As far as I know, CVE-2026-119618, the Apache mod_http2 RCE vulnerability, is not exploitable on a typical installation. It can crash your processes, of course.

@GossiTheDog has further details.
#apache #httpd

A critical vulnerability in the #Apache webserver has been disclosed, which affects #NextcloudPi.
The good news is that a patched version is already available for your system.

You may want to run `sudo apt-get update && sudo apt-get upgrade` to get it faster.

YOU WON'T GET THE FIX IF YOU'RE STILL ON BOOKWORM.

https://security-tracker.debian.org/tracker/CVE-2026-119618

The programming mistake behind CVE-2026-119618 is C, but not C.

Had the code used malloc/free(), all would have been fine. But Apache httpd‘s runtime uses its own memory pools. These are not thread safe:

If you allocate memory from two threads you can corrupt the pools. Just via the allocate calls alone.

The pools are kept internally in several data structures and not visible in calls. Modify the „wrong“ hashtable and things explode under load.

Footguns.

CVE-2026-119618 ist eine 9,8 in `mod_http2` 🥳

We recently pushed an update for Apache's (httpd) mod2_http to our (optional) security repo, patching this upstream CVE: https://access.redhat.com/security/cve/cve-2026-119618

For more info on our security repo, see: https://rockylinux.org/news/2026-05-14-introducing-security-repository

#Debian has released a fix to Apache2 mod_http2 #CVE_2026_119618 vulnerability. Even though this vulnerability could in theory lead to remote code execution it appears to be quite difficult to pull off without some additional infoleak or the typical security controls being unavailable.

#infosec #cybersecurity

TR-103 - Critical Remote Code Execution in Apache HTTP Server `mod_http2` - CVE-2026-119618

🔗 https://www.circl.lu/pub/tr-103/

#cve #vulnerabilitymanagement #cybersecurity #apache

I thought the Cybersecurity Awareness Month is over? But on and on and on it goes: https://www.wordfence.com/blog/2026/11/cve-2026-119618-apache-http2/

Only affects apache web servers where HTTP2 is enabled, but then it could be potentially serious. Debian has already new packages out, and upgrade is as easy as `apt upgrade` (or to be very specific and leave the rest of the system untouched `apt install --only-upgrade apache2`).

So go upgrade now!

#psa #itsec #apache #webserver #upgrade

⚠️ Apache HTTP Server – CVE-2026-119618 (CVSS 9.8)

Une vulnérabilité critique dans mod_http2 permet l'exécution de code à distance (RCE) sans authentification, via une corruption mémoire. Versions Apache 2.4.55 à 2.4.70 concernées.

Conditions d'exploitation : le serveur doit être accessible, avec le module mod_http2 chargé et HTTP/2 activé (h2 ou h2c). Des requêtes HTTP/2 concurrentes spécialement construites peuvent déclencher la faille. Les serveurs utilisant uniquement HTTP/1.1 ne sont pas concernés.

🐧 Côté Linux : :linus2:

• Debian 12/13 : vulnérables, correctifs attendus. Sid déjà corrigée. :debian:
• RHEL 9/10 : correctifs disponibles, exploitation plus complexe selon Red Hat (sévérité « Important »).
• RHEL 8 et antérieures : non affectées. :redhat:
• Amazon Linux : correctifs attendus.

Un PoC public est déjà disponible ! Il démontre la corruption mémoire et des plantages d'Apache, mais pas encore une RCE fonctionnelle.
👀
⬇️
https://github.com/googlesky/CVE-2026-119618

Aucune exploitation en masse confirmée à ce stade.

Vérifions nos serveurs Apache exposés à Internet, appliquons les correctifs disponibles ou désactivons temporairement HTTP/2 (Protocols http/1.1), y compris dans les VirtualHosts.

Attention aux correctifs rétroportés par les distributions : la version affichée d'Apache ne suffit pas à déterminer si nous sommes vulnérables....

:debian: https://security-tracker.debian.org/tracker/CVE-2026-119618

:redhat: https://access.redhat.com/security/cve/cve-2026-119618

#CyberVeille #Apache

TIL by default the apache installation on Debian doesn't enabled HTTP/2 support.

