MeridianMeridian

Critical Apache HTTP/2 Flaw Allows Unauthenticated Remote Code Execution

A critical vulnerability tracked as CVE-2026-119618 has been identified in the Apache HTTP Server's mod_http2 module, affecting versions 2.4.55 through 2.4.70. The flaw enables remote attackers to execute arbitrary code on affected servers without any authentication, potentially granting full control over the server process. It carries a CVSS score of 9.8 and impacts only systems with HTTP/2 enabled via the Protocols directive using h2 or h2c. Red Hat has released fixes for Enterprise Linux 9 and 10, while the Apache project issued version 2.4.71 to address the issue along with two additional lower-severity bugs. The vulnerability was discovered by Anthropic's OSS Scanner and reported by researchers from Google Cloud Vulnerability Research. Earlier related flaws such as CVE-2026-23918 remain relevant for servers not updated beyond version 2.4.67.

The Hacker NewsTranslated from English

Read at source

A critical flaw in the Apache HTTP Server's HTTP/2 module, mod_http2, can allow a remote attacker to execute arbitrary code on the server without authentication. Tracked as CVE-2026-119618, the vulnerability affects versions 2.4.55 through 2.4.70 and has been fixed in version 2.4.71, released yesterday.

Only servers with HTTP/2 enabled are impacted. An attacker who can reach the server requires no credentials to exploit the issue and could gain full control of the server process. The flaw received a CVSS score of 9.8. Public research has demonstrated a reliable exploit against servers in their default configuration with mod_http2 enabled.

Red Hat rates the flaw as Important rather than Critical on its Enterprise Linux releases because its builds include additional memory allocator protections that make exploitation significantly harder. The company shipped fixes for Red Hat Enterprise Linux 9 and 10 yesterday.

Affected Platforms and Fixes

  • Apache HTTP Server project releases: Fixed in 2.4.71
  • Red Hat Enterprise Linux 9: Fixed as mod_http2-2.0.26-7.el9_9.1
  • Red Hat Enterprise Linux 10: Fixed as mod_http2-2.0.29-5.el10_3.1
  • Debian unstable: Fixed in apache2 2.4.71-1
  • Red Hat Enterprise Linux 6, 7 and 8: Not affected

Administrators are advised to update immediately or disable HTTP/2 by removing h2 and h2c from the Protocols directive, leaving only http/1.1. The vulnerability was reported on October 26 by Anthropic's OSS Scanner and confirmed last week by Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research.

Apache HTTP Servermod_http2CVE-2026-119618CVE-2026-23918
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

eMudhra Revokes Eight More Intermediate CA Certificates After Private Key Handling Failure
Vulns & Exploits

eMudhra Revokes Eight More Intermediate CA Certificates After Private Key Handling Failure

Certificate authority eMudhra has revoked eight additional intermediate CA certificates following an investigation that uncovered improper private key handling during the certificate generation process. The new revocations bring the total to 16 affected certificates, including eight ECDSA keys that were reduced to a single byte by a faulty custom Python script. The same script also processed eight RSA keys outside the protection of hardware security modules, violating the company's certificate policy. Earlier warning signs in June 2025 were not fully investigated, allowing the issue to persist until discovery by researcher Wayne in October 2026. Major browsers and Microsoft released blocking updates, and eMudhra announced it will exit the publicly trusted TLS business. An independent KPMG review is scheduled to deliver findings by December 4.

BleepingComputerNov 11, 2026Translated from English

Zoom Releases Patches for Critical Privilege Escalation Flaws in Workplace for Windows
Vulns & Exploits

Zoom Releases Patches for Critical Privilege Escalation Flaws in Workplace for Windows

Zoom has issued software updates to fix two security vulnerabilities in Zoom Workplace for Windows that could allow unauthenticated remote attackers to escalate privileges. The flaws, tracked as CVE-2026-108186 with a CVSS score of 9.6 and CVE-2026-108187 with a CVSS score of 8.1, both stem from improper input validation and origin validation issues respectively. Successful exploitation requires no special permissions and can be carried out over the network. CVE-2026-108187 affects versions before 7.1.5, while CVE-2026-108186 impacts versions from 7.1.0 up to but not including 7.1.8. This marks the second round of similar high-severity fixes this year after the July remediation of CVE-2026-53412. Users are strongly encouraged to apply the latest patches immediately to reduce exposure.

The Hacker NewsNov 11, 2026Translated from English

Critical Xen Orchestra Authentication Bypass Flaw Exploited in Attacks
Vulns & Exploits

Critical Xen Orchestra Authentication Bypass Flaw Exploited in Attacks

A threat actor has been actively exploiting a critical authentication bypass vulnerability in Xen Orchestra, the web-based management platform for XCP-ng and XenServer environments. The flaw resides in the REST authentication mechanism, where an empty token is mishandled and treated as an unfiltered lookup, allowing the first valid token to be returned and enabling unauthenticated attackers to gain administrator privileges. Vates, the software maker behind the product, confirmed that successful compromise of Xen Orchestra can lead to arbitrary code execution on managed pools and full root takeover of XCP-ng nodes. The same actor also exploited a second vulnerability involving malicious VM imports that can compromise underlying hosts, though a fix for this issue remains under development. The attacks originated from infrastructure including the IP address 91.211.251.112:8001 and Tor exit nodes, with no CVE identifiers assigned to either flaw. Vates has published indicators of compromise and recommended placing Xen Orchestra instances behind dedicated networks, implementing WAF rules, rotating credentials, and performing full reinstalls in confirmed compromise cases.

SecurityWeekNov 11, 2026Translated from English