The Apache Software Foundation has patched a critical vulnerability in Apache HTTP Server, one of the world's most widely used web servers. The flaw, CVE-2026-119618, is in mod_http2, the module that handles HTTP/2 traffic, and affects versions 2.4.55 through 2.4.70. According to Red Hat, an attacker who can reach the server can exploit it without authentication and take control of the server process. Red Hat rated it 9.8 out of 10. Only servers with HTTP/2 enabled are affected; servers that serve only HTTP/1.1 are not vulnerable.
The flaw was reported on October 26 by OSS Scanner, Anthropic's free scanning service for open-source projects, which uses the company's AI models. Researchers from Google Cloud Vulnerability Research reported it independently on November 3. Wiz found affected versions in 64% of cloud environments in its data, with 51% publicly exposed, but those figures do not account for whether HTTP/2 is enabled.
According to Wiz, as of November 11 no exploit was available and no attacks had been reported. Red Hat said public research has demonstrated a reliable exploit, without naming it. What to do: update to version 2.4.71 or to your distribution's patched packages. Those who cannot update right away can temporarily disable HTTP/2 in the server configuration. WordPress security updates do not fix the issue, because it is in the web server itself.
