{
  "id": 19850016,
  "title": "Critical Apache Flaw: Who Updates the Server Behind Your Website?",
  "url": "https://urgent.news/2026/11/13/critical-apache-flaw-who-updates-the-server-behind-your-website",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-13T19:08:17.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/gabbrowick/critical-apache-flaw-who-updates-the-server-behind-your-website-5526"
  },
  "original_language": "en",
  "account": "On November 11th, Apache released version 2.4.71 of its widely-used web server to address a critical flaw, CVE-2026-119618. This vulnerability allows an attacker to execute their own code on the server without any password if HTTP/2 is enabled. The flaw affects Apache versions 2.4.55 to 2.4.70. The problem exists in the mod_http2 module, specifically in a function that handles request headers. Two independent teams reported the issue: Anthropic's automated scanner on October 26th and Google Cloud researchers on November 3rd. Apache rates this vulnerability as critical. Approximately one out of every five websites worldwide runs Apache, including small businesses with brochure sites, WordPress installations, and management tools accessible from outside. The flaw only becomes exploitable when HTTP/2 is enabled, an option that accelerates page loading. Apache ships with it disabled by default, but many hosting providers and technicians activate it for speed. It is impossible to determine whether a site is exposed merely by looking at it; professional assistance is required. Attackers target servers across the internet for flaws like this one, turning small sites into potential targets. Compromised servers can be used to send spam, host scams, or deliver user data from contact forms. The disclosure of this bug comes from an AI tool, which shortens the gap between a vulnerability being announced and the first attacks. To check if your server has been updated, you can run httpd -v or apache2 -v on Red Hat, AlmaLinux, and similar systems, while httpd -v on Debian and Ubuntu. To check if HTTP/2 is enabled, search for the Protocols directive with h2 in the Apache configuration files. Some Linux distributions have already patched the flaw, even if the version number appears lower. If you cannot determine the server version or have doubts, contact your hosting provider or the entity managing your site to confirm they have updated to version 2.4.71 or applied the necessary fixes. If updating is not feasible immediately, disabling HTTP/2 can serve as a temporary workaround, albeit at the expense of slightly slower page loading.",
  "summary": "On 11 November Apache released version 2.4.71 of its web server, one of the most widely used in the world. It fixes a critical flaw, CVE-2026-119618, that lets an attacker run their own code on the server without any password. It affects versions 2.4.55 to 2.4.70 with HTTP/2 enabled. What happened The bug sits in the mod_http2 module, in a function that handles request headers. Two parts of the…",
  "key_points": [
    "Apache released version 2.4.71 to fix critical vulnerability CVE-2026-119618 on November 11th.",
    "Flaw allows code execution without password if HTTP/2 enabled in modhttp2 module."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}