{"metadata": {"vulnerability": "CVE-2026-119618", "count": 268, "kinds": {"milestone": 20, "sighting": 151, "kev": 0, "other": 97}, "linked_omitted": 0}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0484", "record": "NCSC-2026-0484", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-10-01T16:06:53.028Z", "date_only": false, "value": "2026-10-01T16:06:53.028000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-10-01T16:06:53.028Z", "date_only": false, "value": "2026-10-01T16:06:53.028000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98954", "record": "RHSA-2026:98954", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-10-01T16:06:53.028Z", "date_only": false, "value": "2026-10-01T16:06:53.028000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98968", "record": "RHSA-2026:98968", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-10-01T16:06:53.028Z", "date_only": false, "value": "2026-10-01T16:06:53.028000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98978", "record": "RHSA-2026:98978", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-10-01T16:06:53.028Z", "date_only": false, "value": "2026-10-01T16:06:53.028000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98979", "record": "RHSA-2026:98979", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-10-01T16:06:53.028Z", "date_only": false, "value": "2026-10-01T16:06:53.028000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98981", "record": "RHSA-2026:98981", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-10-01T16:06:53.028Z", "date_only": false, "value": "2026-10-01T16:06:53.028000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98982", "record": "RHSA-2026:98982", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-10-01T23:10:33.829Z", "date_only": false, "value": "2026-10-01T23:10:33.829141+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-10-01T23:10:33.829Z", "date_only": false, "value": "2026-10-01T23:10:33.829141+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98954", "record": "RHSA-2026:98954", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-10-01T23:10:33.829Z", "date_only": false, "value": "2026-10-01T23:10:33.829141+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98968", "record": "RHSA-2026:98968", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-10-01T23:10:33.829Z", "date_only": false, "value": "2026-10-01T23:10:33.829141+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98978", "record": "RHSA-2026:98978", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-10-01T23:10:33.829Z", "date_only": false, "value": "2026-10-01T23:10:33.829141+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98979", "record": "RHSA-2026:98979", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-10-01T23:10:33.829Z", "date_only": false, "value": "2026-10-01T23:10:33.829141+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98981", "record": "RHSA-2026:98981", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-10-01T23:10:33.829Z", "date_only": false, "value": "2026-10-01T23:10:33.829141+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98982", "record": "RHSA-2026:98982", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-10-26T12:00:00Z", "date_only": false, "value": "2026-10-26T12:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / apache", "record": "CVE-2026-119618", "field": "containers.cna.timeline.0.time", "text": "reported (Anthropic)"}, {"timestamp": "2026-10-30T12:32:13.904Z", "date_only": false, "value": "2026-10-30T12:32:13.904Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-119618", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-03T15:50:00Z", "date_only": false, "value": "2026-11-03T15:50:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / apache", "record": "CVE-2026-119618", "field": "containers.cna.timeline.1.time", "text": "reported (Google)"}, {"timestamp": "2026-11-05T14:30:38.080Z", "date_only": false, "value": "2026-11-05T14:30:38.080000+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T14:30:38.080Z", "date_only": false, "value": "2026-11-05T14:30:38.080000+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98954", "record": "RHSA-2026:98954", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T14:30:38.080Z", "date_only": false, "value": "2026-11-05T14:30:38.080000+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98968", "record": "RHSA-2026:98968", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T14:30:38.080Z", "date_only": false, "value": "2026-11-05T14:30:38.080000+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98978", "record": "RHSA-2026:98978", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T14:30:38.080Z", "date_only": false, "value": "2026-11-05T14:30:38.080000+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98979", "record": "RHSA-2026:98979", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T14:30:38.080Z", "date_only": false, "value": "2026-11-05T14:30:38.080000+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98981", "record": "RHSA-2026:98981", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T14:30:38.080Z", "date_only": false, "value": "2026-11-05T14:30:38.080000+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98982", "record": "RHSA-2026:98982", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T14:30:38.080Z", "date_only": false, "value": "2026-11-05T14:30:38.080000+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98998", "record": "RHSA-2026:98998", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T00:00:00Z", "date_only": true, "value": "2026-11-11", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1500", "record": "CERTFR-2026-AVI-1500", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-11-11T12:52:00Z", "date_only": false, "value": "2026-11-11T12:52:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "vulnerabilities.1.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T12:52:00Z", "date_only": false, "value": "2026-11-11T12:52:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98954", "record": "RHSA-2026:98954", "field": "vulnerabilities.1.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T12:52:00Z", "date_only": false, "value": "2026-11-11T12:52:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98968", "record": "RHSA-2026:98968", "field": "vulnerabilities.1.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T12:52:00Z", "date_only": false, "value": "2026-11-11T12:52:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98978", "record": "RHSA-2026:98978", "field": "vulnerabilities.1.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T12:52:00Z", "date_only": false, "value": "2026-11-11T12:52:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98979", "record": "RHSA-2026:98979", "field": "vulnerabilities.1.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T12:52:00Z", "date_only": false, "value": "2026-11-11T12:52:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98981", "record": "RHSA-2026:98981", "field": "vulnerabilities.1.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T12:52:00Z", "date_only": false, "value": "2026-11-11T12:52:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98982", "record": "RHSA-2026:98982", "field": "vulnerabilities.1.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T12:52:00Z", "date_only": false, "value": "2026-11-11T12:52:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98998", "record": "RHSA-2026:98998", "field": "vulnerabilities.1.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T13:47:54Z", "date_only": false, "value": "2026-11-11T13:47:54+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-11T13:47:54Z", "date_only": false, "value": "2026-11-11T13:47:54+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T13:47:54Z", "date_only": false, "value": "2026-11-11T13:47:54+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "vulnerabilities.1.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-11T14:10:53Z", "date_only": false, "value": "2026-11-11T14:10:53+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:98998", "record": "RHSA-2026:98998", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-11T14:10:53Z", "date_only": false, "value": "2026-11-11T14:10:53+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:98998", "record": "RHSA-2026:98998", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T14:10:53Z", "date_only": false, "value": "2026-11-11T14:10:53+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:98998", "record": "RHSA-2026:98998", "field": "vulnerabilities.1.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-11T14:11:46Z", "date_only": false, "value": "2026-11-11T14:11:46+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:98978", "record": "RHSA-2026:98978", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-11T14:11:46Z", "date_only": false, "value": "2026-11-11T14:11:46+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:98978", "record": "RHSA-2026:98978", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T14:11:46Z", "date_only": false, "value": "2026-11-11T14:11:46+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:98978", "record": "RHSA-2026:98978", "field": "vulnerabilities.1.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-11T14:17:42Z", "date_only": false, "value": "2026-11-11T14:17:42+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:98968", "record": "RHSA-2026:98968", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-11T14:17:42Z", "date_only": false, "value": "2026-11-11T14:17:42+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:98968", "record": "RHSA-2026:98968", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T14:17:42Z", "date_only": false, "value": "2026-11-11T14:17:42+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:98968", "record": "RHSA-2026:98968", "field": "vulnerabilities.1.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-11T14:19:26Z", "date_only": false, "value": "2026-11-11T14:19:26+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:98954", "record": "RHSA-2026:98954", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-11T14:19:26Z", "date_only": false, "value": "2026-11-11T14:19:26+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:98954", "record": "RHSA-2026:98954", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T14:19:26Z", "date_only": false, "value": "2026-11-11T14:19:26+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:98954", "record": "RHSA-2026:98954", "field": "vulnerabilities.1.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-11T14:33:32.168Z", "date_only": false, "value": "2026-11-11T14:33:32.168448Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3n226e5xh3x2k", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "6657b290-b843-44da-a94d-f5a682fb1fde", "content": "Update Apache HTTP Server to 2.4.71 now to fix CVE-2026-119618, a critical mod_http2 remote code execution flaw, alongside CVE-2026-106023.\n\n#Apache #ApacheHTTPServer #WebSecurity #Cybersecurity #InfoSec", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3n226e5xh3x2k"}, {"timestamp": "2026-11-11T14:34:56Z", "date_only": false, "value": "2026-11-11T14:34:56+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:98981", "record": "RHSA-2026:98981", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-11T14:34:56Z", "date_only": false, "value": "2026-11-11T14:34:56+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:98981", "record": "RHSA-2026:98981", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T14:34:56Z", "date_only": false, "value": "2026-11-11T14:34:56+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:98981", "record": "RHSA-2026:98981", "field": "vulnerabilities.1.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-11T14:36:37Z", "date_only": false, "value": "2026-11-11T14:36:37+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:98979", "record": "RHSA-2026:98979", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-11T14:36:37Z", "date_only": false, "value": "2026-11-11T14:36:37+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:98979", "record": "RHSA-2026:98979", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T14:36:37Z", "date_only": false, "value": "2026-11-11T14:36:37+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:98979", "record": "RHSA-2026:98979", "field": "vulnerabilities.1.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-11T14:54:08.155Z", "date_only": false, "value": "2026-11-11T14:54:08.155Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119618", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-11T14:55:08.116Z", "date_only": false, "value": "2026-11-11T14:55:08.116000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98998", "record": "RHSA-2026:98998", "field": "vulnerabilities.0.release_date", "linked_record": true}, {"timestamp": "2026-11-11T14:58:55Z", "date_only": false, "value": "2026-11-11T14:58:55+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:98982", "record": "RHSA-2026:98982", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-11T14:58:55Z", "date_only": false, "value": "2026-11-11T14:58:55+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:98982", "record": "RHSA-2026:98982", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T14:58:55Z", "date_only": false, "value": "2026-11-11T14:58:55+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:98982", "record": "RHSA-2026:98982", "field": "vulnerabilities.1.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-11T15:00:54.258Z", "date_only": false, "value": "2026-11-11T15:00:54.258545+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98998", "record": "RHSA-2026:98998", "field": "vulnerabilities.0.discovery_date", "linked_record": true}, {"timestamp": "2026-11-11T15:17:15Z", "date_only": false, "value": "2026-11-11T15:17:15Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-HJHF-GPG9-QQFJ", "record": "GHSA-HJHF-GPG9-QQFJ", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-11T15:17:15.900Z", "date_only": false, "value": "2026-11-11T15:17:15.900", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119618", "record": "FKIE_CVE-2026-119618", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T15:31:05Z", "date_only": false, "value": "2026-11-11T15:31:05Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-HJHF-GPG9-QQFJ", "record": "GHSA-HJHF-GPG9-QQFJ", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T15:55:23.793Z", "date_only": false, "value": "2026-11-11T15:55:23.793Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-119618", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-11T16:00:15Z", "date_only": false, "value": "2026-11-11T16:00:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110157", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "f28bed55-1368-4e4e-bf6b-bf7d6a6568a3", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-119618-scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a realslimsud0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-11 15:58:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nTiered scanner for CVE-2026-119618 (Apache mod_http2 assign_headers RCE): h2 presence, banner range, deterministic race-free CL oracle\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110157", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-11T16:54:14.622Z", "date_only": false, "value": "2026-11-11T16:54:14.622640Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hn100.bsky.social/post/3n22g7ipjcl2f", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "c5b34b22-e594-4f2b-bf28-d69d6fd2afea", "content": "CVE-2026-119618 (critical): mod_HTTP2: heap corruption and RCE in assign_headers\n\nDiscussion", "url": "https://bsky.app/profile/hn100.bsky.social/post/3n22g7ipjcl2f"}, {"timestamp": "2026-11-11T18:04:00.353Z", "date_only": false, "value": "2026-11-11T18:04:00.353344Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117599124839245989", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "cdbc67b5-f648-424c-89ae-dfbf3c89cc9a", "content": "CVE-2026-119618 Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.