analiza aiqbench
Anthropic's Mythos AI autonomously discovered a critical vulnerability in Rejetto HTTP File Server caused by the use of non-cryptographic Math.random() for session signing, enabling attackers to forge admin sessions and execute arbitrary code. This finding highlights the persistent risks of relying on standard JavaScript pseudo-random number generators in security-sensitive contexts, even within open-source frameworks like Koa. The incident underscores Mythos's capability to identify high-severity flaws in third-party software through its Project Glasswing initiative.
Anthropic Mythos AI Finds Rejetto HFS Flaw That Lets Attackers Forge Admin Sessions and Execute Code
Anthropic’s Mythos AI has identified a critical vulnerability in Rejetto HTTP File Server that could allow remote attackers to forge administrator sessions and execute arbitrary code. The issue, tracked as CVE-2026-61500, stems from predictable session-signing keys generated through JavaScript’s non-cryptographic Math.random() function. Horizon3 made the finding after joining Anthropic’s Project Glasswing in July 2026, which […] The post Anthropic Mythos AI Finds Rejetto HFS Flaw That Lets Attackers Forge Admin Sessions and Execute Code appeared first on Cyber Security News.
Anthropic’s Mythos AI has identified a critical vulnerability in Rejetto HTTP File Server that could allow remote attackers to forge administrator sessions and execute arbitrary code. The issue, tracked as CVE-2026-61500, stems from predictable session-signing keys generated through JavaScript’s non-cryptographic Math.random() function. Horizon3 made the finding after joining Anthropic’s Project Glasswing in July…
Extras afișat conform termenilor RSS ai publicației · 53 cuvinte · textul integral și figurile sunt pe site-ul publicației
Subiecte conexe
Links #3: 2026/06 Part 1
LessWrong · 15 iun. 2026
Concrete Evaluations to Investigate the OpenAI Model That Hacked Hugging Face
AI Alignment Forum · 3 aug. 2026
Weekly Cyber Security Newsletter Bulletin – Entra ID RCE, Claude Code Ransomware, T-Mobile Cable, Azure Credential Theft +20 Stories
Cybersecurity News · 23 aug. 2026
Weekly Cyber Security Newsletter Bulletin – Certighost Exploit, Checkpoint 0-day, HTTP/2 Flaw, Notepad++ Plugin Abuse +20 Stories
Cybersecurity News · 26 iul. 2026