Apache released patches for a critical vulnerability in Apache mod_http2. Very early in the cycle, but we're watching for patch availability and potential exploitation.

https://ifin.network/t/cve-2026-119618-rce-and-denial-of-service-in-apache-mod-http2/980

#ThreatIntel #ThreatIntelligence

As far as I know, CVE-2026-119618, the Apache mod_http2 RCE vulnerability, is not exploitable on a typical installation. It can crash your processes, of course.

@GossiTheDog has further details.
#apache #httpd

The programming mistake behind CVE-2026-119618 is C, but not C.

Had the code used malloc/free(), all would have been fine. But Apache httpd‘s runtime uses its own memory pools. These are not thread safe:

If you allocate memory from two threads you can corrupt the pools. Just via the allocate calls alone.

The pools are kept internally in several data structures and not visible in calls. Modify the „wrong“ hashtable and things explode under load.

Footguns.

#Debian has released a fix to Apache2 mod_http2 #CVE_2026_119618 vulnerability. Even though this vulnerability could in theory lead to remote code execution it appears to be quite difficult to pull off without some additional infoleak or the typical security controls being unavailable.

#infosec #cybersecurity

Guess I'll urgently disable http/2 on all my web servers. *sighs*

https://ifin.network/t/cve-2026-119618-rce-and-denial-of-service-in-apache-mod-http2/980

#apache

⚠️ Apache HTTP Server – CVE-2026-119618 (CVSS 9.8)

Une vulnérabilité critique dans mod_http2 permet l'exécution de code à distance (RCE) sans authentification, via une corruption mémoire. Versions Apache 2.4.55 à 2.4.70 concernées.

Conditions d'exploitation : le serveur doit être accessible, avec le module mod_http2 chargé et HTTP/2 activé (h2 ou h2c). Des requêtes HTTP/2 concurrentes spécialement construites peuvent déclencher la faille. Les serveurs utilisant uniquement HTTP/1.1 ne sont pas concernés.

🐧 Côté Linux : :linus2:

• Debian 12/13 : vulnérables, correctifs attendus. Sid déjà corrigée. :debian:
• RHEL 9/10 : correctifs disponibles, exploitation plus complexe selon Red Hat (sévérité « Important »).
• RHEL 8 et antérieures : non affectées. :redhat:
• Amazon Linux : correctifs attendus.

Un PoC public est déjà disponible ! Il démontre la corruption mémoire et des plantages d'Apache, mais pas encore une RCE fonctionnelle.
👀
⬇️
https://github.com/googlesky/CVE-2026-119618

Aucune exploitation en masse confirmée à ce stade.

Vérifions nos serveurs Apache exposés à Internet, appliquons les correctifs disponibles ou désactivons temporairement HTTP/2 (Protocols http/1.1), y compris dans les VirtualHosts.

Attention aux correctifs rétroportés par les distributions : la version affichée d'Apache ne suffit pas à déterminer si nous sommes vulnérables....

:debian: https://security-tracker.debian.org/tracker/CVE-2026-119618

:redhat: https://access.redhat.com/security/cve/cve-2026-119618

#CyberVeille #Apache

TIL by default the apache installation on Debian doesn't enabled HTTP/2 support.

Went looking into this since the critical apache vulnerability from yesterday (https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability) sounds bad.

#apache #debian

A severe remote code execution vulnerability has been identified in Apache HTTP Server's mod_http2 module, affecting versions 2.4.55 through 2.4.70 on servers with HTTP/2 enabled.

Tracked as CVE-2026-119618, the flaw has been rated 9.8 out of 10 by Red Hat.

Version 2.4.71 addresses the issue, and administrators unable to update immediately are advised to remove h2 and h2c from their Protocols directive.

https://en.hacks.gr/krisimo-provlima-asfaleias-ston-apache-server-me-kindyno-apomakrysmenis-prosvasis/

#Apache #HTTP2 #CVE2026119618 #RedHat

Apache httpd 2.4.71 Fixes Critical HTTP/2 RCE (CVE-2026-119618): Root Cause, Detection and Patch Guide

https://thecybersecguru.com/news/apache-httpd-2-4-71-cve-2026-119618-http2-rce/

Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

A critical flaw in Apache HTTP Server’s HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday. Only servers with HTTP/2 enabled are affected, according to Red Hat. https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html

CVE-2026-119618

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

https://www.cve.org/CVERecord?id=CVE-2026-119618

#vulnerability #apache #httpd #cve

Update Apache HTTP Server to 2.4.71 now to fix CVE-2026-119618, a critical mod_http2 remote code execution flaw, alongside CVE-2026-106023.