\nhttps://www.cve.org/CVERecord?id=CVE-2026-119618https://httpd.apache.org/security/vulnerabilities_24.html#apache #ApacheSoftwareFoundation #ApacheHTTPServer#CVE_2026_119618#bot", "url": "https://infosec.exchange/users/cve/statuses/117599124839245989"}, {"timestamp": "2026-11-11T18:04:44Z", "date_only": false, "value": "2026-11-11T18:04:44+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:98998", "record": "RHSA-2026:98998", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-11T19:00:15Z", "date_only": false, "value": "2026-11-11T19:00:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/fw9y2XzO7ZSOkz4j1bwaTCP6Z7UYLr92uyFOPkqiNgrrIe4", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "1595846c-27da-42e0-9a75-10f2585ceeb9", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-11T19:00:15Z", "date_only": false, "value": "2026-11-11T19:00:15.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/fw9y2XzO7ZSOkz4j1bwaTCP6Z7UYLr92uyFOPkqiNgrrIe4", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "bf587536-6aae-403f-b69a-0546373f62e8"}, {"timestamp": "2026-11-11T19:46:05.447Z", "date_only": false, "value": "2026-11-11T19:46:05.447429Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/115741367687413652/statuses/117599524028842689", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "c5af3239-5e68-4885-b287-86cca81eeb95", "content": "Apache released patches for a critical vulnerability in Apache mod_http2. Very early in the cycle, but we're watching for patch availability and potential exploitation.\nhttps://ifin.network/t/cve-2026-119618-rce-and-denial-of-service-in-apache-mod-http2/980\n#ThreatIntel #ThreatIntelligence", "url": "https://infosec.exchange/ap/users/115741367687413652/statuses/117599524028842689"}, {"timestamp": "2026-11-11T21:27:54.854Z", "date_only": false, "value": "2026-11-11T21:27:54.854620Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/betterhn20.e-work.xyz/post/3n22vj4yy5u2v", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "d1285f0a-4143-4c79-bedf-b663951c68fb", "content": "CVE-2026-119618 (critical): mod_HTTP2: heap corruption and RCE in assign_headers https://httpd.apache.org/security/vulnerabilities_24.html (https://news.ycombinator.com/item?id=50453368)", "url": "https://bsky.app/profile/betterhn20.e-work.xyz/post/3n22vj4yy5u2v"}, {"timestamp": "2026-11-11T21:45:57.261Z", "date_only": false, "value": "2026-11-11T21:45:57.261151Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3n22wjc7k7s2a", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "7d9cf082-b2b8-4171-959d-dfe7d4aa2fdc", "content": "Apache HTTP Server\u306e\u8106\u5f31\u6027(Critical: CVE-2026-119618, Important: CVE-2026-106023, Low: CVE-2026-109163)\u30682.4.71\u30ea\u30ea\u30fc\u30b9\n\n#sios_tech #security #vulnerability #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u8106\u5f31\u6027 #apache\n\nsecurity.sios.jp/vulnerabilit...", "url": "https://bsky.app/profile/omo.bsky.social/post/3n22wjc7k7s2a"}, {"timestamp": "2026-11-11T22:41:54.248Z", "date_only": false, "value": "2026-11-11T22:41:54.248104Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/vuldb/statuses/117600217584016014", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "11c96cdc-7d36-4ebd-83e8-c948ef94c33a", "content": "\ud83d\udea8 Some increased actor activities are shown targeting Apache HTTP Server (CVE-2026-119618) https://vuldb.com/vuln/435819/cti", "url": "https://infosec.exchange/users/vuldb/statuses/117600217584016014"}, {"timestamp": "2026-11-11T23:00:00Z", "date_only": false, "value": "2026-11-11T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4517", "record": "WID-SEC-W-2026-4517", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-11T23:00:00Z", "date_only": false, "value": "2026-11-11T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4517", "record": "WID-SEC-W-2026-4517", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T23:00:00Z", "date_only": false, "value": "2026-11-11T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4517", "record": "WID-SEC-W-2026-4517", "field": "vulnerabilities.2.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-11T23:00:00Z", "date_only": false, "value": "2026-11-11T23:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.circl.lu/pub/tr-103/", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "5f7f6136-8ea6-4e27-9e65-c7d6372f84cf", "content": "Introduction\n\nOn 11 November 2026, the Apache Software Foundation disclosed CVE-2026-119618, a critical vulnerability in the Apache HTTP Server HTTP/2 module (mod_http2). A concurrency flaw can cause heap memory corruption and may allow an unauthenticated remote attacker to execute code with the privileges of the Apache web-server process.\n\nThe issue affects Apache HTTP Server 2.4.55 through 2.4.70 and was fixed upstream in 2.4.71, released on 11 November 2026. Separately distributed mod_h2 releases 2.0.8 through 2.0.42 are also listed as affected. Organisations using distributor-maintained packages should verify the presence of the security backport rather than rely only on the upstream version number.\n\nCIRCL recommends prompt security updates for affected installations, with priority given to Internet-facing Apache servers that negotiate HTTP/2. Importantly, the vulnerable code path is not reachable merely because mod_http2 is installed or loaded: HTTP/2 must be enabled and reachable on the Apache service.\n\nTechnical details\n\nThe vulnerability is a race condition (CWE-362) in assign_headers() in mod_http2. During concurrent processing of HTTP/2 streams, a worker can modify a header table allocated for another execution context. This unsafe access to shared memory can corrupt the heap and lead to remote code execution or a server crash.\n\nThe upstream fix changes a write in modules/http2/h2_request.c from the shared request header table (req->headers) to the current request’s input header table (r->headers_in). Red Hat describes publicly demonstrated unauthenticated exploitation in a configuration where the affected HTTP/2 code path is enabled. This does not, by itself, establish exploitation in the wild.\n\nApache rates the issue Critical. Red Hat assigns CVSS v3.1 9.8 (Critical) for its general assessment, while noting that platform-specific build choices can affect exploitability. For example, Red Hat rates its RHEL 9 and 10 packages Important because their allocator implementation makes exploitation more difficult; Red Hat reports RHEL 8 and earlier as not affected. Apply the advisory specific to the deployed product and build.\n\nAffected systems and vulnerability reachability\n\nExploitation requires a vulnerable mod_http2 build and an Apache endpoint that accepts HTTP/2. The Protocols directive determines whether HTTP/2 is available. h2 enables HTTP/2 over TLS; h2c enables cleartext HTTP/2.\n\n\n\t\n\t\t\t\n\t\t\t\t\tConfiguration\n\t\t\t\t\tVulnerability reachable?\n\t\t\t\n\t\n\t\n\t\t\t\n\t\t\t\t\tmod_http2 not loaded\n\t\t\t\t\tNo\n\t\t\t\n\t\t\t\n\t\t\t\t\tmod_http2 loaded, HTTP/1.1 only\n\t\t\t\t\tNo\n\t\t\t\n\t\t\t\n\t\t\t\t\tmod_http2 loaded, HTTP/2 enabled (h2)\n\t\t\t\t\tYes\n\t\t\t\n\t\t\t\n\t\t\t\t\tmod_http2 loaded, cleartext HTTP/2 enabled (h2c)\n\t\t\t\t\tYes\n\t\t\t\n\t\t\t\n\t\t\t\t\tHTTP/2 enabled on only one virtual host\n\t\t\t\t\tPotentially, through that virtual host\n\t\t\t\n\t\n\n\nThis table assumes an affected, unpatched version and a client able to reach the relevant Apache endpoint. Apache’s core default is Protocols http/1.1; loading mod_http2 does not automatically change that default. A virtual host with its own Protocols directive overrides the base server’s value. Consequently, checking only the global configuration can miss an HTTP/2-enabled virtual host.\n\nWhere a reverse proxy (such as haproxy), load balancer or CDN terminates HTTP/2 and forwards only HTTP/1.1 to Apache, the upstream client’s HTTP/2 session does not by itself make this Apache vulnerability reachable. Verify the actual protocol between each frontend and Apache; do not infer backend exposure from a public endpoint advertising HTTP/2.\n\nVerification\n\nAdministrators can use the following commands as an initial configuration review (command and configuration paths may vary by distribution):\n\n\n\n\n\n\n1\n2\n3\n4\n5\n6\n7\n8\n9\n\n\n\n# Apache version and loaded modules\napachectl -v\napachectl -M | grep -i http2\n\n# Identify configured virtual hosts\napachectl -S\n\n# Locate explicit protocol settings, including virtual-host overrides\ngrep -RniE '^[[:space:]]*Protocols[[:space:]]+' /etc/apache2 /etc/httpd 2>/dev/null\n\n\n\nFor a reachable endpoint, test the negotiated protocol, preferably by connecting directly to the Apache service rather than through an intermediary:\n\n\n\n\n\n\n1\n2\n3\n4\n5\n\n\n\n# HTTP/2 over TLS (ALPN)\ncurl --http2 -sS -o /dev/null -w 'HTTP/%{http_version}\\n' https://example.org/\n\n# Cleartext HTTP/2 (direct h2c)\ncurl --http2-prior-knowledge -sS -o /dev/null -w 'HTTP/%{http_version}\\n' http://example.org/\n\n\n\nA response reporting HTTP/2 indicates that the tested endpoint accepted HTTP/2, but does not confirm that its Apache backend is vulnerable. Conversely, a negative test does not prove that all listening addresses, virtual hosts, ports or backend paths reject HTTP/2. Confirm the effective Apache configuration and the vendor’s patched-package status.\n\nMitigation and recommendations\n\nApply security updates\n\n\n\nUpgrade to Apache HTTP Server 2.4.71 or later, or install a distributor-supplied build explicitly patched for CVE-2026-119618.\n\nUpdate independently bundled or separately maintained mod_http2 components as directed by their vendor. Do not assume that a higher standalone module version exists without checking an actual vendor release or verified patch.\n\nRestart affected Apache processes after updating and verify that the running processes use the corrected build.\n\n\nDisable HTTP/2 temporarily if patching is delayed\n\nIf HTTP/2 is not required, restrict the supported protocols to HTTP/1.1:\n\n\n\n\n\n\n1\n\n\n\nProtocols http/1.1\n\n\n\nEnsure that every relevant virtual host either inherits this restriction or explicitly applies it. Remove h2 and h2c from any overriding Protocols directives, test the configuration (apachectl -t), and reload or restart Apache. Verify the result from both the server configuration and the affected network paths. Unloading mod_http2 entirely is another possible temporary measure, provided no other functionality depends on it.\n\nDisabling HTTP/2 prevents reachability of this particular vulnerability but does not remediate the vulnerable code. A security update remains the preferred permanent action.\n\nReduce exposure and monitor\n\n\n\nPrioritise Internet-facing websites, APIs, shared-hosting environments and Apache instances behind frontends that forward HTTP/2 to the backend.\n\nWhere immediate patching or protocol changes are impossible, restrict access to trusted networks as a temporary risk-reduction measure.\n\nReview unexpected Apache worker crashes, abnormal restarts, memory-corruption symptoms, suspicious child-process creation, unauthorised file changes and unexpected outbound connections. These are investigative leads, not confirmed indicators of compromise.\n\nPreserve relevant logs and host evidence where exploitation is suspected; a successful software update does not remove persistence established before patching.\n\n\nGuidance for organisations in Luxembourg\n\nCIRCL recommends that organisations operating Apache HTTP Server inventory HTTP/2-enabled instances, determine whether the deployed mod_http2 build is affected, and patch exposed systems without delay. Teams should distinguish module presence from actual protocol reachability, particularly in environments with multiple virtual hosts or reverse proxies.\n\nOrganisations observing suspicious activity should follow their incident-response procedures and contact their relevant CSIRT, including CIRCL where applicable.\n\nReferences\n\n\n\nCVE-2026-119618 \u2014 CIRCL Vulnerability-Lookup\n\nApache HTTP Server 2.4 security advisories (fixed in 2.4.71)\n\nApache upstream fix \u2014 commit 824beab\n\nApache documentation \u2014 mod_http2\n\nApache documentation \u2014 Protocols directive\n\nRed Hat vulnerability analysis \u2014 CVE-2026-119618\n\nApache disclosure on oss-security, 11 November 2026\n\n\nClassification of this document\n\nTLP:CLEAR \u2014 Information may be distributed without restriction, subject to copyright controls.\n\nRevision\n\n\n\nVersion 1.0 \u2013 TLP:CLEAR \u2013 Initial version \u2013 12 November 2026.\n", "url": "https://www.circl.lu/pub/tr-103/"}, {"timestamp": "2026-11-12T00:00:00Z", "date_only": false, "value": "2026-11-12T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1500", "record": "CERTFR-2026-AVI-1500", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-11-12T00:00:00Z", "date_only": false, "value": "2026-11-12T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1500", "record": "CERTFR-2026-AVI-1500", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T00:00:00Z", "date_only": false, "value": "2026-11-12T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-119618", "record": "UBUNTU-CVE-2026-119618", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T00:00:00Z", "date_only": false, "value": "2026-11-12T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1500", "record": "CERTFR-2026-AVI-1500", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-11-12T00:36:07.715Z", "date_only": false, "value": "2026-11-12T00:36:07.715647Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eventmonitor.bsky.social/post/3n264unas6anl", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "564de97c-8319-4b39-9de5-8d6cdea2f89a", "content": "Developing: Critical Apache HTTP Vulnerability (CVE-2026-119618)\nhttps://cyber.eventmonitor.net/incident/EM-20261111-TYEP/critical-apache-http-vulnerability-cve-2026-119618/\n#news #cybersecurity", "url": "https://bsky.app/profile/eventmonitor.bsky.social/post/3n264unas6anl"}, {"timestamp": "2026-11-12T01:12:02Z", "date_only": false, "value": "2026-11-12T01:12:02.