[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZMeARjxV4HXzcNi5mkr9csqtPPHRilYTptWK4vzX2WQ":3},{"article":4,"iocs":50,"watch_terms":61,"solutions":62,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"6f680fd7-931e-40b0-829b-d80dd39284b8","Apache HTTP Server patches critical HTTP\u002F2 remote code execution flaw","apache-http-server-patches-critical-http-2-remote-code-execution-flaw-e1501a","A critical vulnerability in the HTTP\u002F2 module of Apache HTTP Server could be exploited by an unauthenticated attacker to obtain remote code execution (RCE). [...]","A critical vulnerability (CVE-2026-119618) in Apache HTTP Server's HTTP\u002F2 module allows unauthenticated attackers to achieve remote code execution by corrupting heap memory. The Apache Software Foundation has released a patch, but a significant number of servers remain vulnerable. Wiz estimates 64% of cloud environments have vulnerable resources, with about half publicly exposed.","Apache HTTP Server patches critical HTTP\u002F2 remote code execution flaw CVE-2026-119618.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fapache-http-server-patches-critical-http-2-remote-code-execution-flaw\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F12\u002FApache.jpg","2026-11-12T19:12:55+00:00","2026-11-12T20:00:07.387436+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Apache HTTP Server","product",{"name":21,"type":22},"HTTP\u002F2","technology",{"name":24,"type":25},"Apache Software Foundation","vendor",{"name":27,"type":19},"mod_http2",{"name":29,"type":25},"Wiz",{"name":31,"type":25},"Google Cloud","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,40,45],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55,58],{"type":52,"value":53,"context":54},"cve","CVE-2026-119618","Critical vulnerability in Apache HTTP Server's HTTP\u002F2 module",{"type":52,"value":56,"context":57},"CVE-2026-106023","Null pointer dereference in 'mod_md'",{"type":52,"value":59,"context":60},"CVE-2026-109163","Low-severity data overwrite flaw in 'mod_vhost_alias'",[24,29,31],{"controls":63,"vendors":143},[64,93,118],{"slug":65,"name":66,"problem":67,"products":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":94,"name":95,"problem":96,"products":97},"patch-management","Automated patch management","Known holes get closed in days, not months.",[98,106,110],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":94,"product_name":107,"url":108,"description":109},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":49,"name":119,"problem":120,"products":121},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":139,"product_name":140,"url":141,"description":142},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[144],{"slug":145,"name":146,"logo_path":147,"roles":148},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[149],"reported_by",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":160},"critical-apache-http2-rce-flaw-leaves-64-of-cloud-environments-exposed","Critical Apache HTTP\u002F2 RCE Flaw Leaves 64% of Cloud Environments Exposed","A critical heap memory corruption vulnerability in Apache HTTP Server's HTTP\u002F2 module enables unauthenticated remote code execution, one of the most severe risk profiles possible for a web server component. Despite a patch being available from the Apache Software Foundation, an estimated 64% of cloud environments still run vulnerable versions, with roughly half of those directly exposed to the internet. This gap between patch availability and patch deployment is a recurring and preventable failure pattern. The scale of exposure demonstrates that many organizations lack timely, systematic processes for identifying and remediating critical vulnerabilities in internet-facing infrastructure.",[155,156,157,158,159],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":161,"NIST SP 800-53 SI-2: Flaw Remediation":162,"CIS Control 7: Continuous Vulnerability Management (v8)":163,"CIS Control 2: Inventory and Control of Software Assets (v8)":164,"NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks":165},"NIS2 Article 21(2)(e) mandates security in acquisition, development, and maintenance including vulnerability handling, requiring operators to have processes that ensure timely remediation of publicly disclosed critical vulnerabilities in production systems.","SI-2 explicitly requires organizations to identify, report, and correct information system flaws within defined time frames, which would have mandated timely application of the Apache patch.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; a process compliant with this control would have flagged the Apache CVE and driven patch deployment before 64% of cloud environments remained exposed.","CIS Control 2 requires maintaining an accurate inventory of authorized software; organizations without such an inventory cannot quickly identify all Apache HTTP Server instances that need patching when a critical CVE is disclosed.","This category directly addresses the expectation that once a critical vulnerability like CVE-2026-119618 is identified, organizations must act to mitigate it or formally accept the risk rather than leaving systems unpatched."]