#Apache #ApacheHTTPServer #WebSecurity #Cybersecurity #InfoSec

https://securityonline.info/apache-http-server-cve-2026-119618-rce-fixed/?utm_source=mastodon&utm_medium=jetpack_social

Meanwhile, Vivaldi had an update within 24 hours:

The Chromium update includes a fix for CVE-2026-125350 (Use after free in XML), which has a known exploit in the wild.

https://vivaldi.com/blog/desktop/minor-update-two-8-3/

Microsoft Edge now has a patch for the Google Chromium Use-After-Free zero-day:

The Chromium team reported that CVE-2026-125350 has an exploit in the wild, and this update contains a fix for it.

https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#november-11-2026

Der achte Zero-Day in Google Chrome

Google hat noch eine Chance, die Zahl des Vorjahres zu über treffen. Eben (am 9. November) wurden Updates für Chrome veröffentlicht, die mehrere Sicherheitslücken schließen. Unter denen ist CVE-2026-125350, die bereits für Angriffe ausgenutzt wird (Zero-Day). Das ist die achte bereits ausgenutzte Zero-Day Schwachstelle in Chrome in diesem Jahr, damit kommt Google jetzt schon auf die Summe des Vorjahres*. Noch bleiben knapp zwei Monate Zeit. ;-) Da der Fehler im Browser-Kern von Chromium steckt, müssen sämtliche Chromium-Ableger (Chromium selbst, Opera, Vivaldi) ebenfalls kurzfristig aktualisiert werden. ... Weiterlesen:

https://www.pc-fluesterer.info/wordpress/2026/11/12/der-achte-zero-day-in-google-chrome/

#zeroday #browser #chrome #cybercrime #google #sicherheit #UnplugGoogle #UnplugTrump #wissen

SSHole (CVE-2026-123158): il bug di autenticazione OpenSSH sfruttato in appena 40 ore
#tech
https://spcnet.it/sshole-cve-2026-123158-il-bug-di-autenticazione-openssh-sfruttato-in-appena-40-ore/
@informatica

Alpine box with SSH open? SSHole (CVE-2026-123158, CISA KEV) lets an attacker in with one long password on sshd built without PAM. Run apk upgrade -U -a and restart sshd, or set PasswordAuthentication no.

Also: SonicWall's SAML/MFA bypass, Plex2Shell on QNAP, and an Outlook zero-day now in KEV. GPUStack and FreeSWITCH have fixes; CISA confirmed both exploited this week.

https://patchorpass.beehiiv.com/?utm_source=mastodon&utm_medium=social&utm_campaign=issue-4

#infosec #homelab #linux

Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover

A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server, which occurs if that server is later chosen to take over as the main server while it still lacks some recent changes. MongoDB released fixed versions earlier this week. https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html

MongoDB Server contains a high-severity flaw tracked as CVE-2026-118383 with a 9.5 CVSS rating.

An unauthenticated attacker can trigger a server crash under specific conditions involving lagging replica sets and primary catch-up cleanup.

MongoDB discovered the issue internally and released patched versions.

Cloud-managed clusters receive automatic updates, while self-managed deployments require manual patching across…

https://en.hacks.gr/sovaro-keno-asfaleias-sti-mongodb-pos-mporei-na-katarreysei-i-vasi-dedomenon-sas/

#MongoDB #CVE2026118383 #Database #Vulnerability

A public exploit for CVE-2026-80521, an AF_UNIX use-after-free, enables Linux kernel privilege escalation. Fixed in 7.1.10, 6.12.111 and 7.2.

