Wiz reports CVE-2026-119618, a race in Apache HTTP Server mod_http2 assign_headers(), on versions 2.4.55 through 2.4.70, with 2.4.71 and newer as the fix. For a WordPress or Joomla site, an Apache HTTP/2 host check starts with the company that runs the server.
Key takeaways
- Wiz describes CVE-2026-119618 as a race in mod_http2 assign_headers() on Apache HTTP Server 2.4.55 through 2.4.70, with 2.4.71 and newer named as the fix.
- At the time of publication, Wiz reported no public exploit and no in-the-wild exploitation, and publishes no CVSS score.
- On shared hosting the host upgrades Apache or sets Protocols to http/1.1 and removes h2 and h2c.
Why should a website owner care about this Apache HTTP/2 report?
A WordPress or Joomla site hits this bug only when the host’s Apache offers HTTP/2 on a build inside the range Wiz published. Wiz describes CVE-2026-119618 as a race in assign_headers(): concurrent threads share data without proper synchronization, which can corrupt heap memory. A remote attacker with no account might then run code with the web server user’s privileges. The post calls the issue both critical and high-severity, publishes no CVSS score, and shows no working shell. Wiz credits Anthropic and Google Cloud’s Vulnerability Research Team with independent discovery. Cross-check 2.4.71 on the Apache Software Foundation 2.4 vulnerability list and the NVD entry before you plan maintenance.
The post’s standalone mod_h2 lines conflict: it lists 2.0.8 through 2.0.42 as affected, one cell says 2.0.24 and newer is patched, and the fix text says to move past 2.0.42. On shared hosting the account holder still cannot install the httpd package, the division of responsibility we described in why only your host can patch the server.
How do you run an Apache HTTP/2 host check?
An Apache HTTP/2 host check needs the httpd version and whether this site still negotiates HTTP/2. Wiz lists Apache HTTP Server 2.4.55 through 2.4.70 as affected and 2.4.71 and newer as patched. Hosting that offers only HTTP/1.1 sits outside that attack surface. On shared hosting, HTTP/2 is often left on once the provider installed mod_http2, and that switch belongs to the host. If the host has not shown that h2 and h2c are off, treat a build from 2.4.55 through 2.4.70 as exposed, and a missing version as unknown.
Read the Server header when it includes a version, the server information page in cPanel, Plesk, or DirectAdmin, or a support reply that quotes the Apache package. A header that says only Apache leaves the version unknown. On a server you administer, apachectl -M shows whether http2_module is loaded, and an external HTTP/2 request shows whether the vhost still accepts it.
What should you ask your host to change today?
Ask the host to upgrade Apache HTTP Server to 2.4.71 or later and to reply with the installed version string. When an upgrade has to wait, ask them to turn HTTP/2 off. Wiz’s temporary mitigation is Protocols http/1.1, with h2 and h2c removed from the global config and from every vhost Protocols line. Browsers, WordPress, and Joomla already speak HTTP/1.1, so pages, logins, and plugins keep working. If the host built mod_h2 separately, tell them to follow Apache’s own advisory, not the Wiz table.
What should you review on the site after Apache is patched?
Wiz’s 64 percent and 51 percent figures describe cloud accounts in its own data and skip configuration. They are not a verdict that a shared WordPress site was hacked. Wiz names no threat actor and no malware tied to CVE-2026-119618, and warns a compromised Apache process in a cloud or container could reach neighboring services or a cloud metadata endpoint.
After the host moves to 2.4.71 or later, review the site once the host confirms the server was running 2.4.55 through 2.4.70 with HTTP/2 enabled and signs of compromise are present. Look for PHP files dated outside plugin and theme updates you ran, administrator users you did not create, and redirects, spam pages, or checkout code you did not add. The package update leaves existing PHP files in place.
If the error log shows a segmentation fault in the same window as mod_http2 messages, patch and read the file tree. Those lines do not prove CVE-2026-119618, and Wiz did not publish them as a signature. If the host will not name the build and new admins or strange URLs are already present, start with the file review in our case notes. Once httpd is current, ongoing checks belong in a website protection package. A firewall in front of WordPress can block some requests and still leave the Apache version unchanged, so it does not replace 2.4.71.
FAQ
Is HTTP/1.1-only hosting affected by CVE-2026-119618?
If Apache offers only HTTP/1.1 and neither h2 nor h2c is negotiated, the attack surface Wiz describes is closed. Check the live vhost, because a CDN dashboard may say HTTP/2 while the origin's Protocols line is still http/1.1.
Who patches Apache on shared hosting?
The host does. A WordPress or Joomla administrator cannot upgrade the httpd package.
Does a WordPress core or plugin update fix this Apache bug?
No. WordPress core, Joomla, and plugin updates leave the Apache version unchanged. CVE-2026-119618, as Wiz describes it, sits in mod_http2 on the server.
If the host confirms it has been running 2.4.55 through 2.4.70 with HTTP/2 open and the file tree already looks altered, SiteGuarding can pick up the site review through our website protection package.