What happened. The Apache HTTP Server project shipped version 2.4.71 on Nov 11 to fix CVE-2026-119618, which Apache rates critical. The bug sits in mod_http2, the module that handles HTTP/2 traffic, in a function called assign_headers(). Apache describes it as heap corruption that can lead to remote code execution. Red Hat scores it 9.8 out of 10 and says an attacker does not need a login to exploit it.
How it works, in plain words. It is a race condition: two threads inside the server touch the same piece of memory without taking turns, and the collision can corrupt memory. A carefully timed stream of HTTP/2 requests can turn that corruption into control of the Apache worker process. Servers that only speak HTTP/1.1 are not affected.
Who found it. Apache credits Anthropic's OSS Scanner, which reported it on Oct 26, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research, who reported the same bug on Nov 3. It is another sign that AI-driven bug hunting is now finding critical flaws in core internet software.
Who is exposed. Affected versions are 2.4.55 through 2.4.70, plus the standalone mod_h2 module 2.0.8 through 2.0.42. Wiz told SecurityWeek that 64% of cloud environments it sees run an affected Apache version and 51% have one exposed to the internet, but those counts ignore whether HTTP/2 is turned on, so the truly exploitable share is lower. As of SecurityWeek's Nov 12 report there were no known attacks; a public proof of concept crashes Apache but does not show code execution, while Red Hat says separate public research demonstrated a reliable exploit.
Do now. Upgrade to 2.4.71 or your distribution's patched package, starting with internet-facing servers and reverse proxies. If you cannot patch today, turn HTTP/2 off (remove h2 from the Protocols line) as a stopgap. WordPress or app-level updates do not fix this; it lives in the web server itself. The same release also fixes CVE-2026-106023 (a mod_md crash, rated important) and a low-severity mod_vhost_alias bug.