A critical Apache HTTP/2 vulnerability, CVE-2026-119618, lets a remote attacker with no login run code on Apache HTTP Server 2.4.55 through 2.4.70 when HTTP/2 is enabled. The upstream fix is 2.4.71, released 11 November 2026. The Hacker News reported the flaw the next day. The server in front of your WordPress or Joomla site is the target. Check whether h2 or h2c is on, and whether you or your host can turn it off today.