Went looking into this since the critical apache vulnerability from yesterday (https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability) sounds bad.

#apache #debian

https://nvd.nist.gov/vuln/detail/cve-2026-119618

*sigh* Wo kann man nochmal Bauernhöfe auf Island kaufen?

#LebenInDerIT #NeverendingUpdates

Och Menno. Vielleicht können wir uns ja drauf einigen, über den Weihnachtsurlaub keine Lücken zu finden oder so? https://app.opencve.io/cve/CVE-2026-119618

Ubuntu hat für den apache2 CVE-2026-119618 noch keine Seite, ist aber was am machen dran

Und während wir uns gerade von den Sicherheitslücken der letzten Tage erholen:

"Anthropic's OSS Scanner"
https://www.cve.org/CVERecord?id=CVE-2026-119618

#apache #security #ki

🚨 Critical Apache HTTP Server flaw discovered by Anthropic and Google could allow hackers to execute code without authentication; CVE-2026-119618

The Apache Software Foundation has released an urgent security update addressing a critical remote code execution vulnerability in Apache HTTP Server's HTTP/2 module.

The flaw, tracked as CVE-2026-119618, involves a race condition that could allow unauthenticated attackers to corrupt server memory and potentially execute malicious code on vulnerable systems.

The vulnerability was independently discovered by Anthropic's AI-powered OSS Scanner and researchers at Google Cloud.

Apache HTTP Server versions 2.4.55 through 2.4.70 are affected, with version 2.4.71 released to address the issue.

Source: https://httpd.apache.org/security/vulnerabilities_24

No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Need API access? darkwebinformer.com/api-details

Check out the Telegram channel: t.me/SliceForLifeee

A severe remote code execution vulnerability has been identified in Apache HTTP Server's mod_http2 module, affecting versions 2.4.55 through 2.4.70 on servers with HTTP/2 enabled.

Tracked as CVE-2026-119618, the flaw has been rated 9.8 out of 10 by Red Hat.

Version 2.4.71 addresses the issue, and administrators unable to update immediately are advised to remove h2 and h2c from their Protocols directive.

https://en.hacks.gr/krisimo-provlima-asfaleias-ston-apache-server-me-kindyno-apomakrysmenis-prosvasis/

#Apache #HTTP2 #CVE2026119618 #RedHat

Apache httpd 2.4.71 Fixes Critical HTTP/2 RCE (CVE-2026-119618): Root Cause, Detection and Patch Guide

https://thecybersecguru.com/news/apache-httpd-2-4-71-cve-2026-119618-http2-rce/

Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

A critical flaw in Apache HTTP Server’s HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday. Only servers with HTTP/2 enabled are affected, according to Red Hat. https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html

CVE-2026-119618

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

https://www.cve.org/CVERecord?id=CVE-2026-119618

#vulnerability #apache #httpd #cve

Karen IT Security Response Center (@ksrc) Advisory

Advisory ID: KSRC-2026-11121

A #critical race-condition #vulnerability has been identified in the #mod_http2 module of the #Apache HTTP Server. Tracked as CVE-2026-119618, the flaw allows an unauthenticated #remote attacker to trigger heap corruption and achieve remote code execution on servers that have HTTP/2 enabled.

The vulnerability has been assigned a CVSS v3.1 score of 9.8 (Critical). Apache HTTP Server versions 2.4.55 through 2.4.70 are affected. The issue was fixed in version 2.4.71, released on 11 November 2026. Public proof-of-concept material is available.

https://ksrc.karenit.net/blog/security-alert/critical-remote-code-execution-in-apache-http-server-mod-http2

#cve #cyberSecurity #staysafe #StayInformed #StayProtected

PSA: Critical Apache HTTP/2 Vulnerability: What WordPress Site Owners Should Know

If your WordPress site is hosted on Apache, ask your host whether its Apache server accepts HTTP/2 and whether the fix has been installed.

https://www.wordfence.com/blog/2026/11/cve-2026-119618-apache-http2/

#WordPress #Apache #infosec

Too tired to hunt for the config detail that decides if #Apache CVE-2026-119618 needs emergency patching? Our new free scanner checks both conditions that make the RCE risk real:

→ the server runs Apache 2.4.55–2.4.70
→ and HTTP/2 is on

The scan gives you evidence for both: h2c request, server reply, version, port. No crash trigger, no login, no email required.

