boot verifies signatures but does not guarantee absence of vulnerabilities, allowing exploits like checkm8 to persist across devices. The piece details data protection classes, BFU versus AFU states, and how passcodes interact with hardware-bound keys to limit brute-force attempts. It further describes application sandboxing, entitlements, code signing, and Pointer Authentication (PAC) as layered defenses that raise the cost of exploitation. The analysis shows why modern jailbreaks require multi-stage chains involving kernel read/write, sandbox escapes, and PAC bypasses rather than single vulnerabilities. Overall, the architecture transforms privilege from a simple scalar into a graph of capabilities across isolated components.
Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Enable Unauthenticated Remote Code Execution
Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, both scoring CVSS 9.2, were disclosed on October 21. The flaws allow attackers to execute arbitrary code without authentication by triggering out-of-memory conditions that lead to use-after-free memory corruption. Exploitation involves specially crafted requests that manipulate uninitialized arrays and function pointers, with full chains demonstrated via PHP_SESSION_UPLOAD_PROGRESS and fatal error backtraces. The issues affect PHP versions starting from 5.4 and were discovered using AI tools Gemini 4 Argon and GPT-5.6 Sol, resulting in a patch exceeding 10,000 lines of code. Amazon detected attacks as early as October 17, with Cloudflare later reporting millions of exploitation attempts. Mitigation requires updating to patched versions such as PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, while temporary workarounds include disabling session upload progress and fatal error backtraces.
Trend Micro ZDI Reports on Critical Linux KSMBD Vulnerabilities Leak to Public Mailing Lists Before Patches
Trend Micro Zero Day Initiative inadvertently published detailed vulnerability reports for the Linux kernel's KSMBD component into public mailing lists. Two flaws received CVSS scores of 9.0, enabling remote code execution under specific conditions. One issue involves a race condition during parallel SMB request handling, while the second stems from an incorrect buffer size calculation in the SMB Direct mechanism that requires RDMA and a writable share. Technical details including root causes and reproduction steps became publicly archived before fixes reached end users. The KSMBD maintainer has already merged a patch for ZDI-CAN-33774 into their repository, yet distribution kernels may still lack the update. Additional privilege-escalation and information-disclosure risks in other kernel components were also described in the leaked messages.