#Linux #LinuxKernel #CVE202680521 #PrivilegeEscalation #kernelCTF #PoC #CyberSecurity #InfoSec

https://securityonline.info/cve-2026-80521-linux-kernel-privilege-escalation/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-80521: Use-after-free in AF_UNIX ermöglicht Rechteausweitung im Linux-Kernel

Für die Schwachstelle CVE-2026-80521 im Linux-Kernel liegen seit Kurzem technische Details und ein funktionierender Exploit vor. Betroffen ist die Garbage Collection von AF_UNIX-Sockets. Lokale Nutzer können sich damit Root-Rechte verschaffen. Korrigierte Kernel-Versionen stehen bereit.

https://www.all-about-security.de/cve-2026-80521-use-after-free-in-af_unix-ermoeglicht-rechteausweitung-im-linux-kernel/

#linux

Microsoft November 2026 Patch Tuesday Fixes 1,093 Vulnerabilities, including an Outlook Zero-Day (CVE-2026-124194) that can leak a user’s NTLMv2 authentication hash to an attacker.

According to Microsoft’s advisory, an unauthenticated attacker can send a specially crafted message file and trick the recipient into opening it in Outlook. Opening the file can make Outlook connect to an attacker-controlled network location without showing the usual external-content warning. This connection can expose authentication information that an attacker could use to impersonate the victim.

Read more: https://www.windowscult.com/microsoft-patch-tuesday-review/

#PatchTuesday #security #Microsoft

📰 Microsoft Patches Actively Exploited Outlook Zero-Day in Massive Update

Microsoft patches actively exploited Outlook zero-day CVE-2026-124194 in its massive November Patch Tuesday update. The flaw allows attackers to steal NTLM hashes. CISA has added it to the KEV catalog. #PatchTuesday #Outlook #ZeroDay #Cybersecurity

🔗 https://cyber.netsecops.io/articles/microsoft-patches-outlook-zero-day-cve-2026-124194-in-november-update/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Panorama: Sicherheitslücke CVE-2026-0330 erlaubt Codeausführung mit Root-Rechten

Palo Alto Networks hat am 11. November 2026 einen Sicherheitshinweis zu einer Schwachstelle in der PAN-OS-Software veröffentlicht, die auf Panorama läuft. Sie erlaubt es einem authentifizierten Administrator mit Netzwerkzugriff, beliebigen Code mit Root-Rechten auszuführen. Der Hersteller empfiehlt, betroffene Installationen zu patchen.

https://shorturl.at/6U7rF
#schwachstellen #sicherheitsupdates #security

🚨 Microsoft patches Windows Active Directory flaw that could allow attackers to remotely execute malicious code, CVE-2026-119948

Microsoft has released security updates for a high-severity Active Directory vulnerability that could allow attackers with low-level privileges to execute malicious code remotely on affected Windows systems.

The flaw, tracked as CVE-2026-119948 (CVSS 7.5), stems from a stack-based buffer overflow and affects multiple versions of Windows Server 2016 through 2025, Windows 10, and Windows 11.

Successful exploitation requires specific conditions but no user interaction. Microsoft has not identified any active exploitation or publicly available exploit code.

Administrators are urged to deploy the November 2026 security updates, particularly across affected Windows Server environments.

Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119948

No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Need API access? darkwebinformer.com/api-details

Check out the Telegram channel: t.me/SliceForLifeee

🚨 Node.js patches 16 security vulnerabilities, including a serious flaw that could expose TLS private keys

The Node.js project has released security updates addressing 16 vulnerabilities, including seven high-severity flaws affecting its widely used JavaScript runtime.

Among the most concerning is CVE-2026-123864, which could allow unauthenticated attackers to extract sensitive server memory, potentially exposing TLS private keys and other users' requests under specific conditions.

Additional vulnerabilities could allow attackers to crash servers remotely, leak sensitive information, bypass TLS authentication protections, and exhaust system resources.

Security updates are now available in Node.js 22.23.5, 24.22.3, and 26.13.1. Administrators are urged to upgrade affected deployments immediately.

Source: https://nodejs.org/en/blog/vulnerability/november-2026-security-releases

No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Need API access? darkwebinformer.com/api-details

Check out the Telegram channel: t.me/SliceForLifeee

Node.js fixes 17 bugs, including Node.js HTTP/2 vulnerabilities and a TLS heap leak (CVE-2026-123864). Update to 26.13.1, 24.22.3 or 22.23.5.

#NodeJS #HTTP2 #TLS #CVE2026123864 #DoS #JavaScript #CyberSecurity #InfoSec

https://securityonline.info/nodejs-http2-tls-vulnerabilities-november-2026/?utm_source=mastodon&utm_medium=jetpack_social