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.dk/news/2026-11-12/Kritisk-Apache-HTTP2-saarbarhed-giver-mulighed-for-fjernafvikling-af-kode", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "a476cff2-eb5a-4613-af18-2585f0548615", "url": "https://www.cert.dk/news/2026-11-12/Kritisk-Apache-HTTP2-saarbarhed-giver-mulighed-for-fjernafvikling-af-kode"}, {"timestamp": "2026-11-12T02:01:05.383Z", "date_only": false, "value": "2026-11-12T02:01:05.383675Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sansisc.bsky.social/post/3n23erme5s42w", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "0f6a51e8-18b5-44b9-9617-08c161745d01", "content": "SANS Stormcast Thursday, November 12th, 2026: Apache mod_http2 RCE (CVE-2026-119618); Fortinet FortiMail Criticals; Ivanti EPM SQLi (CVE-2026-121653); Windows SignDrop CLFS; N-able N-central HF2\n https://isc.sans.edu/podcastdetail/10176", "url": "https://bsky.app/profile/sansisc.bsky.social/post/3n23erme5s42w"}, {"timestamp": "2026-11-12T02:52:50.681Z", "date_only": false, "value": "2026-11-12T02:52:50.681581Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/veduis.bsky.social/post/3n23ho52zdr2c", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "7a646cc9-fbf6-44b2-a1fc-800305f0d448", "content": "CVE-2026-119618: critical RCE in Apache HTTP Server. Wiz data shows 64% of cloud environments have vulnerable resources. Patch immediately.", "url": "https://bsky.app/profile/veduis.bsky.social/post/3n23ho52zdr2c"}, {"timestamp": "2026-11-12T03:10:30.701Z", "date_only": false, "value": "2026-11-12T03:10:30.701595Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hnbot.gsuscs.xyz/post/3n23inpoaus2w", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "7efc270b-410e-4575-9b0f-a1b8e140585d", "content": "Critical RCE Vulnerability in Apache HTTP Server\n\nhttps://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability", "url": "https://bsky.app/profile/hnbot.gsuscs.xyz/post/3n23inpoaus2w"}, {"timestamp": "2026-11-12T03:47:58.918Z", "date_only": false, "value": "2026-11-12T03:47:58.918050Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/betterhn20.e-work.xyz/post/3n23kqq5clq26", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "f9ccb733-b4d2-450e-b6c1-b17230fa4502", "content": "Critical RCE Vulnerability in Apache HTTP Server https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability (https://news.ycombinator.com/item?id=50462177)", "url": "https://bsky.app/profile/betterhn20.e-work.xyz/post/3n23kqq5clq26"}, {"timestamp": "2026-11-12T03:50:10.289Z", "date_only": false, "value": "2026-11-12T03:50:10.289676Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tomoyamachi.bsky.social/post/3n23kuntp2w2l", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "d7d06682-fb93-4a4c-abad-900788b0ccec", "content": "Apache HTTP Server\u3067HTTP/2\u304c\u6709\u52b9\u306a\u3068\u304d\u306b\u5f71\u97ff\u304c\u3067\u308b\u8106\u5f31\u6027\u306e\u8a73\u7d30 \"Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know | Wiz Blog\" https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability", "url": "https://bsky.app/profile/tomoyamachi.bsky.social/post/3n23kuntp2w2l"}, {"timestamp": "2026-11-12T03:53:59.143Z", "date_only": false, "value": "2026-11-12T03:53:59.143836Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hackernewstop5.bsky.social/post/3n23l3htzoo2n", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "e415f3fc-ec80-48d3-8221-6999ec766b4b", "content": "Critical RCE Vulnerability in Apache HTTP Server\n\n#HackerNews\n\nhttps://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability", "url": "https://bsky.app/profile/hackernewstop5.bsky.social/post/3n23l3htzoo2n"}, {"timestamp": "2026-11-12T03:57:08.540Z", "date_only": false, "value": "2026-11-12T03:57:08.540391Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/wojak7537.bsky.social/post/3n23lb3gveu2l", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "e4141c6d-270f-4a67-a5b7-6ad1fcd69082", "content": "CVE-2026-119618 is a critical RCE race condition in Apache HTTP Server's mod_http2 assign_headers() function, affecting versions 2.4.55 through 2.4.70; Wiz data shows 64% of cloud environments have vulnerable resources.\nhttps://agxsearch.ai/t/gvn7yf?utm_source=bluesky&utm_medium=social", "url": "https://bsky.app/profile/wojak7537.bsky.social/post/3n23lb3gveu2l"}, {"timestamp": "2026-11-12T04:12:26Z", "date_only": false, "value": "2026-11-12T04:12:26.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "e209abc7-429a-4dab-a613-997115e90e41", "content": "A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday.\n\nOnly servers with HTTP/2 enabled are affected, according to Red Hat, which ships the server as part of Red Hat Enterprise Linux.\n\nAn attacker who can reach the", "url": "https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html"}, {"timestamp": "2026-11-12T04:40:43.913Z", "date_only": false, "value": "2026-11-12T04:40:43.913733Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trendjpnews.bsky.social/post/3n23nozymr32l", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "7e818689-d668-4ceb-8cd5-db41851dec30", "content": "cve-2026-119618\n\nCritical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know", "url": "https://bsky.app/profile/trendjpnews.bsky.social/post/3n23nozymr32l"}, {"timestamp": "2026-11-12T04:43:53.092Z", "date_only": false, "value": "2026-11-12T04:43:53.092061Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/glonce.com/post/3n23nup4ehz2k", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "02986e85-6f5f-4a92-9fb3-827f18150cb0", "content": "Wiz flags critical Apache HTTP Server mod_http2 RCE flaw, CVE-2026-119618\nWiz says CVE-2026-119618, a race condition in Apache HTTP Server's HTTP/2 module, lets an unauthenticated remote attacker corrupt heap memory and run code.", "url": "https://bsky.app/profile/glonce.com/post/3n23nup4ehz2k"}, {"timestamp": "2026-11-12T04:47:56.835Z", "date_only": false, "value": "2026-11-12T04:47:56.835147Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/betterhn50.e-work.xyz/post/3n23o3xfgc724", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "21807237-1347-4c4a-8ff6-2afcd404321f", "content": "Critical RCE Vulnerability in Apache HTTP Server https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability (https://news.ycombinator.com/item?id=50462177)", "url": "https://bsky.app/profile/betterhn50.e-work.xyz/post/3n23o3xfgc724"}, {"timestamp": "2026-11-12T05:04:52Z", "date_only": false, "value": "2026-11-12T05:04:52.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/110270", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "421ad435-c50a-4edb-a770-e8f3cf2ba51b", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a apache-httpd-scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a foxcornlab\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-12 04:17:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDetection-only triage for Apache HTTP Server 2.4.71 batch: CVE-2026-119618 (mod_http2 RCE, CVSS 9.8), CVE-2026-106023, CVE-2026-109163. Grades httpd versions, catches the distro-backport and mod_h2 traps.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110270"}, {"timestamp": "2026-11-12T05:05:48Z", "date_only": false, "value": "2026-11-12T05:05:48.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110271", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "72c2da4d-5ea0-4269-b986-de4e847e40a9", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-119618\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a googlesky\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-12 05:05:34\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nApache httpd mod_http2 (2.4.55-2.4.70) races on the connection allocator when assign_headers() writes the synthesised Content-Length: 0 into the shared stream table, corrupting the child heap. Containerised lab, stdlib HTTP/2 PoC, ASan and TSan evidence, 2.4.71 differential, workaround test, 0day sweep.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110271", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-12T05:15:14Z", "date_only": false, "value": "2026-11-12T05:15:14.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/10639", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "1fbc1c38-2a6f-4e29-be6c-9954e3e2882c", "content": "\u203c\ufe0f BREAKING - Critical Apache HTTP/2 flaw could allow unauthenticated remote code execution.\n\nCVE-2026-119618 affects versions 2.4.55\u20132.4.70 with HTTP/2 enabled.\n\nCVSS 9.8. Fixed in 2.4.71, but some #Linux distributions still await patches.\n\nRead more \u2192 https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html", "url": "https://t.me/thehackernews/10639"}, {"timestamp": "2026-11-12T05:25:21.159Z", "date_only": false, "value": "2026-11-12T05:25:21.159298Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3n23q6tailt23", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "f5e51db3-a121-4646-97ee-9aaf026014fc", "content": "\u26a0\ufe0f PATCH NOW\n\nApache HTTP Server 2.4.55 to 2.4.70 has a critical race in its HTTP/2 module (CVE-2026-119618) that Apache says can lead to code execution.\nAffects servers where Apache itself serves HTTP/2.\nFix: update to 2.4.71.", "url": "https://bsky.app/profile/suriq.io/post/3n23q6tailt23"}, {"timestamp": "2026-11-12T05:32:01.631Z", "date_only": false, "value": "2026-11-12T05:32:01.631629Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/veduis.bsky.social/post/3n23qkrzqiy2k", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "107a60a7-0ab2-4dbf-a0c1-761a82850188", "content": "Apache HTTP Server 2.4.71 fixes CVE-2026-119618 in mod_http2.\n\nVersions 2.4.55 through 2.4.70 with HTTP/2 enabled can let an unauthenticated remote attacker run code. Red Hat says only those setups are affected.", "url": "https://bsky.app/profile/veduis.bsky.social/post/3n23qkrzqiy2k"}, {"timestamp": "2026-11-12T05:42:06.979Z", "date_only": false, "value": "2026-11-12T05:42:06.979453Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsph.com/post/3n23r4srxc52a", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "5eaaf916-6aec-4a44-a891-6ad0a97e5dc8", "content": "\u201cAccording to Wiz data, 64% of cloud environments have resources vulnerable to CVE-2026-119618\u201d, Wiz Blog reports.\n\n#cybersecurity", "url": "https://bsky.app/profile/cybernewsph.com/post/3n23r4srxc52a"}, {"timestamp": "2026-11-12T05:48:39Z", "date_only": false, "value": "2026-11-12T05:48:39.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/xhti_5O7h5FyHe3W5dLjlpb_K8Zqz_H1-6WNEkGi0RkUMQ", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "92c63a9f-9107-44e2-8bbb-29e07698fb7e", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-12T06:01:35.598Z", "date_only": false, "value": "2026-11-12T06:01:35.598915Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/raven-sec.bsky.social/post/3n23s7kncbgb5", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "80df9c77-033c-4e14-94c6-43d943f293f3", "content": "Apache, Synology, N-central all CVSS 9.8+\u2014patch now\n\n\u2022 Apache HTTP/2 RCE CVE-2026-119618 unauthenticated\n\u2022 Synology DSM SQL injection CVE-2026-76954 CVSS 9.8\n\n5 sources verified \u00b7 hackingallthethings.com\n#infosec #threatintel #cybersecurity #CVE2026119618 #CVE202676954", "url": "https://bsky.app/profile/raven-sec.bsky.social/post/3n23s7kncbgb5"}, {"timestamp": "2026-11-12T06:06:41.591Z", "date_only": false, "value": "2026-11-12T06:06:41.591005Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-119618", "record": "BELL-CVE-2026-119618", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T06:08:44.905Z", "date_only": false, "value": "2026-11-12T06:08:44.905801Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/chuiho.net/post/3n23smgzc772a", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "7660c14c-1b64-4572-81cf-ca2b9feaf768", "content": "\uff3b\u8b66\u6212\uff3dApache HTTP Server \u306e CVE-2026-119618\u3001mod_http2 \u306b\u91cd\u5927\u306a\u6b20\u9665\nApache HTTP Server 2.4.55\u301c2.4.70 \u306e mod_http2 \u306b\u3001\u30ed\u30b0\u30a4\u30f3\u4e0d\u8981\u3067\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3055\u308c\u3046\u308b\u6b20\u9665\u3002\u4fee\u6b63\u7248\u306f 2.4.71\u3002\u78ba\u8a8d\u65b9\u6cd5\u3068\u56de\u907f\u7b56\u3092\u6574\u7406\u3059\u308b\u3002\nhttps://chuiho.net/posts/apache-mod-http2-cve-2026-119618-rce/ #ApacheHTTPServer #mod_http2", "url": "https://bsky.app/profile/chuiho.net/post/3n23smgzc772a"}, {"timestamp": "2026-11-12T06:21:59.423Z", "date_only": false, "value": "2026-11-12T06:21:59.423679Z", "kind": "sighting", "label": "Seen", "source": "https://indieweb.social/users/speedealz/statuses/117601859853315293", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "afb50973-006d-45fb-802e-59aa8cf056fe", "content": "Critical #RCE #Vulnerability in #Apache HTTP Server https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability", "url": "https://indieweb.social/users/speedealz/statuses/117601859853315293"}, {"timestamp": "2026-11-12T06:30:06.442Z", "date_only": false, "value": "2026-11-12T06:30:06.442537Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3n23tsmokdd23", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "554a3d08-2a77-4bb6-b306-ff364d9c2533", "content": "Apache HTTP Server\u306eHTTP/2\u30e2\u30b8\u30e5\u30fc\u30eb(mod_http2)\u306b\u6df1\u523b\u306a\u8106\u5f31\u6027\uff08CVE-2026-119618\uff09\u304c\u3042\u308a\u3001\u8a8d\u8a3c\u306a\u3057\u3067\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u30d0\u30fc\u30b8\u30e7\u30f32\u2026", "url": "https://bsky.app/profile/postac001.bsky.social/post/3n23tsmokdd23"}, {"timestamp": "2026-11-12T06:38:49.020Z", "date_only": false, "value": "2026-11-12T06:38:49.020163Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3n23uc7sn3v25", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "c64b2eb8-11c1-41d6-911a-380ff4993095", "content": "\ud83e\udd16 CVE-2026-119618 (critical): heap corruption \u2192 RCE in Apache mod_http2 assign_headers(). Unauthenticated, HTTP/2 servers only. Affects 2.4.55\u20132.4.70, fixed in 2.4.71. Patch now.\nhttps://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3n23uc7sn3v25"}, {"timestamp": "2026-11-12T06:43:19.027Z", "date_only": false, "value": "2026-11-12T06:43:19.027064Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3n23ukaxnnw2v", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "616adc99-417a-4a51-9e7b-2ee03fba8c89", "content": "Apache httpd 2.4.71 Fixes Critical HTTP/2 RCE (CVE-2026-119618): Root Cause, Detection and Patch\u00a0Guide\n\nApache httpd 2.4.71 patches a critical mod_http2 race condition (CVE-2026-119618). See how the bug works, how to\u2026\n\nhttps://thecybersecguru.com/news/apache-httpd-2-4-71-cve-2026-119618-http2-rce/", "url": "https://bsky.app/profile/thecybersecguru.com/post/3n23ukaxnnw2v"}, {"timestamp": "2026-11-12T06:45:18.789Z", "date_only": false, "value": "2026-11-12T06:45:18.789507Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hn100.atproto.rocks/post/3n23unslaqp23", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "9b084ed8-1add-474a-996b-19b131c34f36", "content": "Critical RCE Vulnerability in Apache HTTP Server\nhttps://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability\n\nhttps://news.ycombinator.com/item?id=50462177", "url": "https://bsky.app/profile/hn100.atproto.rocks/post/3n23unslaqp23"}, {"timestamp": "2026-11-12T07:00:18Z", "date_only": false, "value": "2026-11-12T07:00:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/HnXcySbe8OrB0r1z99AfQpyWxxbMe8sIRiojnHxJHDz56E0", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "692d76dc-ae6f-410f-8085-4a994689dbba", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-12T07:00:18Z", "date_only": false, "value": "2026-11-12T07:00:18.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/HnXcySbe8OrB0r1z99AfQpyWxxbMe8sIRiojnHxJHDz56E0", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "786ecffc-d0f0-4e17-9a94-d2f59024c7cb"}, {"timestamp": "2026-11-12T07:01:32.819Z", "date_only": false, "value": "2026-11-12T07:01:32.819427Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/xiaoguang99.bsky.social/post/3n23vku7ums2e", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "bbc81995-a503-4b55-b076-51fadbc86977", "content": "\u6700\u4e25\u91cd\u7684\u662f CVE-2026-119618\uff0c\u85cf\u5728\u5904\u7406 HTTP/2 \u7684 mod_http2 \u6a21\u5757\u91cc\uff1aassign_headers \u51fd\u6570\u5728\u5e76\u53d1\u65f6\u5bf9\u5171\u4eab\u6570\u636e\u6ca1\u52a0\u597d\u540c\u6b65\uff0c\u5806\u5185\u5b58\u88ab\u7834\u574f\u4e4b\u540e\u53ef\u80fd\u88ab\u5229\u7528\u6765\u8fdc\u7a0b\u6267\u884c\u4ee3\u7801\u3002\u5f71\u54cd 2.4.55 \u5230 2.4.70\uff0cRed Hat \u7ed9\u7684 CVSS 3.1 \u662f 9.8 \u5206\u3002\u53d1\u73b0\u8005\u662f Anthropic \u7684\u5f00\u6e90\u626b\u63cf\u5668\u548c Google Cloud \u7684\u6f0f\u6d1e\u7814\u7a76\u56e2\u961f\u3002\u5b98\u65b9\u6ca1\u7ed9\u7ed5\u8fc7\u529e\u6cd5\uff0c\u5347\u7ea7\u662f\u552f\u4e00\u89e3\u3002", "url": "https://bsky.app/profile/xiaoguang99.bsky.social/post/3n23vku7ums2e"}, {"timestamp": "2026-11-12T07:13:07.491Z", "date_only": false, "value": "2026-11-12T07:13:07.491966Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/dastechno.com/post/3n23w7klzwj2y", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "d699c650-f763-42c1-b8db-684f721a81ca", "content": "Apache 2.4.71: Kritische HTTP/2-L\u00fccke CVE-2026-119618 geschlossen\n\nApache HTTP Server 2.4.71 schlie\u00dft eine kritische L\u00fccke in mod_http2, betroffen sind 2.4.55 bis 2.4.70. Wer HTTP/2 nutzt, sollte jetzt updaten \u2013 so pr\u00fcfen Sie Ihren Server.