Apache Patches Critical HTTP Server RCE Found by Anthropic, Google

By Eduard Kovacs

AI Summary

Apache patched CVE-2026-119618, a critical race condition in the mod_http2 module of Apache HTTP Server that allows unauthenticated remote code execution on any server with HTTP/2 enabled; the flaw was discovered by researchers at Anthropic and Google. Server administrators running Apache with HTTP/2 should apply the patch immediately, as this attack surface is exposed on a large portion of internet-facing web infrastructure.

Read full article → https://www.securityweek.com/apache-patches-critic…

Relevance score: 83.0/100

# More from November 14

1
Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins The Hacker News
2
Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases The Hacker News
3
Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files The Hacker News
4
New Mior and Skyfall Attacks Let Rogue Cloud Hosts Steal Secrets From AMD SEV-SNP VMs The Hacker News
5
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE The Hacker News
6
New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access The Hacker News
7
FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls The Hacker News
9
SilentAir Hijacks Asian Telecom Networks to Intercept SMS 2FA Codes and Spy on Taiwanese Users The Hacker News
10
Hackers compromise 4,800 GitHub accounts to steal cloud credentials BleepingComputer