The Apache Software Foundation released security updates for Apache HTTP Server on November 12, 2026, fixing a flaw in its mod_http2 module that lets remote attackers execute arbitrary code. Security researchers from Anthropic OSS Scanner and Google Cloud Vulnerability Research found the bug, which developers track as CVE-2026-119618. Bill Toulas reported for BleepingComputer that Apache HTTP Server powers one out of five websites on the internet today. Because so many public hosts run Apache HTTP Server software, cybersecurity firm watchTowr urged systems teams to patch their systems now or turn off HTTP/2 [1].
The mod_http2 Race Condition
The security flaw stems from broken thread synchronization inside the mod_http2 module. The Apache Software Foundation describes the problem as “Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server’s mod_http2 in assign_headers() can lead to RCE.” That timing bug corrupts heap memory [1].
Security analysts at cloud defense firm Wiz inspected the bug and rated its severity as critical. In their advisory, Wiz researchers explained: “Due to improper synchronization when executing concurrent threads sharing resources, an attacker can trigger heap corruption. This memory corruption can ultimately be leveraged to achieve RCE on the hosting server, allowing unauthorized threat actors to execute arbitrary commands with the privileges of the web server process.” While official CVSS scores are still pending, the threat allows unauthenticated outsiders to seize host control through crafted network traffic [1].
Monitoring teams have seen no live attacks in the wild targeting CVE-2026-119618 so far. Wiz researchers said that while exploit scripts are not public today, hackers often dissect fresh patches within days. Intruders cannot trigger the flaw unless a host turns on HTTP/2 support. Unpatched internet servers face growing exposure [1].
Vulnerable Apache HTTP Server Versions
The flaw impacts Apache HTTP Server versions 2.4.55 through 2.4.70, touching dozens of stable releases used by web hosts worldwide. Separate standalone mod_h2 packages face the same risk across versions 2.0.8 through 2.0.42. Because these builds shipped in Linux distribution packages and container images, server admins must verify specific version numbers. Older releases like version 2.4.54 stay safe from this bug [1].
Beyond the main HTTP/2 flaw, the Apache Software Foundation resolved two other bugs in this maintenance cycle. Developers fixed CVE-2026-106023, a null pointer dereference bug tucked inside the mod_md certificate module. They also patched CVE-2026-109163, which BleepingComputer tracks as a low-severity data overwrite flaw in the mod_vhost_alias component. Neither secondary flaw allows remote code execution on the host. Updating to the latest Apache web server build gives admins clean protection for all three flaws while maintaining steady web performance [1].
Linux distributions have started pushing updated packages to their software repositories. Server admins can run local package queries to check whether their systems load patched code. When vendor repositories lag behind, compiling source code from the Apache Software Foundation resolves the bug [1].
Exposure Across Public Clouds
Cloud scan data gathered by Wiz shows widespread deployment of affected software in commercial environments. According to telemetry findings from Wiz, 64% of cloud environments host vulnerable Apache HTTP Server assets, and roughly half of those systems expose open ports to the web. Those numbers point to thousands of endpoints visible to remote port scanners. Most base Linux clouds keep HTTP/2 disabled by default, meaning mod_http2 never starts up unless administrators manually edit configuration files [1].
Security firm watchTowr verified that the race condition never runs unless admins turn on HTTP/2 in configuration files. Default setups use HTTP/1.1 to process incoming web traffic without touching the broken assign_headers code. When site owners enable HTTP/2 to speed up asset loading, the flaw activates [1].
Public web daemons attract constant probing from threat groups looking for footholds in enterprise infrastructure. Earlier this year, the FBI warned of a critical PHP vulnerability as sites went dark in corporate hosting networks that postponed routine maintenance. Security engineers warn that running unpatched Apache HTTP Server setups with HTTP/2 enabled invites automated intrusion attempts [1].
Mitigations for Apache HTTP Server Hosts
Security teams urge swift defensive action for all organizations running public web infrastructure. Cybersecurity analysts at watchTowr offered blunt guidance for systems teams, telling them to “patch now or drop h2 until you can.” Commenting out the mod_http2 line in server configuration files drops traffic back to HTTP/1.1, shutting down the attack path while engineers schedule software updates [1].
Enterprise software suites face similar patching urgency when unauthenticated remote execution bugs appear in perimeter tools. On the same day as the Apache disclosure, The Hacker News reported that software maker PTC released urgent fixes for CVE-2026-126325, a flaw with a CVSS v4 score of 9.2 out of 10.0. The bug hits PTC Windchill releases 11.0 M030 through 13.1.4.0 and PTC FlexPLM setups. The flaw lets untrusted data slip past validation checks during object decoding, allowing crafted network requests to trigger remote code execution. PTC patched its cloud hosting environments automatically and urged on-premises customers to deploy the update [3].
Initial access brokers and ransomware crews routinely seek out such flaws to breach enterprise networks. Yordan Ganchev, principal threat intelligence specialist at watchTowr, said that PTC platforms represent “a textbook target for initial access brokers and ransomware operators and a significant enabler of triple extortion campaigns.” Ganchev noted that unpatched perimeter software lets intruders steal sensitive business data and halt operations, recalling when Cl0p ransomware groups exploited CVE-2026-12569 in July 2026 [3].
Parallel Memory Risks in Server Stacks
The race condition inside Apache HTTP Server highlights persistent memory corruption risks that affect core server components. In a separate vulnerability report, researcher Mehmet Ince revealed CVE-2026-6460, a 22-year-old zero-day flaw in PostgreSQL core that converts type confusion into reliable remote code execution [2].
Mehmet Ince, an amateur Muay Thai fighter and security advisor, found the flaw after studying memory bugs in extensions like pg_clickhouse, which patched an out-of-bounds write and read chain on June 23. His research into PostgreSQL showed that core Datum carriers do not carry embedded labels specifying their data type. Instead, PostgreSQL references catalog rows in pg_type and numeric types like consttype 23 (int4) to call output functions such as int4in and textout. By abusing LANGUAGE internal to register mismatched functions, Ince proved that type confusion turns numeric values into arbitrary memory pointers that hijack process flow [2].
During walks with his partner Bilge, a staff machine learning engineer at EDB, Mehmet Ince mapped how memory primitives disrupt complex server stacks. Web hosts face similar risks when network services mismanage untrusted data, prompting admins to study probes targeting remote code execution across server daemons. For organizations running Apache HTTP Server, applying the new update keeps web services shielded from memory corruption attacks [1].
- ONLINE NEWS Toulas, B. (2026, November 12). Apache HTTP Server patches critical HTTP/2 remote code execution flaw. BleepingComputer. [Article Link]
- WEBSITE Ince, M. (2026, November 9). How I ended up turning a 22-year-old PostgreSQL type-confusion primitive into RCE (CVE-2026-6460). Mehmet Ince Security Research. [Article Link]
- ONLINE NEWS The Hacker News. (2026, November 12). PTC patches critical Windchill and FlexPLM flaw that could enable remote code execution. The Hacker News. [Article Link]
