By Thorsten Meyer | November 12, 2026 | ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Key takeaways
- What happened: The Apache HTTP Server project has fixed a flaw in mod_http2, the module that lets Apache speak HTTP/2. Apache rates it “critical” and says it “can lead to RCE”, remote code execution. It is tracked as CVE-2026-119618.
- Who is affected: Apache HTTP Server 2.4.55 through 2.4.70, and the standalone mod_h2 module from GitHub, versions 2.0.8 through 2.0.42. In practice only servers with HTTP/2 switched on are exposed. Servers that serve only HTTP/1.1 are not, according to Red Hat.
- The fix: Apache HTTP Server 2.4.71, released on November 11, 2026. Red Hat shipped fixed packages the same day. Debian had fixed only its unstable branch when we checked.
- Is it exploited? Not on CISA’s list of exploited flaws when we checked, and Wiz says there are “no reports of exploitation in the wild”. But Red Hat writes that “public research has demonstrated a reliable exploit”. Treat it as urgent.
- The AI angle: Apache credits two finders: “Anthropic’s OSS Scanner”, an AI scanner, and two researchers from Google Cloud Vulnerability Research. Anthropic’s report came first, on October 26.
Products Worth Considering
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
LG UltraGear 34G600A-B 34-Inch Curved WQHD Gaming Monitor, 160Hz
As an affiliate, we earn on qualifying purchases.
A bug in the part of Apache that handles many requests at once
HTTP/2 lets a browser send many requests over a single connection at the same time. Apache’s mod_http2 handles those parallel requests with several threads. That is where the bug sits.
Apache’s advisory describes it in standard vulnerability language: a “Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server’s mod_http2 in assign_headers() can lead to RCE.” The title is shorter: “heap corruption and RCE in assign_headers”.
Red Hat explains it in plainer words: “Due to a thread-safety flaw, one thread can modify memory that belongs to another thread, corrupting the server’s internal memory.” According to Red Hat, “a remote attacker who can reach the web server could exploit this flaw to execute arbitrary commands on the server without any authentication.” Red Hat gives it a CVSS 3.1 score of 9.8 out of 10. NVD had not published its own score yet when we checked.
Apache does not publish exploit details, and neither do we. What matters for admins is the scope and the fix.
Who is affected
Versions. Apache lists Apache HTTP Server “from 2.4.55 through 2.4.70” and “Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.” The fixed upstream release is 2.4.71.
Configuration. The bug lives in the HTTP/2 module. Red Hat says: “This issue affects servers with HTTP/2 (h2 or h2c) enabled via the Protocols directive; servers serving only HTTP/1.1 are not affected.” In Apache’s own documentation, the default is “Protocols http/1.1”, and HTTP/2 must be switched on in the configuration. So check what your configuration says, not what the default is.
Distributions. Most servers get Apache from their Linux distribution, not from apache.org. Here is what the vendors said when we checked on November 12:
- Red Hat rates the flaw “Critical” overall but “Important” for Red Hat Enterprise Linux 9 and 10. Its reason: the mod_http2 packages there “allocate each HTTP/2 stream from a separate allocator, which substantially increases the complexity of exploiting the flaw.” Fixed packages shipped on November 11, for example RHSA-2026:98981 for RHEL 9 and RHSA-2026:98978 for RHEL 10. Red Hat Enterprise Linux 8 and earlier are not affected. Red Hat JBoss Core Services and Red Hat Hardened Images were still listed as “Affected”.
- Debian lists its stable releases bookworm and trixie as “vulnerable”. The fixed package 2.4.71-1 had reached only the unstable branch, sid.
- Ubuntu and SUSE: we found no published advisory for this CVE when we checked.
How many servers? Wiz, a cloud security company, says that “64% of cloud environments have resources vulnerable to CVE-2026-119618” and that “51% of cloud environments have publicly exposed instances.” Wiz adds: “Note that this does not take configuration into account.” These are Wiz’s own customer data, not a count of exploitable servers.
