⛓️💥 And Now a Critical Apache Vulnerability
The Apache Security team, regarding CVE-2026-119618:
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.
This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.
Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
Apache ranked this "Critical" according to their impact levels, which means it meets the following criteria:
A vulnerability rated with a Critical impact is one which could potentially be exploited by a remote attacker to get Apache to execute arbitrary code (either as the user the server is running as, or root). These are the sorts of vulnerabilities that could be exploited automatically by worms.
The patch was released two days ago. If you're running Apache anywhere, drop what you're doing and update now.
It hasn't been that long since the critical PHP vulnerabilities. And Microsoft should probably reconsider the "365" part of their product names. And all US flights were grounded today.
What will tomorrow bring?