Check your Apache server: https://pentest-tools.com/network-vulnerability-scanning/cve-2026-119618-scanner-apache-http2-rce

Share it with a fellow sysadmin who needs way too much coffee to get through the day.

#infosec #offensivesecurity

Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover

A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server, which occurs if that server is later chosen to take over as the main server while it still lacks some recent changes. MongoDB released fixed versions earlier this week. https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html

MongoDB Server contains a high-severity flaw tracked as CVE-2026-118383 with a 9.5 CVSS rating.

An unauthenticated attacker can trigger a server crash under specific conditions involving lagging replica sets and primary catch-up cleanup.

MongoDB discovered the issue internally and released patched versions.

Cloud-managed clusters receive automatic updates, while self-managed deployments require manual patching across…

https://en.hacks.gr/sovaro-keno-asfaleias-sti-mongodb-pos-mporei-na-katarreysei-i-vasi-dedomenon-sas/

#MongoDB #CVE2026118383 #Database #Vulnerability

🚨 Critical MongoDB flaw allows unauthenticated attackers to crash database servers, with potential for remote code execution; CVE-2026-118383

MongoDB has released emergency security updates addressing a critical use-after-free vulnerability (CVSS 9.5) that could allow attackers to crash database servers without authentication and potentially execute malicious code under specific conditions.

Researchers at Datadog Security Labs demonstrated how just two specially crafted requests could trigger a crash during a replica set failover, potentially disrupting database availability. Standalone MongoDB instances are not affected.

The vulnerability affects multiple MongoDB Server versions, including 4.4 through 9.0. Patches are available, and administrators are urged to update affected replica set members immediately.

MongoDB says it has found no evidence of exploitation in the wild.

Source: https://www.mongodb.com/community/forums/t/important-mongodb-security-update-available-action-required-november-10-2026/344843

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Need API access? darkwebinformer.com/api-details

Check out the Telegram channel: t.me/SliceForLifeee

CVE-2026-118383: The Pre-Auth MongoDB Use-After-Free That Crashes a New Primary During Failover

https://thecybersecguru.com/news/mongodb-cve-2026-118383-use-after-free/

> * New upstream version 18.7.
> * The fix for CVE-2026-6460 requires recompilation of (almost) all server
> extension packages.

Next to the PostgreSQL updates that were just announced, we also
recompiled all extensions against the new server versions. I didn't
send out update emails for each of them since 100 more emails don't
make the problem better.

Overall, 51519 packages were updated over the last days. (Not
including the PG and LLVM snapshots that get built all the
time anyway.)

https://mehmetince.net/part-3-6-how-i-ended-up-turning-a-22-year-old-postgresql-type-confusion-primitive-into-rce-cve-2026-6460/

Are you deadass Citrix, I can't even right now:

28 CVEs in NetScaler, 9 are critical, 4 are medium (6.9s) but the other 15 are high severity. No mention of exploitation.

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305&articleURL=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin

EDIT: another advisory, h/t @mtaggart https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697320&articleURL=Citrix_NetScaler_Console_Security_Bulletin_for_CVE_2026_120869

#Citrix #NetScaler #CVE

Citrix announced security updates on 12 November 2026 for 12 issues across NetScaler ADC, NetScaler Gateway, NetScaler Console and Secure Access Client for Windows and Linux.

Nine issues in ADC and Gateway could cause unexpected behavior or denial of service.

