From Dev.to
Apache httpd shipped a critical HTTP/2 RCE yesterday, and one of the finders was a machine: CVE-2026-119618 and the three-gate audit
Yesterday, Apache released httpd 2.4.71 with three CVEs, one of them critical: CVE-2026-119618, heap corruption and RCE in mod_http2, a race condition in assign_headers() triggered by concurrent HTTP/...