\n\n#News", "url": "https://bsky.app/profile/dastechno.com/post/3n23w7klzwj2y"}, {"timestamp": "2026-11-12T07:22:36Z", "date_only": false, "value": "2026-11-12T07:22:36.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.ncsc.nl/alerts/kwetsbaarheid-in-apache-http-server-modhttp2-en-modh2", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "532692ec-0029-45f4-962e-524d8967c573", "url": "https://www.ncsc.nl/alerts/kwetsbaarheid-in-apache-http-server-modhttp2-en-modh2"}, {"timestamp": "2026-11-12T07:59:35.627Z", "date_only": false, "value": "2026-11-12T07:59:35.627894Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0484", "record": "NCSC-2026-0484", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-12T07:59:35.627Z", "date_only": false, "value": "2026-11-12T07:59:35.627894Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0484", "record": "NCSC-2026-0484", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T07:59:35.627Z", "date_only": false, "value": "2026-11-12T07:59:35.627894Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0484", "record": "NCSC-2026-0484", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-12T08:15:27.982Z", "date_only": false, "value": "2026-11-12T08:15:27.982767Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hermesvector.bsky.social/post/3n23zozfvfr23", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "1274d8e0-86c4-400a-a0a0-db94d0e8f8b2", "content": "Race condition in Apache HTTP Server HTTP/2 module allows remote code execution\n\nCVE-2026-119618 affects Apache HTTP Server versions 2.4.55 through 2.4.70 and can lead to arbitrary code execution. Apache has released version 2.4.71 to fix the issue.", "url": "https://bsky.app/profile/hermesvector.bsky.social/post/3n23zozfvfr23"}, {"timestamp": "2026-11-12T08:55:30.681Z", "date_only": false, "value": "2026-11-12T08:55:30.681047Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yonle.waltuh.cyou.ap.brid.gy/post/3n243whned4n2", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "9729f4c3-9c29-494e-9244-28a048100dd0", "content": "SAY HIIIII TO CVE-2026-119618 FOR APACHE2\u2019s HTTP/2 FLAAAWWW!!", "url": "https://bsky.app/profile/yonle.waltuh.cyou.ap.brid.gy/post/3n243whned4n2"}, {"timestamp": "2026-11-12T09:01:11Z", "date_only": false, "value": "2026-11-12T09:01:11.000000Z", "kind": "sighting", "label": "Seen", "source": "https://threatintel.cc/2026/11/12/critical-apache-http-flaw-could.html", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "c7824df5-4221-419e-87e6-e8554db7587f", "content": "Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely\n\nA critical flaw in Apache HTTP Server’s HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday. Only servers with HTTP/2 enabled are affected, according to Red Hat.", "url": "https://threatintel.cc/2026/11/12/critical-apache-http-flaw-could.html"}, {"timestamp": "2026-11-12T09:01:40.439Z", "date_only": false, "value": "2026-11-12T09:01:40.439106Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/24hhotnewsai.bsky.social/post/3n244bnsf3c2u", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "58a3d96a-9912-48b5-b335-708d255c758d", "content": "\ud83d\udd25 L\u1ed7 h\u1ed5ng mod_http2 tr\u00ean Apache HTTP Server CVE-2026-119618 cho ph\u00e9p RCE: C\u1eadp nh\u1eadt t\u1eeb 2.4.55\u20132.4.70 l\u00ean 2.4.71\n#NewsBrief #VNNews", "url": "https://bsky.app/profile/24hhotnewsai.bsky.social/post/3n244bnsf3c2u"}, {"timestamp": "2026-11-12T09:02:15.193Z", "date_only": false, "value": "2026-11-12T09:02:15.193512Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threataft.bsky.social/post/3n2445jdqtc2u", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "80f80aaf-c723-4343-9ca8-731a00c95270", "content": "CVE-2026-119618: CVSS 9.8 pre-auth RCE in Apache mod_http2.\n\nassign_headers() race \u2192 heap corruption \u2192 RCE. No credentials.\n\nAffects 2.4.55\u20132.4.70. Fixed: 2.4.71. Public PoC up. 64% cloud envs exposed (Wiz).\n\nthreataft.com/articles/cve...", "url": "https://bsky.app/profile/threataft.bsky.social/post/3n2445jdqtc2u"}, {"timestamp": "2026-11-12T09:07:59Z", "date_only": false, "value": "2026-11-12T09:07:59.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberDispatch/3735", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "4353e3be-3460-4147-988b-168e1415f04a", "content": "Critical Apache HTTP/2 flaw could allow unauthenticated remote code execution.\n\nCVE-2026-119618 affects versions 2.4.55\u20132.4.70 with HTTP/2 enabled.\n\nCVSS 9.8. Fixed in 2.4.71, but some Linux distributions still await patches.", "url": "https://t.me/CyberDispatch/3735"}, {"timestamp": "2026-11-12T09:59:24Z", "date_only": false, "value": "2026-11-12T09:59:24.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/cyberheartmi9/d3f0c1f9683b51be5eb205146dc33694", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "09060c59-7572-4c25-9574-5cfa371a9416", "content": "# CVE-2026-119618 \u2014 Anatomy of a Race Condition in Apache HTTP/2 (`mod_http2`)\n\n> A critical, pre-authentication remote code execution flaw in Apache HTTP Server's\n> HTTP/2 module. This article walks through the root cause, the exact wire-level\n> trigger conditions (including one that is not documented anywhere else), how to\n> detect it, and how to prove it with sanitizers.\n\n**CVE-2026-119618** \u00b7 Critical (CVSS 9.8) \u00b7 Apache HTTP Server 2.4.55 \u2013 2.4.70 \u00b7 Fixed in 2.4.71\nDisclosed 2026-11-11 \u00b7 CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization\n\n---\n\n## TL;DR\n\n| | |\n|---|---|\n| **What** | `mod_http2` writes into a **shared** header table from a worker thread. When two threads do that concurrently, the table's backing array is swapped under the other thread's feet \u2014 a use-after-free that corrupts the heap and yields RCE. |\n| **The bug** | One line: `apr_table_setn(req->headers, \"Content-Length\", \"0\")` should have been `apr_table_setn(r->headers_in, \u2026)`. |\n| **Preconditions** | HTTP/2 enabled \u00b7 request has `Content-Type` \u00b7 request has **no** `Content-Length` \u00b7 request is handled as *no-body* |\n| **Hidden requirement** | The request must carry **exactly 10, 20, 40 or 80 regular headers**. Anything else never reaches the shared allocator, and the bug cannot fire. |\n| **Detection** | Protocol reachability \u00d7 version range \u2014 deterministic, no traffic required beyond a handshake. |\n| **Proof** | ThreadSanitizer on a live, vulnerable server races **inside `assign_headers()`**; AddressSanitizer catches the heap corruption. |\n\nEverything in this article is reproducible with the toolkit in this repository. No\nexploit chain, no shell payload \u2014 the flaw is demonstrated as memory corruption.\n\n---\n\n## Table of contents\n\n1. [The vulnerability](#1-the-vulnerability)\n2. [How `mod_http2` is structured](#2-how-mod_http2-is-structured)\n3. [Root cause](#3-root-cause)\n4. [The trigger conditions](#4-the-trigger-conditions)\n5. [The header-count requirement](#5-the-header-count-requirement)\n6. [Proof](#6-proof)\n7. [Detection](#7-detection)\n8. [The proof of concept](#8-the-proof-of-concept)\n9. [The instrumented lab](#9-the-instrumented-lab)\n10. [Remediation](#10-remediation)\n11. [Limitations](#11-limitations)\n12. [Reproducing everything](#12-reproducing-everything)\n13. [References](#13-references)\n\n---\n\n## 1. The vulnerability\n\n### 1.1 Disclosure summary\n\n| Field | Value |\n|---|---|\n| CVE | CVE-2026-119618 |\n| Component | `mod_http2` (bundled with httpd) and the standalone `mod_h2` project |\n| Class | CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization |\n| Impact | Heap corruption \u2192 arbitrary code execution in the httpd worker process |\n| Authentication | **None required** |\n| Affected (httpd) | 2.4.55 \u2192 2.4.70 |\n| Fixed (httpd) | **2.4.71** (released 2026-11-11) |\n| Affected (standalone `mod_h2`) | 2.0.8 \u2192 2.0.42 \u2014 **no fixed release**; repository archived 2026-06-09 |\n| Fix commit | `824beab9b9424d6cfb29595248fdbf6c3dddeab1` (cherry-pick of `5ed39287660daacd1233cb9bbc984b25fa9a4fe3`, upstream PR #975/#977) |\n| Reported by | Anthropic's OSS Scanner (`ANT-2026-MAPKT6MZ`) on 2026-10-26; Anthony Weems & Simon Scannell of Google Cloud Vulnerability Research on 2026-11-03 |\n| Exploitation | At publication time, no exploit was available and no exploitation in the wild was reported |\n\n### 1.2 Why it matters\n\nWiz measured that **64 % of cloud environments** contain resources vulnerable to\nCVE-2026-119618, and that **51 %** of them expose such instances publicly. The\nflaw sits in the HTTP/2 request path of a web server: a compromised Apache\ninstance is a lateral-movement pivot into adjacent workloads and cloud metadata\nendpoints.\n\nRed Hat rates the flaw *Important* rather than *Critical* on RHEL 9 and 10,\nbecause their `mod_h2` package gives every HTTP/2 stream its own memory\nallocator, which makes weaponising the corruption considerably harder. That is a\n**hardening measure, not a fix** \u2014 the affected code is identical and still\nrequires patching.\n\n### 1.3 The fix, in one line\n\n```diff\n--- a/modules/http2/h2_request.c\n+++ b/modules/http2/h2_request.c\n@@ -350,7 +350,7 @@ static void assign_headers(request_rec *r, const h2_request *req,\n                 /* If we have a content-type, but already seen eos, no more\n                  * data will come. Signal a zero content length explicitly.\n                  */\n-                apr_table_setn(req->headers, \"Content-Length\", \"0\");\n+                apr_table_setn(r->headers_in, \"Content-Length\", \"0\");\n             }\n         }\n```\n\nOne table. One function. That is the whole vulnerability \u2014 and that is also\nwhy it took until 2026 to be found.\n\n---\n\n## 2. How `mod_http2` is structured\n\nUnderstanding the bug requires understanding the threading model, because\n`mod_http2` in httpd is not a single-threaded module.\n\n```\n                     \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n   TCP connection \u2500\u2500\u25b6\u2502  c1: the session thread                  \u2502\n                     \u2502  h2_c1_run \u2192 h2_session_process          \u2502\n                     \u2502    \u2022 reads frames                         \u2502\n                     \u2502    \u2022 builds h2_request per stream         \u2502\n                     \u2502    \u2022 hands streams to the multiplexer    \u2502\n                     \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                                     \u2502  h2_mplx (h2_mplx.c)\n                                     \u25bc\n                     \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n                     \u2502  h2_workers: a pool of worker threads   \u2502\n                     \u2502  slot_run (h2_workers.c:299)             \u2502\n                     \u2502    \u2022 each takes one stream                \u2502\n                     \u2502    \u2022 creates a SECONDARY connection (c2) \u2502\n                     \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                                     \u25bc\n                     \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n                     \u2502  c2: the secondary connection            \u2502\n                     \u2502  c2_process (h2_c2.c:748)                 \u2502\n                     \u2502    r = h2_create_request_rec(req, c, \u2026)   \u2502\n                     \u2502      \u2514\u2500\u25b6 assign_headers(r, req, no_body)  \u2502\n                     \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n```\n\nTwo facts matter:\n\n1. **`h2_request` objects are shared.** The per-stream request template\n   (`stream->rtmp`, later `stream->request`) is created by the session thread\n   but consumed by a worker thread \u2014 and, as we will see, by *more than one*.\n2. **The header table inside it is not thread-safe.** `apr_table_t` is backed by\n   an array whose pointer is swapped when it grows.\n\n---\n\n## 3. Root cause\n\n### 3.1 The vulnerable function\n\n```c\n/* modules/http2/h2_request.c \u2014 httpd 2.4.55 \u2026 2.4.69 */\nstatic void assign_headers(request_rec *r, const h2_request *req,\n                           int no_body, int is_connect)\n{\n    r->headers_in = apr_table_clone(r->pool, req->headers);   /* private copy */\n    \u2026\n    cl = apr_table_get(req->headers, \"Content-Length\");\n    if (no_body) {\n        if (!cl && apr_table_get(req->headers, \"Content-Type\")) {\n            /* If we have a content-type, but already seen eos, no more\n             * data will come. Signal a zero content length explicitly.\n             */\n            apr_table_setn(req->headers, \"Content-Length\", \"0\");   /* \u2190 BUG */\n        }\n    }\n```\n\n`r->headers_in` is a **fresh clone**, allocated in the request's own pool \u2014\nprivate to the thread that owns `r`. `req->headers` is the **shared** table of\nthe `h2_request` template. The function writes to the wrong one.\n\n### 3.2 Why the shared table is dangerous\n\nAPR 1.7 implements `apr_table_t` on top of an array:\n\n```c\n/* apr/tables/apr_tables.c */\nstatic void *apr_array_push_noclear(apr_array_header_t *arr)\n{\n    if (arr->nelts == arr->nalloc) {\n        int new_size = (arr->nalloc <= 0) ? 1 : arr->nalloc * 2;\n        char *new_data = apr_palloc(arr->pool, arr->elt_size * new_size);\n\n        memcpy(new_data, arr->elts, arr->nalloc * arr->elt_size);\n        arr->elts = new_data;          /* \u2190 the old array is abandoned here */\n        arr->nalloc = new_size;\n    }\n    ++arr->nelts;\n    return arr->elts + (arr->elt_size * (arr->nelts - 1));\n}\n```\n\nWhen the table grows it allocates a **new** array and abandons the old one. The\nold array is pool memory \u2014 freed the moment the pool is cleared or destroyed,\nor reused for something else. Any other thread still holding a pointer into it\nis now reading or writing freed memory.\n\n### 3.3 Who else touches that table?\n\n`assign_headers()` is reachable from two places, both of which build a\n`request_rec` from the *same* `h2_request`:\n\n| Call site | `no_body` |\n|---|---|\n| `h2_c2.c:748` \u2014 `c2_process()` \u2192 `h2_create_request_rec(req, c, conn_ctx->beam_in == NULL)` | `1` for body-less requests |\n| `h2_c2_filter.c:658` \u2014 the c2 input/output filter's error path \u2192 `h2_create_request_rec(conn_ctx->request, f->c, 1)` | always `1` |\n\nBoth run on **worker threads**. Under sufficient concurrency, two of them\nexecute `assign_headers()` for the same `h2_request` at the same time, and\nboth write to the same shared table.