CVE-2026-120869 could let an unauthenticated attacker bypass checks and access restricted NetScaler Console resources; it is fixed in version 14.1-74.34 an…

https://en.hacks.gr/i-citrix-diorthonei-12-provlimata-poy-mporoysan-na-diakopsoyn-ypiresies-i-na-dosoyn-prosvasi-se-periorismenoys-poroys/

#Citrix #NetScaler #CVE_2026_120869 #SecureAccessClient

Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass

Citrix has patched 12 flaws across NetScaler ADC, NetScaler Gateway, NetScaler Console and the Secure Access Client, including nine critical memory-overflow issues in NetScaler, scored as high as 9.5, that can cause denial of service, and a critical improper-authentication flaw in NetScaler Console (CVE-2026-120869, CVSS 9.4) that lets an unauthenticated attacker bypass authentication. Citrix says the issues were found through AI-assisted code review and that it is not aware of any exploitation. https://thehackernews.com/2026/11/citrix-patches-12-netscaler-and-secure.html

thats a funny one.. imagine using products built by security companies

🔐 CVE-2026-120869

📊 CVSS: 9.3 · Critical
📅 11/12/2026, 03:17 PM
📦 Affected: Citrix NetScaler Console (< 14.1-74.34)
📚 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697320 https://nvd.nist.gov/vuln/detail/CVE-2026-120869

🔗 https://hecate.pw/vulnerability/CVE-2026-120869

#cve #vulnerability #hecate

Citrix NetScaler vulnerabilities fixed: CVE-2026-120868 hits default setups, CVE-2026-120869 bypasses Console login. Upgrade to 14.1-73.57 now.

#Citrix #NetScaler #CVE #Vulnerability #PatchNow #DoS #PrivilegeEscalation #CyberSecurity #InfoSec

https://securityonline.info/citrix-netscaler-vulnerabilities-november-2026/?utm_source=mastodon&utm_medium=jetpack_social

SSHole (CVE-2026-123158): il bug di autenticazione OpenSSH sfruttato in appena 40 ore
#tech
https://spcnet.it/sshole-cve-2026-123158-il-bug-di-autenticazione-openssh-sfruttato-in-appena-40-ore/
@informatica

SSHole (CVE-2026-123158): il bug di autenticazione OpenSSH sfruttato in appena 40 ore

https://spcnet.it/sshole-cve-2026-123158-il-bug-di-autenticazione-openssh-sfruttato-in-appena-40-ore/

Check Point exploited zero-day: CVE-2026-123039 (7.8 high) local privilege escalation to root

Check Point observed an active exploit of this vulnerability against a couple of dozen customers.

https://support.checkpoint.com/results/sk/sk1000362

#CheckPoint #cve #zeroday

Check Point Gateway vulnerability CVE-2026-123039 exploited with PHP2Shell to gain root, plant backdoors and wipe ESXi. Patch to R82.20 Take 14.

#CheckPoint #PHP2Shell #ExploitedInTheWild #PrivilegeEscalation #Wiper #CyberSecurity #InfoSec

https://securityonline.info/check-point-gateway-vulnerability-cve-2026-123039/?utm_source=mastodon&utm_medium=jetpack_social

Check Point Gateway: Sicherheitslücke CVE-2026-123039 wird aktiv ausgenutzt

Angreifer haben eine Schwachstelle im Gaia-Betriebssystem von Check Point bei einigen Dutzend Kunden ausgenutzt. Sie kombinierten sie mit Lücken im Mobile-Access-Portal, um Root-Rechte zu erlangen. Check Point stellt Jumbo-Hotfixes bereit, ab R82.20 Take 14 ist die Lücke geschlossen.

https://www.all-about-security.de/check-point-gateway-sicherheitsluecke-cve-2026-123039-wird-aktiv-ausgenutzt/

#checkpoint #patch #sicherheitslucken #schwachstellen #cybersecurity

Meanwhile, Vivaldi had an update within 24 hours:

The Chromium update includes a fix for CVE-2026-125350 (Use after free in XML), which has a known exploit in the wild.

https://vivaldi.com/blog/desktop/minor-update-two-8-3/

Microsoft Edge now has a patch for the Google Chromium Use-After-Free zero-day:

The Chromium team reported that CVE-2026-125350 has an exploit in the wild, and this update contains a fix for it.

