thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
A critical flaw in Apache HTTP Server's mod_http2, CVE-2026-119618, can let unauthenticated remote attackers run code on HTTP/2-enabled servers; versions 2.4.55 through 2.4.70 are affected, and 2.4.71 fixes it. Red Hat rates it 9.8 on CVSS and cites public research showing a reliable exploit, while Wiz said no exploit was available and no in-the-wild exploitation was reported.