\n\n### 3.4 The race, as ThreadSanitizer sees it\n\nCaptured from a live, vulnerable Apache 2.4.69 (full report:\n[`poc/evidence/tsan-assign_headers-race.txt`](poc/evidence/tsan-assign_headers-race.txt)):\n\n```\nWARNING: ThreadSanitizer: data race\n  Read of size 8 at 0x723400006830 by thread T2:\n    #0 allocator_alloc         memory/unix/apr_pools.c:331\n    #1 apr_palloc               memory/unix/apr_pools.c:843\n    #2 apr_array_push_noclear   tables/apr_tables.c:132\n    #3 apr_table_setn           tables/apr_tables.c:638\n    #4 assign_headers           modules/http2/h2_request.c:373\n    #5 h2_create_request_rec    modules/http2/h2_request.c:407\n    #6 c2_process               modules/http2/h2_c2.c:748\n    #7 h2_c2_hook_process       modules/http2/h2_c2.c:914\n    #8 ap_run_process_connection server/connection.c:42\n    #9 h2_c2_process             modules/http2/h2_c2.c:722\n   #10 slot_run                 modules/http2/h2_workers.c:299\n   #11 thread_start             server/util.c:3198\n\n  Previous write of size 8 at 0x723400006830 by thread T1:\n    #1 apr_palloc               memory/unix/apr_pools.c:843\n    #2 apr_array_push_noclear   tables/apr_tables.c:132\n    #3 apr_table_setn           tables/apr_tables.c:638\n    #4 assign_headers           modules/http2/h2_request.c:373\n    #5 h2_create_request_rec    modules/http2/h2_request.c:407\n    #6 c2_process               modules/http2/h2_c2.c:748\n    \u2026\nSUMMARY: ThreadSanitizer: data race memory/unix/apr_pools.c:331 in allocator_alloc\n```\n\n**Both stacks are inside the vulnerable statement.** Two worker threads, one\nshared table, one array pointer being swapped under the other thread's feet.\n\n> A note on an early wrong turn: the first hypothesis was that the *session\n> thread* races the worker thread on the header table. Static analysis of\n> `h2_stream_end_headers()` showed the header block is completed before a\n> stream is dispatched, so the session thread is not the other party. It is\n> another **worker** thread. The way this was settled was by instrumenting the\n> branch and letting ThreadSanitizer tell us.\n\n### 3.5 The corruption\n\nUnder AddressSanitizer the same shared-table access produces memory corruption\ninside the vulnerable function:\n\n```\n==910099==ERROR: AddressSanitizer: SEGV on unknown address\n    #0 apr_table_add     tables/apr_tables.c:797\n    #1 apr_table_clone   tables/apr_tables.c:442\n    #2 assign_headers    poc/race_harness.c:86\n    #3 worker_thread     poc/race_harness.c:133\nSUMMARY: AddressSanitizer: SEGV tables/apr_tables.c:797 in apr_table_add\n```\n\nThe hash-array pointer of the shared table was overwritten with garbage while\nthe worker was cloning it \u2014 the classic use-after-free signature that turns\ninto controlled data.\n\n---\n\n## 4. The trigger conditions\n\nFor the vulnerable branch to execute, all of the following must hold:\n\n| # | Condition | Why |\n|---|---|---|\n| 1 | HTTP/2 is enabled (`Protocols h2` and/or `h2c`) | The flaw lives in `mod_http2`; without HTTP/2 the module never runs. |\n| 2 | The request carries a `Content-Type` header | `apr_table_get(req->headers, \"Content-Type\")` must succeed. |\n| 3 | The request carries **no** `Content-Length` header | The `!cl` guard. |\n| 4 | The request is handled as *no-body* | `no_body` must be `1`. Body-less requests take the `h2_c2.c:748` path; the c2 error path always passes `1`. |\n| 5 | The request carries **exactly 10, 20, 40 or 80 regular headers** | See \u00a75. Without this, the shared allocator is never touched. |\n| 6 | Two threads reach the shared table concurrently | The race itself. |\n\nConditions 1\u20134 fall straight out of the source. Condition 5 is the one that is\neasy to miss, and it is what separates a PoC that works from one that does\nnothing.\n\n---\n\n## 5. The header-count requirement\n\nThis is the part that is not in any advisory, and it is the single most\nimportant detail for anyone writing a PoC or a detection rule.\n\n### 5.1 The arithmetic\n\n`mod_http2` creates the shared table with a fixed initial capacity:\n\n```c\n/* h2_stream.c:790 */\nstream->rtmp = h2_request_create(stream->id, stream->pool, \u2026);\n   \u2192 req->headers = apr_table_make(pool, 10);      /* nalloc = 10 */\n```\n\nThe table grows by doubling, and **growth is the only thing that allocates**:\n\n```\ninsertion #      1 \u2026 10  11      12 \u2026 20  21      22 \u2026 40  41      \u2026\nnalloc              10     20        20     40        40     80\nallocates?          no    YES        no    YES        no    YES\n```\n\nThe vulnerable `apr_table_setn(req->headers, \"Content-Length\", \"0\")` adds the\n**next** entry. It is therefore the allocating insertion **only when the table\nalready holds exactly `nalloc` entries** \u2014 10, 20, 40 or 80.\n\n### 5.2 What actually goes into that table\n\nTwo details decide the count:\n\n* **Pseudo-headers are not in the table.** `h2_request_add_header()` stores\n  `:method`, `:scheme`, `:path` and `:authority` in dedicated struct fields.\n  Only *regular* headers go into `req->headers`.\n* **`Host` is overwritten, not pushed.** `h2_request_end_headers()` does\n  `apr_table_setn(req->headers, \"Host\", req->authority)` \u2014 a write to an\n  existing key does not grow the array. Send a `Host` header explicitly so the\n  count stays where you put it.\n\n### 5.3 Empirical confirmation\n\n`poc/pool_probe.c` links against a real APR and watches the table's backing\narray pointer:\n\n```\nmod_http2 shared-table model: apr_table_make(pool, 10)\nheaders   nalloc     Content-Length insert reallocates (pool hit)?\n\u2026\n 9         10         no\n10        10         YES  <== pool allocated by the worker\n11        20         no\n\u2026\n20        20         YES  <== pool allocated by the worker\n21        40         no\n```\n\nAnd the instrumented server confirms it on every single execution:\n\n```\n144 CVE-2026-119618-VULN-BRANCH-HIT nelts=10 nalloc=10 poolhit=1\n144 CVE-2026-119618-VULN-BRANCH-HIT nelts=20 nalloc=20 poolhit=1\n144 CVE-2026-119618-VULN-BRANCH-HIT nelts=40 nalloc=40 poolhit=1\n144 CVE-2026-119618-VULN-BRANCH-HIT nelts=80 nalloc=80 poolhit=1\n```\n\n**100 % of vulnerable-branch executions allocated from the shared pool.**\n\n### 5.4 Why this matters practically\n\nA PoC that sends `content-type` and nothing else \u2014 the obvious thing to write \u2014\n**can never trigger this CVE**. The table holds two entries, never grows, never\ntouches the shared allocator, and the race window does not exist.\n\nIt also means a detection rule cannot simply look for \"HTTP/2 request with\n`Content-Type` and no `Content-Length`\". The header *count* is part of the\nsignature.\n\n---\n\n## 6. Proof\n\nThree independent lines of evidence, all reproducible from this repository.\n\n### 6.1 Deterministic: the vulnerable branch executes\n\n```\n RESULT: VULNERABLE CODE PATH CONFIRMED\n   The server executed the vulnerable assign_headers() branch 576 time(s),\n   of which 576 allocated from the shared APR pool.\n   This is a deterministic result - it does not depend on winning the race.\n```\n\n### 6.2 ThreadSanitizer: the data race, in the live server\n\nSee \u00a73.4. 257 race blocks were captured in a single run; the saved report is\n[`poc/evidence/tsan-assign_headers-race.txt`](poc/evidence/tsan-assign_headers-race.txt).\n\n### 6.3 AddressSanitizer: the heap corruption\n\nSee \u00a73.5.\n\n---\n\n## 7. Detection\n\nThe detector in [`detector/`](detector/) answers one question \u2014 *is this server\nvulnerable?* \u2014 using three independent layers.\n\n### 7.1 Layer 1 \u2014 is HTTP/2 actually reachable?\n\nThe flaw is only reachable through `mod_http2`. Three ways to find out:\n\n| Probe | How |\n|---|---|\n| TLS + ALPN | Negotiate `h2`; a server advertising `h2` in ALPN runs `mod_http2`. |\n| h2c prior knowledge | Send the HTTP/2 connection preface (`PRI * HTTP/2.0\\r\\n\\r\\nSM\\r\\n\\r\\n`); a compliant server replies with `SETTINGS`. |\n| h2c upgrade | `Upgrade: h2c` + `HTTP2-Settings:`; a compliant server replies `101`. |\n\nIf none succeed, the module never sees a request and the flaw is unreachable.\n\n### 7.2 Layer 2 \u2014 is the version in range?\n\n```\nhttpd     2.4.55 \u2026 2.4.70   vulnerable   \u2192  fixed in 2.4.71\nmod_h2    2.0.8  \u2026 2.0.42   vulnerable   \u2192  no fixed release (repo archived)\n```\n\nThe version comes from the `Server:` header (over HTTP/1.1, or over HTTP/2 for\nh2-only servers), or from the local binary / package metadata.\n\n### 7.3 Layer 3 \u2014 local configuration audit\n\nThe configuration tree is walked (following `Include` / `IncludeOptional`), every\n`Protocols` directive and every `LoadModule http2_module` is recorded, and the\nresult is cross-referenced with the installed version. `Protocols` can be set\nper-virtual-host, so server-wide *and* per-vhost settings matter.\n\n### 7.4 Verdicts\n\n| Exit | Verdict |\n|---|---|\n| `0` | Not vulnerable \u2014 HTTP/2 disabled, or version outside the range |\n| `1` | **Vulnerable** |\n| `2` | Undetermined \u2014 target unreachable, or version not disclosed |\n| `3` | Detector error |\n\nAn unreachable target reports *undetermined*, never *safe*. A false negative on\na critical CVE is far more expensive than an undetermined verdict.\n\n```console\n$ python3 detector/cli.py --target 127.0.0.1:8080\n[1] TARGET: 127.0.0.1:8080\n------------------------------------------------------------------------------\n  Verdict       : VULNERABLE\n  Reason        : HTTP/2 is enabled (h2c-prior-knowledge, h2c-upgrade) and httpd 2.4.69\n                  is within the affected range 2.4.55..2.4.70\n  HTTP/2        : ENABLED  (h2c-prior-knowledge, h2c-upgrade)\n  Version       : 2.4.69  (source: server-header, product: httpd)\n  Affected range: httpd 2.4.55..2.4.70\n  Fixed in      : 2.4.71\n  Mitigation    : upgrade to httpd 2.4.71 (or remove h2/h2c from the Protocols\n                  directive, leaving 'Protocols http/1.1')\n```\n\n---\n\n## 8. The proof of concept\n\n### 8.1 The reliability problem\n\nThe flaw is a **race**, so \"did the heap get corrupted?\" is probabilistic. A\nPoC that only watches for a crash reports \"nothing happened\" on a genuinely\nvulnerable server \u2014 measured: **0 hits in 5 runs** against the stock Debian\nApache 2.4.69.\n\nSo the PoC splits the proof into a deterministic part and a probabilistic one:\n\n| Signal | Type | Meaning |\n|---|---|---|\n| `CVE-2026-119618-VULN-BRANCH-HIT` | **deterministic** | the server executed the *vulnerable branch* |\n| `poolhit=1` | **deterministic** | that execution allocated from the **shared** APR pool |\n| crash / RST / 5xx / protocol error | probabilistic | the race corrupted something this time |\n\n### 8.2 The instrumentation\n\n[`poc/instrument_h2_request.py`](poc/instrument_h2_request.py) inserts a single,\n`getenv`-guarded logging statement immediately before the vulnerable write:\n\n```c\n                /* --- CVE-2026-119618 PoC instrumentation -------------------------\n                 * Not part of upstream httpd.  Emits a marker when the VULNERABLE\n                 * branch below is taken \u2026\n                 */\n                if (getenv(\"H2_CVE_2026_119618_TRACE\")) {\n                    const apr_array_header_t *trace_a = apr_table_elts(req->headers);\n                    fprintf(stderr, \"CVE-2026-119618-VULN-BRANCH-HIT nelts=%d nalloc=%d poolhit=%d\\n\",\n                            trace_a->nelts, trace_a->nalloc,\n                            trace_a->nelts >= trace_a->nalloc ? 1 : 0);\n                    fflush(stderr);\n                }\n                /* --- end of instrumentation ------------------------------------- */\n                apr_table_setn(req->headers, \"Content-Length\", \"0\");   /* unchanged */\n```\n\nProperties that matter:\n\n* the **vulnerable statement is byte-for-byte identical** \u2014 only a log line is\n  added above it;\n* the marker is **inert** unless `H2_CVE_2026_119618_TRACE=1` is set;\n* the script **prints the exact diff** it applies;\n* it is **idempotent**, and refuses to patch a tree that already contains the\n  2.4.71 *fixed* statement.\n\n### 8.3 The trigger\n\nThe PoC sends requests whose header block matches the vulnerable branch\nexactly: `content-type` present, `content-length` absent, and the header count\nswept across APR's growth boundaries so that at least one request shape reaches\nthe shared pool.\n\n```console\n$ python3 poc/poc.py --target 127.0.0.1:8080 --sweep\n[.] iter 1/3 [no_body   ] [hdr= 10] sent=   48 answered=   48 5xx=  0 rst=  0 \u2026\n[.] iter 1/3 [no_body   ] [hdr= 20] sent=   48 answered=   48 5xx=  0 rst=  0 \u2026\n[.] iter 1/3 [no_body   ] [hdr= 40] sent=   48 answered=   48 5xx=  0 rst=  0 \u2026\n[.] iter 1/3 [no_body   ] [hdr= 80] sent=   48 answered=   48 5xx=  0 rst=  0 \u2026\n[.] iter 1/3 [body_abort] [hdr= 10] sent=   48 answered=   24 5xx=  0 rst= 24 \u2026\n\u2026\n RESULT: VULNERABLE CODE PATH CONFIRMED\n   The server executed the vulnerable assign_headers() branch 576 time(s),\n   of which 576 allocated from the shared APR pool.\n```\n\nTwo request variants cover both routes into the vulnerable statement:\n\n| Variant | Path in `mod_http2` |\n|---|---|\n| `no_body` | `h2_c2.c:748` \u2014 `no_body = (conn_ctx->beam_in == NULL)` |\n| `body_abort` | `h2_c2_filter.c:658` \u2014 the c2 error path, `no_body = 1` |\n\n### 8.4 Avoiding false positives\n\nTwo traps, both handled:\n\n* **`body_abort` resets streams on purpose**, so its disconnects are\n  self-inflicted and are excluded from the evidence.\n* **RST_STREAM and GOAWAY are normal load shedding.** They are reported as\n  *weak* indicators and never counted as proof. Only a TCP **RST** with requests\n  in flight, HTTP/2 protocol errors on the wire, 5xx responses, or a server that\n  stops answering count as strong signals.\n\n---\n\n## 9. The instrumented lab\n\nReproducing a race needs a race-friendly build. Because Docker was unavailable\nand the host had no root, the lab builds everything from source into a local\nprefix:\n\n```bash\n./poc/build_instrumented_httpd.sh tsan     # ThreadSanitizer\n./poc/build_instrumented_httpd.sh asan     # AddressSanitizer\n```\n\nIt builds APR 1.7.6, APR-util 1.6.4, PCRE2 10.45, nghttp2 1.70.0 and httpd\n2.4.69 with the sanitizer in `CFLAGS`/`LDFLAGS`, and applies the marker\ninstrumentation automatically.\n\n```bash\n./poc/run_poc.sh              # one command: build if needed \u2192 start \u2192 PoC \u2192 verdict\n./poc/run_poc.sh tsan --repeat 3\n```\n\n### 9.1 Build notes worth stealing\n\n* **TSAN and `-fPIC` do not mix.** APR's configure fails with\n  `cannot compute suffix of executables`. Drop `-fPIC`.\n* **httpd wants `--with-apr-util`**, not `--with-apu` (the latter is Apache 1.3\n  legacy). With the wrong flag: `APR-util not found`.\n* **`-lcrypt` belongs in `LIBS`, not `LDFLAGS`** \u2014 libraries must be linked\n  *after* the objects that need them. On a host without the `libcrypt.so`\n  development symlink, create a private one and point `-L` at it.\n* **One source tree per sanitizer.** Two parallel builds sharing a tree clobber\n  each other's `configure` run.\n* **`apr_thread.h` is private in APR 1.7.** Use `apr.h` and `apr_general.h`.\n\n---\n\n## 10. Remediation\n\n1. **Upgrade** to Apache HTTP Server **2.4.71** or newer, or to a distribution\n   package carrying the fix.\n2. **If patching is not possible**, remove HTTP/2 from the `Protocols`\n   directive \u2014 server-wide *and* in every `VirtualHost`:\n\n   ```apache\n   Protocols http/1.1\n   ```\n\n   The advisory offers no other workaround.\n3. **Standalone `mod_h2` has no fixed release** (the upstream repository was\n   archived on 2026-06-09). The `Protocols` change is the only mitigation.\n4. **Red Hat's per-stream allocator is hardening, not a fix.** Patch RHEL 9 and\n   10 as well.