decrypted · 13 november 2026 · ransomware and cybercrime · vulnerabilities and patching

Apache's HTTP/2 flaw: a critical web server bug found by an AI scanner

A flaw in the web server that sits behind a large share of the internet's websites was fixed on Wednesday, and how it was found is as interesting as the flaw. Apache HTTP Server 2.4.71, released on 11 November, closes CVE-2026-119618. A CVE is the public reference number every known vulnerability gets, and this one is rated critical because it could allow RCE, remote code execution: an unauthenticated stranger running their own code on your server. Apache credits two independent finders, an automated scanner from Anthropic and researchers at Google Cloud. UK organisations should read the absence of confirmed attacks as a countdown, not comfort.

What actually breaks

The fault sits in mod_http2, the module that handles HTTP/2, the faster modern way browsers and servers talk. Apache describes it as improper synchronisation of a shared resource in a routine called assign_headers(). In plain English, it is a race condition. Picture two clerks handed the same ledger and told to write in it at the same moment, each assuming the other is absent. Occasionally they overwrite each other, and the ledger holds something nobody intended. In the server, that corrupted memory can be steered towards running an attacker's code. Affected are Apache HTTP Server 2.4.55 through 2.4.70.

What defenders can see

Wiz, a cloud security firm, says 64% of the cloud environments in its data hold a vulnerable version and 51% have a publicly exposed one, while cautioning that this ignores configuration. That matters: only servers with HTTP/2 switched on are affected.

The sources disagree on exploitation. Wiz said on 11 November that no exploit was available and no attacks had been reported. SecurityWeek reports a public proof of concept that reproduces crashes but does not demonstrate code execution, and says Red Hat claims public research has shown a reliable exploit. Treat that as unresolved. My opinion: early attempts tend to crash servers first, so watch for repeated crashes in error logs. Defiant warns that WordPress updates cannot fix this, so those on shared hosting must ask their host.

The Secure by Design lesson

Apache's own default leaves HTTP/2 off, according to BleepingComputer. Exposure therefore comes from someone, or a hosting image, switching a feature on and nobody recording why. Secure by Design means shipping the smaller attack surface, and giving every added feature a named owner.

The second lesson is speed. An AI scanner reported this bug on 26 October and Google's team found it independently on 3 November. Two parties reached it within eight days, so assume others could.

The cost of applying the lesson is small. Update to 2.4.71 or your distribution's patched package. If you cannot yet, Wiz suggests removing the h2 and h2c references from your configuration and setting Protocols to http/1.1, a one-line change. Then find out which of your servers, and your suppliers' servers, run HTTP/2.

Also this week

Maersk and the inherited system. Maersk confirmed on 11 November that an attacker took data from a system it inherited through an acquisition. The WhiteArmor ransomware group, which listed Maersk on its leak site on 7 November, demands $5 million in bitcoin within 30 days and claims about 100GB, including driver records and plaintext passwords. It says the data came from a platform tied to LF Logistics, a business Maersk acquired in 2022; Maersk has not confirmed that. Those claims are unverified. Maersk says its findings so far strongly suggest no sensitive data has been disclosed, and that the incident is isolated to a local system. It has not said when the intrusion happened or how. The lesson is unglamorous: an acquired system is your system the day the deal closes, so inventory it, rotate its credentials and log it like the rest.

Microsoft 365 falls over. A widespread Microsoft 365 outage on Thursday 12 November disrupted Exchange Online, Teams, SharePoint Online and Copilot. Microsoft said a number of servers became unexpectedly unavailable, straining the rest, and later pointed to a process that sets up secure connections being overwhelmed, with a recent network configuration change being rolled back. It paused deployments and restarted affected servers, and at the last update gave no confirmed time for full restoration. SecurityWeek notes Microsoft has disclosed no evidence of a cyberattack. For UK organisations the question is fallback, not blame: if email and chat vanish for a day, how do you reach staff and customers? A written, rehearsed answer that does not rely on the same supplier is resilience. Hoping is not.

Sources