The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.

InfoNews

Apache Patches Critical HTTP Server RCE Found by Anthropic, Google

Source: SecurityWeek(opens in a new tab)
Published: November 12, 2026
Record updated: November 12, 2026

Summary

Apache patched CVE-2026-119618, a critical race condition in mod_http2 that could let unauthenticated attackers execute code on servers with HTTP/2 enabled. The flaw affects Apache HTTP Server 2.4.55 through 2.4.70 and was fixed in 2.4.71 on November 11, after independent reports from Anthropic and Google researchers.

Mitigation

Install Apache HTTP Server 2.4.71 or vendor-supplied packages. Disabling HTTP/2 can temporarily prevent exploitation if updates cannot be deployed immediately.