https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#november-11-2026

Der achte Zero-Day in Google Chrome

Google hat noch eine Chance, die Zahl des Vorjahres zu übertreffen. Eben (am 9. November) wurden Updates für Chrome veröffentlicht, die mehrere Sicherheitslücken schließen. Unter denen ist CVE-2026-125350, die bereits für Angriffe ausgenutzt wird (Zero-Day). Das ist die achte bereits ausgenutzte Zero-Day Schwachstelle in Chrome in diesem Jahr, damit kommt Google jetzt schon auf die Summe des Vorjahres*. Noch bleiben knapp zwei Monate Zeit. ;-) Da der Fehler im Browser-Kern von Chromium steckt, müssen sämtliche Chromium-Ableger (Chromium selbst, Opera, Vivaldi) ebenfalls kurzfristig aktualisiert werden. ... Weiterlesen:

https://www.pc-fluesterer.info/wordpress/2026/11/12/der-achte-zero-day-in-google-chrome/

#zeroday #browser #chrome #cybercrime #google #sicherheit #UnplugGoogle #UnplugTrump #wissen

A public exploit for CVE-2026-80521, an AF_UNIX use-after-free, enables Linux kernel privilege escalation. Fixed in 7.1.10, 6.12.111 and 7.2.

#Linux #LinuxKernel #CVE202680521 #PrivilegeEscalation #kernelCTF #PoC #CyberSecurity #InfoSec

https://securityonline.info/cve-2026-80521-linux-kernel-privilege-escalation/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-80521: Use-after-free in AF_UNIX ermöglicht Rechteausweitung im Linux-Kernel

Für die Schwachstelle CVE-2026-80521 im Linux-Kernel liegen seit Kurzem technische Details und ein funktionierender Exploit vor. Betroffen ist die Garbage Collection von AF_UNIX-Sockets. Lokale Nutzer können sich damit Root-Rechte verschaffen. Korrigierte Kernel-Versionen stehen bereit.

https://www.all-about-security.de/cve-2026-80521-use-after-free-in-af_unix-ermoeglicht-rechteausweitung-im-linux-kernel/

#linux

🚨 Palo Alto Networks patches PAN-OS flaw allowing attackers to execute commands with root privileges, CVE-2026-0330

Palo Alto Networks has released security updates for a remote code execution vulnerability in PAN-OS that could allow authenticated administrators to execute arbitrary commands with root privileges on Panorama management systems.

The flaw, tracked as CVE-2026-0330 (CVSS 8.6), affects multiple PAN-OS versions from 10.2 through 12.2. Successful exploitation could give attackers complete control of affected Panorama systems, potentially compromising the infrastructure used to manage enterprise firewalls.

Palo Alto Networks has released patches and recommends restricting management access to trusted internal networks. There is currently no evidence of exploitation in the wild.

Source: https://security.paloaltonetworks.com/CVE-2026-0330

Enterprise-level intel, without the enterprise price tag. Plans for everyone. darkwebinformer.com/pricing

Need API access? darkwebinformer.com/api-details

Check out the Telegram channel: t.me/SliceForLifeee

Panorama: Sicherheitslücke CVE-2026-0330 erlaubt Codeausführung mit Root-Rechten

Palo Alto Networks hat am 11. November 2026 einen Sicherheitshinweis zu einer Schwachstelle in der PAN-OS-Software veröffentlicht, die auf Panorama läuft. Sie erlaubt es einem authentifizierten Administrator mit Netzwerkzugriff, beliebigen Code mit Root-Rechten auszuführen. Der Hersteller empfiehlt, betroffene Installationen zu patchen.

https://shorturl.at/6U7rF
#schwachstellen #sicherheitsupdates #security

📰 Microsoft Patches Actively Exploited Outlook Zero-Day in Massive Update

Microsoft patches actively exploited Outlook zero-day CVE-2026-124194 in its massive November Patch Tuesday update. The flaw allows attackers to steal NTLM hashes. CISA has added it to the KEV catalog. #PatchTuesday #Outlook #ZeroDay #Cybersecurity

🔗 https://cyber.netsecops.io/articles/microsoft-patches-outlook-zero-day-cve-2026-124194-in-november-update/?utm_source=mastodon&utm_medium=social&utm_campaign=daily