Latest
  1. Anthropic publishes guidance on building AI safety evaluations, with figures from its own tests
  2. Pentagon renames its Chief Digital and AI Office the Super Intelligence Office
  3. Donor software firm Mythos sues Anthropic over its Mythos model name
  4. OpenAI launches ChatGPT Wallet so its dots agents can complete purchases
  5. Cohere completes its AISLE acquisition and adds AI code-review company cubic
  6. Firm founded by Alice Huang listed restricted Nvidia servers in Chinese filings, Bloomberg reports
  7. Senate Banking chair asks Jensen Huang and Howard Lutnick to testify on Nvidia
  8. Tasmania’s AI data centres would each run their own community benefit fund

Latest / Media, elections and online safety

IncidentMediaInternationalConfirmed

Apache patches critical HTTP Server flaw reported by Anthropic’s OSS Scanner and Google researchers

See how this story connects

Source: Apache HTTP Server ProjectAlso reported by SecurityWeek

The Apache HTTP Server Project released version 2.4.71 on 11 November 2026, fixing CVE-2026-119618, a critical flaw in the mod_http2 module that can lead to heap corruption and remote code execution in releases 2.4.55 to 2.4.70. Apache credits Anthropic’s OSS Scanner, which reported it on 26 October 2026, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research, who reported it on 3 November. The release also fixes an important flaw in mod_md and a low-severity flaw in mod_vhost_alias.

Why it matters

Operators running Apache HTTP Server 2.4.55 to 2.4.70 need version 2.4.71 to close the remote code execution flaw; mod_h2 releases 2.0.8 to 2.0.42 from GitHub are also affected.

When
11 Nov 2026
ID
WTA-N-2026-0870
Who
Apache HTTP Server Project, Anthropic, Google; Anthony Weems, Simon Scannell
System
Apache HTTP Server 2.4.55 to 2.4.70 with mod_http2
Operator
operators of Apache HTTP Server
Type
critical remote code execution flaw (CVE-2026-119618) reported by Anthropic’s OSS Scanner and Google Cloud Vulnerability Research
Status
fixed in version 2.4.71, released 11 Nov 2026; disclosed by Apache HTTP Server Project, 11 Nov 2026 · Incident ledger

Summary written with AI by wheresthe.ai, from Apache HTTP Server Project and the reporting credited above. Checked against the source on 12 Nov 2026.

Read the original at Apache HTTP Server Project

Source copy: saved on 12 Nov 2026 to check this story and not republished, because the text belongs to its publisher. Also held by the Internet Archive.

Earlier in this Storyline: What led hereVolta-Autodoxer infostealer uses AI models to profile and rank victims

Cite this story

WTA-N-2026-0870: “Apache patches critical HTTP Server flaw reported by Anthropic’s OSS Scanner and Google researchers.” wheresthe.ai, 11 Nov 2026. https://wheresthe.ai/d/intl-apache-patches-critical-http-server-flaw-reported-by-anth-2026-11/ (source: Apache HTTP Server Project).

Spotted an error? Email [email protected].