Urgent.News

What's breaking now, across thousands of outlets.

Thursday, 12 November 2026 Reading Room

Tech

CVE-2026-119618: Critical Apache mod_http2 Flaw Allows Unauthenticated Remote Code Execution

TL;DR what: CVE-2026-119618 is a code execution flaw in Apache HTTP Server's mod_http2 module that affects versions 2.4.55 through 2.4.70 and standalone mod_h2 2.0.8 through 2.0.42. impact: An unauthenticated attacker who can reach a server with HTTP/2 enabled can take full control of the server process, according to Red Hat. fix: Apache HTTP Server 2.4.71 fixes the flaw, Red Hat has shipped…

dev.to ·

CVE-2026-119618 is a critical code execution flaw found in Apache HTTP Server's mod_http2 module. This vulnerability affects versions 2.4.55 through 2.4.70 and standalone mod_h2 from 2.0.8 through 2.0.42. An unauthenticated attacker with access to an HTTP/2-enabled server can exploit this flaw to take full control of the server process.

Apache HTTP Server developers have released version 2.4.71 to address the issue, but many downstream packages remain unfixed as of November 12. Debian stable, Amazon Linux, and Red Hat JBoss Core Services are among the affected distributions. To mitigate the vulnerability, Red Hat advises disabling HTTP/2 on servers that cannot be updated promptly.

The upstream patch is now available, but many organizations are still vulnerable until they apply the fix or disable HTTP/2.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

This story

This is one outlet's version. Read the fullest account.

Read the original at dev.to →

More in Tech

The new model was 59% cheaper and 75% faster. I still wouldn't ship it.

The migration looked like an obvious win on economics. In one EvalShift run, the candidate model was: 58.8% cheaper 75.2% faster 0 failed or truncated calls Run economics.

  • New model 59% cheaper and 75% faster
  • 13.6% of real-world examples showed regression
  • Tool-selection divergence increased by 25%

·dev.to

Why Does My Pod Take Exactly 30 Seconds to Die?

You run kubectl delete pod , and the pod sits in Terminating . You count. It disappears at almost exactly 30 seconds, every time. Thirty seconds is Kubernetes' default terminationGracePeriodSeconds .

  • When deleting a pod, kubelet enters Terminating state lasting 30 seconds.
  • Application fails to handle SIGTERM, leading to SIGKILL and data loss.
  • Solutions include running binary directly, handling SIGTERM, or using init process.

·dev.to

Управління технічним лімітом з'єднань

Класична проблема росту IT-бізнесу: продукт починає активно продаватися, навантаження росте, і в один прекрасний момент падає база даних через вичерпання ліміту з'єднань.

·dev.to

Freelancer Client Onboarding: A First-Week Checklist That Stops Scope Creep

Freelancer Client Onboarding: A First-Week Checklist That Stops Scope Creep The first week with a new client decides how the whole project goes.

  • First week sets project success, not quality of work
  • Kickoff call establishes success criteria and decision-maker
  • Deposit invoice sent before work begins to track project start

·dev.to

More from Thursday 12 November →