Is anyone exploiting it?
The sources disagree, and that is the honest answer.
Wiz wrote on November 11: “As of the time of this blog’s publication, no exploit is available and there are no reports of exploitation in the wild.” CISA’s Known Exploited Vulnerabilities catalog did not list the CVE when we checked on November 12. That catalog, version 2026.11.10, was released before the CVE went public, so it says little yet.
Red Hat’s statement goes further: “public research has demonstrated a reliable exploit against a default-configured server with the mod_http2 module enabled.” Red Hat does not say who did that research or whether it is published. We found no public exploit code linked from the advisories.
The safe reading: assume working exploits exist or will soon. The window between a fix and the first attacks can be very short, as the OpenSSH SSHole case showed last week.
The timeline
- October 26: Anthropic’s report reaches the Apache security team, according to Apache.
- October 30: The CVE number is reserved, according to the CVE.org record.
- November 3: The report from Google Cloud Vulnerability Research reaches Apache.
- November 11: Apache fixes the bug in the 2.4.x branch and releases 2.4.71. Apache’s Eric Covener posts the advisory to the oss-security mailing list at 12:19 UTC. Red Hat’s CVE entry is dated 12:52 UTC. The CVE record goes live at 14:54 UTC.
- November 12: Wiz’s write-up is posted to Hacker News at 02:11 UTC.
From Anthropic’s report to the release took 16 days. From Google’s report, 8 days.
What admins should do now
1. Find your Apache servers. Check every Apache instance, including containers, reverse proxies and appliances. Note the version and look for h2 or h2c in the Protocols lines of the configuration.
2. Patch. Upgrade to Apache HTTP Server 2.4.71, or install your distribution’s fixed package as soon as it is available. Restart Apache afterwards so the new code runs.
3. If you cannot patch yet, switch HTTP/2 off. Wiz recommends restricting active protocols to HTTP/1.1 “by removing h2 and h2c references”:
Protocols http/1.1Then reload Apache. Browsers can still connect over HTTP/1.1, and according to Red Hat, servers that serve only HTTP/1.1 are not affected. For Debian stable, and for standalone mod_h2 builds, this is the main option for now: when we checked, the newest mod_h2 release on GitHub was still v2.0.42, one of the affected versions.
4. Watch your servers. A successful attack would let someone run commands with the rights of the web server process, according to Wiz. Look for unusual child processes, new files in web directories and outbound connections from web servers.
The release also fixes two smaller bugs: CVE-2026-106023 in mod_md, rated “important”, which can crash a child process, and CVE-2026-109163 in mod_vhost_alias, rated “low”. Apache’s announcement says it encourages “users of all prior versions to upgrade.”
The AI angle
Apache credits “Anthropic’s OSS Scanner, as vulnerability ANT-2026-MAPKT6MZ” as one of the two finders. Anthropic launched OSS Scanner on October 8, 2026. According to Anthropic, the outputs “will be fully model-generated, without human review or triage”, and “it is possible reports will be incorrect or invalid.”
Anthropic also published its own test numbers. Its penetration testers checked 97 critical and high-severity findings from an early version across 48 projects. 85 of them, or 88%, met the bar for Anthropic’s disclosure process, and “only one was invalid”. Anthropic also writes that some maintainers “have told us severity ratings can be inflated or the scanner misunderstood the project’s threat model.”
In this case, the finding held up. But it is worth being precise about what we know. Apache’s timeline lists Anthropic’s report first. Wiz describes the bug as “independently discovered by Anthropic and Google Cloud’s Vulnerability Research Team.” Two human researchers at Google reported the same flaw eight days later. Apache has not said how much of the analysis or the fix came from the AI report. Neither Apache nor Anthropic has said whether a human checked this particular report before it was sent.
The broader point holds either way: AI tools now find serious bugs in core internet software, and that also shortens the time defenders have once a bug is public. I looked at this in Anthropic’s five attack chains and in what GPT-6 Cyber and METR’s report mean for the patch window.
