The Apache HTTP Server project released version 2.4.71 on November 11, with a fix for CVE-2026-119618, a flaw in the HTTP/2 module that the project rates critical. A thread-safety bug in mod_http2 can corrupt memory and lead to remote code execution in httpd 2.4.55 through 2.4.70. Red Hat gives the flaw a CVSS score of 9.8, and according … Continue reading Apache Fixes a Critical HTTP/2 Flaw. On Hosting Servers, the Panel Setup Decides Who Is Exposed