\n\n### Distribution status\n\n| Platform | Status | Fixed package |\n|---|---|---|\n| Apache HTTP Server project | Fixed | 2.4.71 |\n| RHEL 9 | Fixed (RHSA-2026:98981) | `mod_http2-2.0.26-7.el9_9.1` |\n| RHEL 10 | Fixed (RHSA-2026:98978) | `mod_http2-2.0.29-5.el10_3.1` |\n| RHEL 6 / 7 / 8 | Not affected | \u2014 |\n| Debian sid | Fixed | `apache2 2.4.71-1` |\n| Debian bookworm / trixie / forky | Vulnerable | \u2014 |\n| Amazon Linux 2 / 2023 / 2027 | Pending fix | \u2014 |\n\n---\n\n## 11. Limitations\n\nHonest accounting of what this work does and does not establish.\n\n* **The heap corruption does not reliably manifest in the live server.** The\n  race is won occasionally; the stock Debian Apache 2.4.69 did not crash in\n  5/5 runs. The TSAN race report and the deterministic marker cover for this \u2014\n  the vulnerable code path and the shared-pool allocation are proven on every\n  run; the crash is a bonus.\n* **The marker requires access to the server's output.** For a remote target\n  you do not control, the PoC falls back to the probabilistic signals. The\n  detector's version/protocol verdict is deterministic without it.\n* **Version fingerprinting depends on the `Server:` header.** With\n  `ServerTokens Min` the version may be hidden \u2014 the detector reports\n  *undetermined* and suggests `--version-override` or a local audit.\n* **A CDN or load balancer in front of httpd hides the origin version.** Scan\n  the origin directly.\n* **The active probe is intrusive.** It is opt-in (`--probe`) and should only\n  be run against hosts you are authorised to test.\n\n### Scope\n\nThis work demonstrates the vulnerability as **memory corruption**, with a\ndeterministic proof that the vulnerable code path and its shared-pool\nallocation are reachable. It deliberately does **not** include heap grooming\nfor control-flow hijack, a shell payload, or any other weaponisation of the\ncorruption into code execution.\n\n---\n\n## 12. Reproducing everything\n\n### 12.1 Requirements\n\n```bash\ngit clone \ncd apache2-cve-rce\npip install -r requirements.txt      # hyper-h2 + hpack\n```\n\n### 12.2 Detection\n\n```bash\npython3 detector/cli.py --local                       # audit this host\npython3 detector/cli.py --target 10.0.0.5 --port 443 --tls\npython3 detector/cli.py --target 10.0.0.5 --port 8080 --probe\npython3 detector/cli.py --target 10.0.0.5 --port 8080 --json\n```\n\n### 12.3 The proof of concept\n\n```bash\n# one command, end to end\n./poc/run_poc.sh\n./poc/run_poc.sh tsan --repeat 3\n\n# or against a server you already have\n./tests/setup_test_server.sh start 8080\npython3 poc/poc.py --target 127.0.0.1:8080 --sweep\n```\n\n### 12.4 The analytical core\n\n```bash\n./poc/build_harness.sh asan\nLD_LIBRARY_PATH=/tmp/httpd-san/asan/apr/lib ASAN_OPTIONS=detect_leaks=0 \\\n  poc/bin/pool_probe\n```\n\n### 12.5 The test suite\n\n```bash\n./tests/run_tests.sh\n```\n\nStarts a real Apache 2.4.69 with `mod_http2` plus a control instance with\nHTTP/2 disabled, and asserts 15 checks \u2014 vulnerable verdict over h2c, over\nTLS/ALPN, *not vulnerable* for the same binary with HTTP/2 disabled,\n*undetermined* for an unreachable target, valid JSON, the local audit, and the\nactive probe.\n\n---\n\n## 13. References\n\n* [The Hacker News \u2014 Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely](https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html)\n* [Apache HTTP Server 2.4 vulnerability list \u2014 CVE-2026-119618](https://httpd.apache.org/security/vulnerabilities_24.html)\n* [Wiz \u2014 Critical RCE Vulnerability in Apache HTTP Server](https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability)\n* [Red Hat \u2014 CVE-2026-119618 severity assessment](https://access.redhat.com/security/cve/cve-2026-119618)\n* [Debian security tracker](https://security-tracker.debian.org/tracker/CVE-2026-119618)\n* [Apache HTTP Server \u2014 `mod_http2` documentation](https://httpd.apache.org/docs/2.4/mod/mod_http2.html)\n* Fix commit [`824beab9b9424d6cfb29595248fdbf6c3dddeab1`](https://github.com/apache/httpd/commit/824beab9b9424d6cfb29595248fdbf6c3dddeab1)\n* Upstream PR [icing/mod_h2#975](https://github.com/icing/mod_h2/pull/975)\n\n---\n\n## Appendix A \u2014 the shared table, end to end\n\n```\nclient                     session thread (c1)              worker thread (c2)\n\u2500\u2500\u2500\u2500\u2500\u2500                     \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500            \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nHEADERS frame\n  :method/:scheme/\u2026   \u2500\u2500\u25b6  h2_request_add_header()\n                             (pseudo-headers \u2192 struct fields)\n  content-type: \u2026         h2_req_add_header() \u2192 req->headers\n  host: \u2026                 (10 entries \u2192 table exactly full)\n  x-pad-0 \u2026 x-pad-7\n  END_STREAM              h2_request_end_headers()\n                             \u2192 apr_table_setn(Host)  [overwrite, no growth]\n                             \u2192 stream->request = req\n                                                          dispatch to worker\n                                                          c2_process()\n                                                          h2_create_request_rec()\n                                                            assign_headers()\n                                                              apr_table_get(Content-Length) \u2192 NULL\n                                                              apr_table_get(Content-Type)   \u2192 hit\n                                                              apr_table_setn(req->headers,\n                                                                             \"Content-Length\", \"0\")\n                                                                \u2514\u2500\u25ba table_push()\n                                                                    \u2514\u2500\u25ba nelts == nalloc\n                                                                        \u2514\u2500\u25ba apr_array_push_noclear()\n                                                                            \u2514\u2500\u25ba apr_palloc(shared pool)\n                                                                            \u2514\u2500\u25ba new array, OLD ARRAY ABANDONED\n                                                          \u2026another worker thread doing the same\u2026\n```\n\nThe last two lines are the race.\n\n\n*All findings in this article were produced against locally built, instrumented\nApache HTTP Server 2.4.69 and the host's own Apache 2.4.69. No third-party\nsystems were scanned, and no exploitation chain was developed.*\n", "url": "https://gist.github.com/cyberheartmi9/d3f0c1f9683b51be5eb205146dc33694"}, {"timestamp": "2026-11-12T10:00:06.504Z", "date_only": false, "value": "2026-11-12T10:00:06.504307Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/geeknewsbot.bsky.social/post/3n247k5yhuy2i", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "528ffe1d-1920-42cd-af4b-fff02e7304a4", "content": "Apache HTTP Server\uc758 \uce58\uba85\uc801\uc778 \uc6d0\uaca9 \ucf54\ub4dc \uc2e4\ud589 \ucde8\uc57d\uc810\n\nApache HTTP Server\uc758 HTTP/2 \ubaa8\ub4c8\uc5d0\uc11c CVE-2026-119618 \ucde8\uc57d\uc810\uc774 \ubc1c\uacac\ub428. \uc778\uc99d\ub418\uc9c0 \uc54a\uc740 \uc6d0\uaca9 \uacf5\uaca9\uc790\uac00 \uc545\uc6a9\uc5d0 \uc131\uacf5\ud558\uba74 \ud799 \uba54\ubaa8\ub9ac\ub97c \uc190\uc0c1\uc2dc\ucf1c \uc6f9 \uc11c\ubc84 \ud504\ub85c\uc138\uc2a4 \uad8c\ud55c\uc73c\ub85c \uc784\uc758 \ucf54\ub4dc\ub97c \uc2e4\ud589\ud560 \uc218 \uc788\uc74c \uc6d0\uc778\uc740 assign_headers() \ud568\uc218\uc758 \uacbd\uc7c1 \uc0c1\ud0dc \ub85c, \uacf5\uc720 \uc790\uc6d0\uc744 \uc0ac\uc6a9\ud558\ub294 \uc2a4\ub808\ub4dc\uc758 ...", "url": "https://bsky.app/profile/geeknewsbot.bsky.social/post/3n247k5yhuy2i"}, {"timestamp": "2026-11-12T10:01:29.329Z", "date_only": false, "value": "2026-11-12T10:01:29.329494Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117602889823927317", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "a093f03c-1e58-427a-a778-47065345496f", "content": "Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely\nA critical flaw in Apache HTTP Server\u2019s HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday. Only servers with HTTP/2 enabled are affected, according to Red Hat. https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html", "url": "https://infosec.exchange/users/edwardk/statuses/117602889823927317"}, {"timestamp": "2026-11-12T10:13:56.711Z", "date_only": false, "value": "2026-11-12T10:13:56.711235Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsyc200.bsky.social/post/3n24acvotzy2u", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "4994cd71-8df1-44c3-9ae3-38e3be2a75b9", "content": "Critical RCE Vulnerability in Apache HTTP Server https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability (http://news.ycombinator.com/item?id=50462177)", "url": "https://bsky.app/profile/newsyc200.bsky.social/post/3n24acvotzy2u"}, {"timestamp": "2026-11-12T10:19:36.773Z", "date_only": false, "value": "2026-11-12T10:19:36.773272Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/decio/statuses/117602961078316146", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "3ff43cc0-8a46-4b85-a415-226ebf60ab83", "content": "\u26a0\ufe0f  Apache HTTP Server \u2013 CVE-2026-119618 (CVSS 9.8)\nUne vuln\u00e9rabilit\u00e9 critique dans mod_http2 permet l'ex\u00e9cution de code \u00e0 distance (RCE) sans authentification, via une corruption m\u00e9moire. Versions Apache 2.4.55 \u00e0 2.4.70 concern\u00e9es.\nConditions d'exploitation : le serveur doit \u00eatre accessible, avec le module mod_http2 charg\u00e9 et HTTP/2 activ\u00e9 (h2 ou h2c). Des requ\u00eates HTTP/2 concurrentes sp\u00e9cialement construites peuvent d\u00e9clencher la faille. Les serveurs utilisant uniquement HTTP/1.1 ne sont pas concern\u00e9s.\n\ud83d\udc27 C\u00f4t\u00e9 Linux : :linus2: \n\nDebian 12/13 : vuln\u00e9rables, correctifs attendus. Sid d\u00e9j\u00e0 corrig\u00e9e. :debian: \nRHEL 9/10 : correctifs disponibles, exploitation plus complexe selon Red Hat (s\u00e9v\u00e9rit\u00e9 \u00ab Important \u00bb).\nRHEL 8 et ant\u00e9rieures : non affect\u00e9es. :redhat: \nAmazon Linux : correctifs attendus.\nUn PoC public est d\u00e9j\u00e0 disponible ! Il d\u00e9montre la corruption m\u00e9moire et des plantages d'Apache, mais pas encore une RCE fonctionnelle.\ud83d\udc40 \u2b07\ufe0f https://github.com/googlesky/CVE-2026-119618\nAucune exploitation en masse confirm\u00e9e \u00e0 ce stade.\nV\u00e9rifions nos serveurs Apache expos\u00e9s \u00e0 Internet, appliquons les correctifs disponibles ou d\u00e9sactivons temporairement HTTP/2 (Protocols http/1.1), y compris dans les VirtualHosts.\nAttention aux correctifs r\u00e9troport\u00e9s par les distributions : la version affich\u00e9e d'Apache ne suffit pas \u00e0 d\u00e9terminer si nous sommes vuln\u00e9rables....\n:debian:  https://security-tracker.debian.org/tracker/CVE-2026-119618\n:redhat: https://access.redhat.com/security/cve/cve-2026-119618\n#CyberVeille #Apache", "url": "https://infosec.exchange/users/decio/statuses/117602961078316146"}, {"timestamp": "2026-11-12T10:19:57.103Z", "date_only": false, "value": "2026-11-12T10:19:57.103645Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hn-frontpage-bot.bsky.social/post/3n24anmtr6p2r", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "026e1621-2746-4393-9801-029ea72055f7", "content": "A critical race condition in Apache HTTP Server\u2019s mod_http2 module (CVE-2026-119618) allows remote attackers to trigger heap corruption and achieve RCE. Users should update to version 2.4.71 or disable HTTP/2 to mitigate risks to cloud environments.", "url": "https://bsky.app/profile/hn-frontpage-bot.bsky.social/post/3n24anmtr6p2r"}, {"timestamp": "2026-11-12T10:23:17.104Z", "date_only": false, "value": "2026-11-12T10:23:17.104100Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/outagewatch.flarewarden.com/post/3n24at75yds4c", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "73dedbd6-7280-4337-a99e-a3639cbb0c15", "content": "\ud83d\udfe1 Liquid Web: Security Advisory: Apache HTTP/2 Vulnerability (CVE-2026-119618)\nMinor issue \u00b7 Hosting \u00b7 since 10:20 UTC\nOur probes: liquidweb.com reachable from all 8 regions\nDetails \u2197 \u00b7 #LiquidWeb", "url": "https://bsky.app/profile/outagewatch.flarewarden.com/post/3n24at75yds4c"}, {"timestamp": "2026-11-12T11:00:11Z", "date_only": false, "value": "2026-11-12T11:00:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/gZzoVw8tbexPflBWb9XSivtdmaiB1sOq6LklkLgCAxGQVm4", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "29f1dff5-4162-44cf-89c9-69c16d25cc21", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-12T11:00:11Z", "date_only": false, "value": "2026-11-12T11:00:11.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/gZzoVw8tbexPflBWb9XSivtdmaiB1sOq6LklkLgCAxGQVm4", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "8bef0cad-3f91-48d8-9aec-b4816540b425"}, {"timestamp": "2026-11-12T11:26:59.009Z", "date_only": false, "value": "2026-11-12T11:26:59.009019Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hermesvector.bsky.social/post/3n24efiodbr2t", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "eb46714c-ab3d-4186-a78f-6edcba2eca9a", "content": "Critical Apache HTTP/2 Vulnerability Allows Remote Code Execution\n\nApache HTTP Server versions 2.4.55 through 2.4.70 are affected by CVE-2026-119618, a critical heap corruption flaw in mod_http2 that can lead to remote code execution. Apache released version 2.4.71 on November 11, 2026\u2026", "url": "https://bsky.app/profile/hermesvector.bsky.social/post/3n24efiodbr2t"}, {"timestamp": "2026-11-12T11:42:16.829Z", "date_only": false, "value": "2026-11-12T11:42:16.829445Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/winsontang.com/post/3n24fatlgjd26", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "be188b93-acaf-4474-8f4e-0a6b6f1425a4", "content": "A critical RCE vulnerability has been identified in Apache HTTP Server, posing serious risks to web applications. It's crucial for administrators to assess their systems and apply patches promptly to safeguard against pot\u2026\n\nhttps://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability", "url": "https://bsky.app/profile/winsontang.com/post/3n24fatlgjd26"}, {"timestamp": "2026-11-12T11:52:40.464Z", "date_only": false, "value": "2026-11-12T11:52:40.464472Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/adhisimon.kodesumber.com.ap.brid.gy/post/3n24ftcpaf752", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "c2ea5d8a-f382-4c55-b1d3-41ff11bb9e1e", "content": "**CVE-2026-119618**\n\n> Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2 [\u2026]", "url": "https://bsky.app/profile/adhisimon.kodesumber.com.ap.brid.gy/post/3n24ftcpaf752"}, {"timestamp": "2026-11-12T12:34:00.418Z", "date_only": false, "value": "2026-11-12T12:34:00.418960Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsyc250.bsky.social/post/3n24i5dxnh72q", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "195ae0cb-a819-4656-a3fc-eb02bf48b562", "content": "Critical RCE Vulnerability in Apache HTTP Server https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability (http://news.ycombinator.com/item?id=50462177)", "url": "https://bsky.app/profile/newsyc250.bsky.social/post/3n24i5dxnh72q"}, {"timestamp": "2026-11-12T12:59:34.364Z", "date_only": false, "value": "2026-11-12T12:59:34.364319Z", "kind": "sighting", "label": "Seen", "source": "https://social.circl.lu/users/circl/statuses/117603590053630597", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "efb0a8f7-4489-4246-a75f-72a9114f7564", "content": "TR-103 - Critical Remote Code Execution in Apache HTTP Server `mod_http2` - CVE-2026-119618\n\ud83d\udd17 https://www.circl.lu/pub/tr-103/\n#cve #vulnerabilitymanagement #cybersecurity #apache", "url": "https://social.circl.lu/users/circl/statuses/117603590053630597"}, {"timestamp": "2026-11-12T13:30:17.542Z", "date_only": false, "value": "2026-11-12T13:30:17.542206Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/gazewires.bsky.social/post/3n24lbxymzv2q", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "c0dc9ec8-4fa5-4f1c-b911-0c9d1da2f355", "content": "\ud83d\udd10 Critical Vulnerability Identified in Apache HTTP/2 Module\n\nA high-severity vulnerability, tracked as CVE-2026-119618, allows unauthenticated attackers to potentially gain control over affected server processes.