CyberSecurity News

Apache Patches Critical HTTP Server RCE Found by Anthropic, Google

SecurityWeek

· November 12, 2026

AI summary

A critical remote code execution vulnerability has been found in Apache HTTP Server, specifically in the mod_http2 module, which could be exploited by unauthenticated attackers. The vulnerability, identified as CVE-2026-119618, is related to a race condition and can be used to execute code on servers that have HTTP/2 enabled. This issue was discovered by researchers at Anthropic and Google. Apache has released patches to address the vulnerability.

Vulnerabilities mentioned

CVE-2026-119618

HIGH

CVSS 8.1

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

Read the full article at SecurityWeekwww.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google/

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to SecurityWeek.