What this means for businesses
Apache often runs where you don’t look. Besides public websites, it also runs internal portals, reverse proxies, admin panels and software appliances. Ask your vendors and hosting providers whether their products use Apache 2.4.55 to 2.4.70 with HTTP/2, and when they ship a fix.
Don’t wait for your distribution if your servers face the internet. Debian stable had no fixed package when we checked. Switching HTTP/2 off is a quick, reversible step that closes the hole on a server you cannot patch today.
Severity depends on the build. Red Hat rates the same bug “Critical” in general and “Important” for its own RHEL 9 and 10 packages. Scanner scores are a starting point; your vendor’s advisory for your exact package is what counts.
What this means for users
Most people have nothing to do. This is a server bug; your browser and your phone are not affected. Websites you use may run Apache, and it is up to their operators to patch.
If you run your own website, a home server or a small business site on Apache, update today. If you use shared hosting, your provider handles Apache; check their status page or ask them. If a NAS, router or other device in your network runs Apache for its web interface, check the maker’s site for updates.
What we don’t know
- Whether there is a public exploit. Wiz says none was available when it published; Red Hat says public research “has demonstrated a reliable exploit” but does not name the research.
- Whether attacks have started. We found no named source reporting attacks in the wild.
- How many servers are exposed. Wiz’s figures do not account for configuration, so they do not tell us how many servers have HTTP/2 switched on.
- When the remaining fixes arrive. Debian stable, Ubuntu, SUSE, Red Hat JBoss Core Services and a new standalone mod_h2 release were all still open when we checked.
- How the two findings relate. Apache lists two separate reports, eight days apart. Whether the AI report included a working exploit, and whether a human reviewed it, has not been published.
The bottom line
A race condition in Apache’s HTTP/2 module can let an attacker run code on a web server. The fix is out, it is simple, and the workaround is one line of configuration. Check your servers today, patch to 2.4.71 or your vendor’s fixed package, and switch HTTP/2 off where you cannot patch yet. The bug was reported first by an AI scanner and then by human researchers. Expect more critical bugs to reach maintainers this way, and plan for shorter patch windows.
I’m Thorsten Meyer. The full sources are below, and more reality checks are at thorstenmeyerai.com.
Sources
- Apache HTTP Server Project: “Apache HTTP Server 2.4 vulnerabilities”, entry CVE-2026-119618, on httpd.apache.org (fixed in 2.4.71, released 2026-11-11)
- Apache HTTP Server Project: “Apache HTTP Server 2.4.71 Released”, November 11, 2026, and the CHANGES file for 2.4.71, on downloads.apache.org
- Eric Covener (Apache): “CVE-2026-119618: Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers”, oss-security mailing list, November 11, 2026
- CVE.org and NVD: CVE-2026-119618, published November 11, 2026
- Apache HTTP Server documentation: Protocols directive (core) and mod_http2, version 2.4 docs
- Red Hat: CVE-2026-119618, Red Hat Customer Portal (checked November 12, 2026)
- Debian security tracker: CVE-2026-119618 (checked November 12, 2026)
- CISA: Known Exploited Vulnerabilities catalog, version 2026.11.10 (checked November 12, 2026)
- mod_h2 project on GitHub: releases page (checked November 12, 2026)
- Wiz: “Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know”, Merav Bar, November 11, 2026
- Anthropic: “Launching an opt-in vulnerability-finding service for open-source software”, Frontier Red Team, October 8, 2026
- Hacker News: story on the Wiz write-up, November 12, 2026, 02:11 UTC
Researched and drafted with AI assistance, including Anthropic’s Claude. Anthropic, whose OSS Scanner is credited as one finder of this bug, also makes Claude; Anthropic did not review or sponsor this article, and neither did any other company or project named here. This article is for information only. It is not legal or security-consulting advice. Statements and package versions as published by the sources above as of November 12, 2026; check your vendor for later updates. Images: AI-generated illustration (Runware) and graphics by Thorsten Meyer AI; no real people or logos are shown.