\n\n\ud83d\udd17 Read the full story on GazeWire\n\n#Cybersecurity #Linux #WebServers #GazeWire", "url": "https://bsky.app/profile/gazewires.bsky.social/post/3n24lbxymzv2q"}, {"timestamp": "2026-11-12T13:31:19.810Z", "date_only": false, "value": "2026-11-12T13:31:19.810163Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/james.rcpt.to/post/3n24ldtq7kc2v", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "056967d5-e505-453a-9038-4f39e424d8f9", "content": "apache2 (2.4.71-1~deb13u1) trixie-security; urgency=medium\n\n  * New upstream release\n    (Closes: #1153732, CVE-2026-119618, CVE-2026-106023, CVE-2026-109163)\n  * Unfuzz patches", "url": "https://bsky.app/profile/james.rcpt.to/post/3n24ldtq7kc2v"}, {"timestamp": "2026-11-12T14:26:51.590Z", "date_only": false, "value": "2026-11-12T14:26:51.590147Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thelabledger.bsky.social/post/3n24oh56wcc2p", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "59487342-548a-479c-8ab3-81c3496bf68a", "content": "\ud83d\udea8 Apache HTTP Server CVE-2026-119618 (critical): a mod_http2 bug can allow unauthenticated RCE. Affects 2.4.55\u20132.4.70 with HTTP/2 on. Update to 2.4.71 or drop h2/h2c from Protocols.\nhttpd.apache.org/security/vul...\n#Apache #infosec #cybersecurity #CVE #selfhosted", "url": "https://bsky.app/profile/thelabledger.bsky.social/post/3n24oh56wcc2p"}, {"timestamp": "2026-11-12T14:35:42.480Z", "date_only": false, "value": "2026-11-12T14:35:42.480696Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hn.rbrt.fr/post/3n24owxalks2b", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "ccae89e3-2dfc-4837-85cf-4cc323befb92", "content": "Critical RCE Vulnerability in Apache HTTP Server\nhttps://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability\nhttps://news.ycombinator.com/item?id=50462177", "url": "https://bsky.app/profile/hn.rbrt.fr/post/3n24owxalks2b"}, {"timestamp": "2026-11-12T14:38:31Z", "date_only": false, "value": "2026-11-12T14:38:31.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google/", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "1a9bdb77-a4f5-4930-855e-c74020d79435", "content": "The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.\n\nThe post Apache Patches Critical HTTP Server RCE Found by Anthropic, Google appeared first on SecurityWeek.", "url": "https://www.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google/"}, {"timestamp": "2026-11-12T15:03:07.825Z", "date_only": false, "value": "2026-11-12T15:03:07.825005Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hnfeed.bsky.social/post/3n24qhxwa4d2f", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "09c62e89-5150-41c9-83e9-15e42b1caa54", "content": "Critical RCE Vulnerability in Apache HTTP Server\nhttps://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability \n[comments] [300 points]", "url": "https://bsky.app/profile/hnfeed.bsky.social/post/3n24qhxwa4d2f"}, {"timestamp": "2026-11-12T15:11:17.825Z", "date_only": false, "value": "2026-11-12T15:11:17.825695Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/betterhn300.e-work.xyz/post/3n24qwlpljz22", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "3302ed24-30e1-491f-81fc-67d88b6640b7", "content": "Critical RCE Vulnerability in Apache HTTP Server https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability (https://news.ycombinator.com/item?id=50462177)", "url": "https://bsky.app/profile/betterhn300.e-work.xyz/post/3n24qwlpljz22"}, {"timestamp": "2026-11-12T15:20:11.928Z", "date_only": false, "value": "2026-11-12T15:20:11.928763Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/365tipu.cz/post/3n24rgipesq23", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "f9d348a4-cc86-477b-b214-13d0a7e8e780", "content": "Apache vydal opravu kritick\u00e9 zranitelnosti v modulu HTTP/2 serveru Apache HTTP Server.  CVE-2026-119618 m\u016f\u017ee v\u00e9st ke vzd\u00e1len\u00e9mu spu\u0161t\u011bn\u00ed k\u00f3du na zraniteln\u00fdch serverech.", "url": "https://bsky.app/profile/365tipu.cz/post/3n24rgipesq23"}, {"timestamp": "2026-11-12T15:27:43.955Z", "date_only": false, "value": "2026-11-12T15:27:43.955298Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/117604172632503926", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "7cabea6a-93de-4b6e-8df6-3520c53686b4", "content": "Oh my.\nhttps://www.cve.org/CVERecord?id=CVE-2026-119618\n\nConcurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.", "url": "https://infosec.exchange/users/cR0w/statuses/117604172632503926"}, {"timestamp": "2026-11-12T15:36:27.986Z", "date_only": false, "value": "2026-11-12T15:36:27.986504Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/carolina.norden.social.ap.brid.gy/post/3n24sdemt5ck2", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "1b4c8e63-9069-45cb-885c-36aec545c9b4", "content": "Und w\u00e4hrend wir uns gerade von den Sichheitsl\u00fccken der letzten Tage erholen:\n\n\"Anthropic's OSS Scanner\"\nhttps://www.cve.org/CVERecord?id=CVE-2026-119618\n\n#apache #security #ki", "url": "https://bsky.app/profile/carolina.norden.social.ap.brid.gy/post/3n24sdemt5ck2"}, {"timestamp": "2026-11-12T16:06:59.597Z", "date_only": false, "value": "2026-11-12T16:06:59.597435Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3n24u26us3m2n", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "b7871948-df39-4084-b9c5-8d3933a2b858", "content": "Apache fixed a critical unauthenticated RCE in mod_http2 (CVE-2026-119618, CVSS 9.8) in httpd 2.4.71. It affects 2.4.55 to 2.4.70 with HTTP/2 enabled. Anthropic's scanner and Google Cloud researchers found it; Wiz saw no exploitation yet. httpd.apache.org/security/vulnerabilities_24.html", "url": "https://bsky.app/profile/entorisec.bsky.social/post/3n24u26us3m2n"}, {"timestamp": "2026-11-12T16:08:19.632Z", "date_only": false, "value": "2026-11-12T16:08:19.632470Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alvantages.bsky.social/post/3n24u4i7xxk2b", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "12465895-cf3c-4f4d-b3ef-b3bcf2719219", "content": "Apache HTTP Server 2.4.71 fixes a critical bug in mod_http2 (CVE-2026-119618). No login needed: an attacker who can reach the server can run code on it. Affected: 2.4.55 through 2.4.70 with HTTP/2 on. Update, or set Protocols http/1.1 until you can.\n\nthehackernews.com/2026/11/crit...", "url": "https://bsky.app/profile/alvantages.bsky.social/post/3n24u4i7xxk2b"}, {"timestamp": "2026-11-12T16:26:30.921Z", "date_only": false, "value": "2026-11-12T16:26:30.921739Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blazr.chaos.social.ap.brid.gy/post/3n24v4wf3zfl2", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "3257c743-fcb9-4842-9bd0-7458fa8d3932", "content": "ach ja...\nhttps://cvedatabase.com/cve/CVE-2026-119618", "url": "https://bsky.app/profile/blazr.chaos.social.ap.brid.gy/post/3n24v4wf3zfl2"}, {"timestamp": "2026-11-12T16:53:04.981Z", "date_only": false, "value": "2026-11-12T16:53:04.981177Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tecnologiageek.com/post/3n24wmlzv5c2g", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "462f2104-64df-48b1-bb75-f1c3e68d337c", "content": "Vulnerabilidad de Apache CVE-2026-119618: c\u00f3digo sin\u00a0login\n\nLa vulnerabilidad de Apache CVE-2026-119618 abre c\u00f3digo remoto sin login en HTTP/2. Versiones afectadas y parche 2.4.71....", "url": "https://bsky.app/profile/tecnologiageek.com/post/3n24wmlzv5c2g"}, {"timestamp": "2026-11-12T17:34:30.423Z", "date_only": false, "value": "2026-11-12T17:34:30.423502Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3n24ywo3hkx2m", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "cd1f67b0-bb32-4bc3-8c53-0753e7304e2d", "content": "Apache HTTP Server \u306e mod_http2 \u306b\u6df1\u523b\u306aRCE\u8106\u5f31\u6027(CVE-2026-119618)\u304c\u767a\u898b\u3055\u308c\u3001\u4fee\u6b63\u3055\u308c\u307e\u3057\u305f\u3002HTTP/2\u6709\u52b9\u30b5\u30fc\u30d0\u30fc\u3067\u8a8d\u8a3c\u306a\u3057\u306b\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u53ef\u80fd\u6027\u2026", "url": "https://bsky.app/profile/postac001.bsky.social/post/3n24ywo3hkx2m"}, {"timestamp": "2026-11-12T17:45:25.818Z", "date_only": false, "value": "2026-11-12T17:45:25.818722Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3n24zk5krdr27", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "a3531556-6958-44f7-910c-8895e9ca63c9", "content": "mod_http2 in apache http server affected by cve-2026-119618, a race condition allowing unauth'd code exec. update to 2.4.71 or disable http/2. #infosec https://0daynews.com/articles/2026-11-12-apache-http-server-mod-http2-cve-2026-119618-rce/", "url": "https://bsky.app/profile/0daynews.bsky.social/post/3n24zk5krdr27"}, {"timestamp": "2026-11-12T17:58:51.796Z", "date_only": false, "value": "2026-11-12T17:58:51.796930Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/censys.bsky.social/post/3n252c7l3i22d", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "a2155540-79ec-49f2-815e-2f7b2fcf183f", "content": "\ud83d\udea8 Critical Apache HTTP Server RCE (CVE-2026-119618, CVSS 9.8) \n\nCensys ARC observes ~166 million Apache HTTP Server web properties on the Internet. HTTP/2 is required and exposure does not confirm vulnerability. Fixed in 2.4.71. Advisory with queries: https://bit.ly/4iC6CmT", "url": "https://bsky.app/profile/censys.bsky.social/post/3n252c7l3i22d"}, {"timestamp": "2026-11-12T18:01:53.398Z", "date_only": false, "value": "2026-11-12T18:01:53.398633Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3s756rm4tps5o", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "ce7f3434-6762-4ac1-a6a0-76f5a689e6e7", "content": "Apache HTTP/2: Race to RCE \u2013 CVE-2026-119618", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3s756rm4tps5o"}, {"timestamp": "2026-11-12T18:03:08Z", "date_only": false, "value": "2026-11-12T18:03:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/information_security_channel/56275", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "d5a95045-940b-42ef-8c42-15aa9fa02544", "content": "Apache Patches Critical HTTP Server RCE Found by Anthropic, Google\nhttps://www.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google/\n\nThe mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.\nThe post Apache Patches Critical HTTP Server RCE Found by Anthropic, Google (https://www.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google/) appeared first on SecurityWeek (https://www.securityweek.com/).", "url": "https://t.me/information_security_channel/56275"}, {"timestamp": "2026-11-12T18:37:28.715Z", "date_only": false, "value": "2026-11-12T18:37:28.715272Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/talkwithtech.bsky.social/post/3n254h5ygnj25", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "fa290fc8-5f1d-4fef-91c6-c92fb6d9f256", "content": "Apache HTTP/2 has a race condition (CVE-2026-119618) that can allow unauthenticated code execution. Patch to 2.4.71 or temporarily restrict Protocols to http/1.1. One hashtag okay", "url": "https://bsky.app/profile/talkwithtech.bsky.social/post/3n254h5ygnj25"}, {"timestamp": "2026-11-12T19:00:08.610Z", "date_only": false, "value": "2026-11-12T19:00:08.610284Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3n255pskvfl2t", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "a8b3013e-530c-49fb-bef8-228b3ee67e0e", "content": "\ud83d\udce2 [VULN] \u26a0\ufe0f Apache HTTP Server : faille critique dans mod_http2 permettant une ex\u00e9cution de code \u00e0 distance - CVE-2026-119618\n\nUne condition de course dans le traitement des requ\u00eates HTTP/2 simultan\u00e9es permet \u00e0 un attaquant non authentifi\u00e9 de corrompre la m\u00e9moire et potentiellemen\u2026\n\n#CVE #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3n255pskvfl2t"}, {"timestamp": "2026-11-12T19:02:04.639Z", "date_only": false, "value": "2026-11-12T19:02:04.639236Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackoutmap.net/post/3n255t5tbb62b", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "5408093c-0317-4af4-968a-acf70b262d71", "content": "Apache fixed a critical flaw in its HTTP/2 code yesterday (CVE-2026-119618). It can let someone run code on a web server without logging in, but only where HTTP/2 is switched on. Two teams found it eight days apart. Who is at risk:\nhttps://blackoutmap.net/blog/apache-http2-cve-2026-119618", "url": "https://bsky.app/profile/blackoutmap.net/post/3n255t5tbb62b"}, {"timestamp": "2026-11-12T19:07:53.087Z", "date_only": false, "value": "2026-11-12T19:07:53.087011Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pentest-tools.com/post/3n2565k3nhk24", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "6d53dbde-2691-4c79-a20d-54029bb0dc37", "content": "Too tired to hunt for the config detail that decides if #Apache CVE-2026-119618 needs emergency patching? Our new free scanner checks both conditions that make the RCE risk real:\n\u2192 Apache 2.4.55\u20132.4.70\n\u2192 HTTP/2 on", "url": "https://bsky.app/profile/pentest-tools.com/post/3n2565k3nhk24"}, {"timestamp": "2026-11-12T19:15:26.828Z", "date_only": false, "value": "2026-11-12T19:15:26.828101Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3n256l5uguc2j", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "d755dbda-14f0-46f1-b7ef-fdf3d8c1845e", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-119618 \u00b7 52 people\n2. CVE-2026-118383 \u00b7 19 people\n3. CVE-2026-124194 \u00b7 15 people \ud83d\udd25\n4. CVE-2026-125350 \u00b7 11 people \ud83d\udd25\n5. CVE-2026-12591 \u00b7 8 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3n256l5uguc2j"}, {"timestamp": "2026-11-12T19:15:28.531Z", "date_only": false, "value": "2026-11-12T19:15:28.531008Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3n256l5y6y22j", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "1957fc04-4ac6-406a-b847-946e6432868a", "content": "1. CVE-2026-119618 \u00b7 52 people\nApache HTTP Server\n\nApache HTTP Server: mod_http2: heap corruption and RCE in assign_headers", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3n256l5y6y22j"}, {"timestamp": "2026-11-12T19:36:22.307Z", "date_only": false, "value": "2026-11-12T19:36:22.307319Z", "kind": "sighting", "label": "Confirmed", "source": "https://ksrc.karenit.net/blog/security-alert/critical-remote-code-execution-in-apache-http-server-mod-http2", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "6f346c75-08fb-401c-bc3a-c96f0936a5d4", "url": "https://ksrc.karenit.net/blog/security-alert/critical-remote-code-execution-in-apache-http-server-mod-http2"}, {"timestamp": "2026-11-12T19:55:57.401Z", "date_only": false, "value": "2026-11-12T19:55:57.40182Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-119618", "record": "BELL-CVE-2026-119618", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-12T19:58:58.903Z", "date_only": false, "value": "2026-11-12T19:58:58.903181Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trustlist.bsky.social/post/3n25ay43u3x2j", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "8154e08c-e2ea-4a6f-832a-32ec407f9f14", "content": "Security advisories 9/21\nApache httpd 2.4.71 fixes a critical mod_http2 code execution flaw\n\nCVE-2026-119618 affects every release from 2.4.55 to 2.4.70 with HTTP/2 enabled, and the standalone mod_h2 module up to 2.0.42.