Wiz reports CVE-2026-119618, a race in Apache HTTP Server mod_http2 assign_headers(), on versions 2.4.55 through 2.4.70, with 2.4.71 and newer as the fix. For a WordPress or Joomla site, an Apache HTTP/2 host check starts with the company that runs the server.
A critical Apache HTTP/2 vulnerability, CVE-2026-119618, lets a remote attacker with no login run code on Apache HTTP Server 2.4.55 through 2.4.70 when HTTP/2 is enabled. The upstream fix is 2.4.71, released 11 November 2026. The Hacker News reported the flaw the next day. The server in front of your WordPress or Joomla site is the target. Check whether h2 or h2c is on, and whether you or your host can turn it off today.