\n\n#infosec #cybersecurity\ntrustlist.uk/security-advisorie\u2026", "url": "https://bsky.app/profile/trustlist.bsky.social/post/3n25ay43u3x2j"}, {"timestamp": "2026-11-12T20:00:10Z", "date_only": false, "value": "2026-11-12T20:00:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110377", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "f1157d58-983d-4618-b3b7-a4fbcde6893b", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Apache-HTTP2-RCE-HEAP-CORRUPTION-CVE-2026-119618-STAND-ALONE-SCANNER\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jeffschafer\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-12 19:25:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nIndependent community CLI scanners for Apache mod_http2 CVE-2026-119618 on Windows, Linux and macOS. Not HCL-supported.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110377", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-12T20:00:10Z", "date_only": false, "value": "2026-11-12T20:00:10.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/110377", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "3c2653e9-75df-43b3-a77b-4dfb7c68d10e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Apache-HTTP2-RCE-HEAP-CORRUPTION-CVE-2026-119618-STAND-ALONE-SCANNER\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jeffschafer\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-12 19:25:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nIndependent community CLI scanners for Apache mod_http2 CVE-2026-119618 on Windows, Linux and macOS. Not HCL-supported.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110377"}, {"timestamp": "2026-11-12T20:03:14.628Z", "date_only": false, "value": "2026-11-12T20:03:14.628604Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117605255979906643", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "205f5edb-8eb1-4127-ae60-a1e0d7095d7b", "content": "\ud83d\udea8 Critical Apache HTTP Server flaw discovered by Anthropic and Google could allow hackers to execute code without authentication; CVE-2026-119618\nThe Apache Software Foundation has released an urgent security update addressing a critical remote code execution vulnerability in Apache HTTP Server's HTTP/2 module.\nThe flaw, tracked as CVE-2026-119618, involves a race condition that could allow unauthenticated attackers to corrupt server memory and potentially execute malicious code on vulnerable systems.\nThe vulnerability was independently discovered by Anthropic's AI-powered OSS Scanner and researchers at Google Cloud.\nApache HTTP Server versions 2.4.55 through 2.4.70 are affected, with version 2.4.71 released to address the issue.\nSource: https://httpd.apache.org/security/vulnerabilities_24\nNo delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing\nNeed API access? darkwebinformer.com/api-details\nCheck out the Telegram channel: t.me/SliceForLifeee", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/117605255979906643"}, {"timestamp": "2026-11-12T20:15:23.746Z", "date_only": false, "value": "2026-11-12T20:15:23.746474Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/techplanet.today/post/3n25bwdpegf2l", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "f9dff30e-cf2a-4d18-a29c-17f9060aa0b3", "content": "Critical RCE Vulnerability in Apache HTTP Server: CVE-2026-119618 Explained\n\nUnderstanding CVE-2026-119618: A Critical Race Condition in Apache HTTP Server\nOn November 11, 2026, a critical vulnerability was disclos\u2026\n\n#cybersecurity #apache #vulnerability #rce #http2 #web-server #security-patch ", "url": "https://bsky.app/profile/techplanet.today/post/3n25bwdpegf2l"}, {"timestamp": "2026-11-12T20:24:46.976Z", "date_only": false, "value": "2026-11-12T20:24:46.976742Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tierrasapiens.bsky.social/post/3n25cgg6kp62y", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "2cc67f06-16a7-46a3-9769-c2aff495362b", "content": "\ud83d\uddb2\ufe0f #Noticia #CiberSeguridad #Cybersecurity #CiberNoticia\n\nFalla cr\u00edtica en el m\u00f3dulo HTTP/2 de Apache (CVE-2026-119618) permite ejecuci\u00f3n remota de c\u00f3digo sin autenticaci\u00f3n\n\nLeer M\u00e1s / Read More...", "url": "https://bsky.app/profile/tierrasapiens.bsky.social/post/3n25cgg6kp62y"}, {"timestamp": "2026-11-12T20:54:31.650Z", "date_only": false, "value": "2026-11-12T20:54:31.650549Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3n25e4divtc2c", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "c49f0362-9e45-4fe4-9ba8-ba6382f1ac7c", "content": "Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely (CVE-2026-119618) #patchmanagement", "url": "https://bsky.app/profile/eyalestrin.bsky.social/post/3n25e4divtc2c"}, {"timestamp": "2026-11-12T20:56:56.991Z", "date_only": false, "value": "2026-11-12T20:56:56.991Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2026-119618", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-12T21:01:32.538Z", "date_only": false, "value": "2026-11-12T21:01:32.538535Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/five-oclick-tech.bsky.social/post/3n25eithpud24", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "ef7ad7ef-d550-4758-a430-09f608fdbfd3", "content": "Critical RCE in Apache HTTP/2\n\nApache HTTP Server 2.4.55-2.4.70 has CVE-2026-119618, a critical RCE in its mod_http2 module, allowing unauthenticated code execution. Wiz data shows 64% of cloud environments are vulnerable. \u2699\ufe0f", "url": "https://bsky.app/profile/five-oclick-tech.bsky.social/post/3n25eithpud24"}, {"timestamp": "2026-11-12T21:13:05Z", "date_only": false, "value": "2026-11-12T21:13:05.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pphm_HackerNews/3813", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "cc244968-b747-49a7-af74-c1757ff8ad0f", "content": "\ud83d\udd34 Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely\n\nA critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday.\n\nOnly servers with HTTP/2 enabled are affected, according to Red Hat, which ships the server as part of Red Hat Enterprise Linux.\n\nAn attacker who can reach the server needs no authentication to exploit the flaw and could take full control of the server process, the Linux vendor says. It rates the flaw 9.8 out of 10 on the CVSS scale.", "url": "https://t.me/pphm_HackerNews/3813"}, {"timestamp": "2026-11-12T21:17:20.893Z", "date_only": false, "value": "2026-11-12T21:17:20.893", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119618", "record": "FKIE_CVE-2026-119618", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-12T21:27:23.048Z", "date_only": false, "value": "2026-11-12T21:27:23.048455Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3n25fwz7p5c24", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "f779605a-604f-4755-9423-7d75284c8627", "content": "Apache HTTP Server 2.4.71\u516c\u958b\u3001HTTP/2\u306eRCE\u306a\u3069\u8106\u5f31\u6027 3\u4ef6(CVE-2026-119618,CVE-2026-106023,CVE-2026-109163)\u3092\u4fee\u6b63\u3000\u6700\u5927\u6df1\u523b\u5ea6\u300cCritical\u300d\u3001Anthropic\u30fbGoogle\u7814\u7a76\u8005\u304c\u5831\u544a \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30cb\u30e5\u30fc\u30b9", "url": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3n25fwz7p5c24"}, {"timestamp": "2026-11-12T22:00:07Z", "date_only": false, "value": "2026-11-12T22:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110389", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "306385a4-d5d4-47f2-873e-f12b4dde26bb", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-119618\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a LLCForge\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-12 21:51:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWeaponised PoC driver for CVE-2026-119618, the mod_http2 assign_headers() race: header-table shaping, allocator free-list priming, controlled heap overlap and a forged apr_table_entry_t layout with an RCE roadmap. httpd 2.4.55-2.4.70, stdlib-only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110389", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-12T22:00:07Z", "date_only": false, "value": "2026-11-12T22:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/110389", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "1ba6ef61-5ac7-4b43-8083-af048a249400", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-119618\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a LLCForge\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-12 21:51:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWeaponised PoC driver for CVE-2026-119618, the mod_http2 assign_headers() race: header-table shaping, allocator free-list priming, controlled heap overlap and a forged apr_table_entry_t layout with an RCE roadmap. httpd 2.4.55-2.4.70, stdlib-only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110389"}, {"timestamp": "2026-11-12T22:21:11.915Z", "date_only": false, "value": "2026-11-12T22:21:11.915852Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/unnchain.bsky.social/post/3n25ixdewd622", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "990fa26b-4cb1-4ce8-b355-6f25b7fab0a7", "content": "Apache httpd\u3067HTTP/2\u3092\u6709\u52b9\u306b\u3057\u3066\u3044\u308b\u4eba\u3078\u3002\n\nmod_http2\u306e\u540c\u671f\u306e\u4e0d\u5177\u5408\uff08CVE-2026-119618\uff09\u3067\u30d2\u30fc\u30d7\u304c\u58ca\u308c\u3001\u9060\u9694\u304b\u3089\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3055\u308c\u308b\u304a\u305d\u308c\u304c\u3042\u308a\u307e\u3059\u3002Apache\u306e\u8a55\u4fa1\u306fcritical\uff08\u91cd\u5927\uff09\u3002\u5bfe\u8c61\u306f2.4.55\u301c2.4.70\u3002GitHub\u914d\u5e03\u306e\u5358\u72ec\u30e2\u30b8\u30e5\u30fc\u30ebmod_h2\u306f2.0.8\u301c2.0.42\u3082\u5bfe\u8c61\u3067\u3059\u3002\n\n\u4fee\u6b63\u7248\u306e2.4.71\u3078\u66f4\u65b0\u3092\u3002\u516c\u5f0f\u30a2\u30c9\u30d0\u30a4\u30b6\u30ea\u306b\u56de\u907f\u7b56\u306e\u8a18\u8f09\u306f\u3042\u308a\u307e\u305b\u3093\u3002\n\nhttps://httpd.apache.org/security/vulnerabilities_24.html\n#\u8106\u5f31\u6027 #Apache", "url": "https://bsky.app/profile/unnchain.bsky.social/post/3n25ixdewd622"}, {"timestamp": "2026-11-12T23:00:00Z", "date_only": false, "value": "2026-11-12T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4517", "record": "WID-SEC-W-2026-4517", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-12T23:00:00Z", "date_only": false, "value": "2026-11-12T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4517", "record": "WID-SEC-W-2026-4517", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-12T23:00:16Z", "date_only": false, "value": "2026-11-12T23:00:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/4-nNYTQscV_eZhHrvwSngzkuLzlKEzV0RvGD2xz9LDEUDnM", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "514beaf2-da54-42f5-a0af-54b71fcef82c", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-12T23:00:16Z", "date_only": false, "value": "2026-11-12T23:00:16.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/4-nNYTQscV_eZhHrvwSngzkuLzlKEzV0RvGD2xz9LDEUDnM", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "6de545a5-3ef9-45be-a56d-9d5e76defd0a"}, {"timestamp": "2026-11-13T00:00:00Z", "date_only": false, "value": "2026-11-13T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-119618", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2026-11-13T00:00:47Z", "date_only": false, "value": "2026-11-13T00:00:47.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/VulnerabilityNews/45400", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "28f5d67c-2ee3-42f0-b48e-24f8216a9417", "content": "Apache Patches Critical HTTP Server RCE Found by Anthropic, Google\n\nThe mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.\nThe post Apache Patches Critical HTTP Server RCE Found by Anthropic, Google appeared first on SecurityWeek.\nhttps://www.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google/", "url": "https://t.me/VulnerabilityNews/45400"}, {"timestamp": "2026-11-13T00:25:45.137Z", "date_only": false, "value": "2026-11-13T00:25:45.137290Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/johonotodai.bsky.social/post/3n25pvz5ndg2e", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "9cf14931-b236-4bca-aa0e-2f536cccdcdd", "content": "Apache HTTP Server CVE-2026-119618\u3001HTTP/2\u51e6\u7406\u306b\u8a8d\u8a3c\u4e0d\u8981\u306e\u9060\u9694\u30b3\u30fc\u30c9\u5b9f\u884c\u30022.4.71\u3067\u4fee\u6b63", "url": "https://bsky.app/profile/johonotodai.bsky.social/post/3n25pvz5ndg2e"}, {"timestamp": "2026-11-13T00:59:07.499Z", "date_only": false, "value": "2026-11-13T00:59:07.499173Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3n25rrpvrn42f", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "d1baaccf-5c37-4989-bc99-c090aa390142", "content": "\ud83e\udd16 CVE-2026-119618 (critical): heap corruption and RCE in Apache mod_http2 assign_headers(), reachable remotely without auth. Affects httpd 2.4.55-2.4.70, fixed in 2.4.71 (mod_h2 2.0.42 too).\nhttps://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3n25rrpvrn42f"}, {"timestamp": "2026-11-13T02:10:04.099Z", "date_only": false, "value": "2026-11-13T02:10:04.099775Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3n25vqkznbc2r", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "4e54b75d-05cd-49e2-b158-d338f0ba0907", "content": "Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely\n\nA critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is f\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3n25vqkznbc2r"}, {"timestamp": "2026-11-13T03:00:06Z", "date_only": false, "value": "2026-11-13T03:00:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/vFqIoN_aF8kd17kepY4CTQlnL-QDvtJYAjn0aRt-KItkFF8", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "2eced9cd-24b3-405d-9a5c-1f804c57b6cc", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-13T03:00:08Z", "date_only": false, "value": "2026-11-13T03:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/6cvZq1Q02BnZT5VJ58XF8l7upjAGOCwYjn7D_5gO62t3ECs", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "f83900a2-ba74-45d2-bc8a-6528805b70bd", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-13T03:00:13Z", "date_only": false, "value": "2026-11-13T03:00:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/VUsxuHnktslbkmqiRU1LMFozxZ_-K-HVBfKH9Q_8ds_sKQs", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "623c40e0-b8a4-4413-9e96-4dbbb0942754", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-13T03:25:26Z", "date_only": false, "value": "2026-11-13T03:25:26Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-119618", "record": "UBUNTU-CVE-2026-119618", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T04:55:27.313Z", "date_only": false, "value": "2026-11-13T04:55:27.313204Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aman179102.bsky.social/post/3n266u43urj22", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "969091b2-21bc-4ab6-a72c-7bb0d61b50df", "content": "CVE-2026-119618 targets a remote code execution path in a core network daemon, meaning attackers can gain system control without credentials.", "url": "https://bsky.app/profile/aman179102.bsky.social/post/3n266u43urj22"}, {"timestamp": "2026-11-13T05:12:17.482Z", "date_only": false, "value": "2026-11-13T05:12:17.482874Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/dragstersystems.bsky.social/post/3n267wga2fc2d", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "84d027e4-d7b3-4ff5-90d1-71ef9bd68d5b", "content": "Falla cr\u00edtica en el m\u00f3dulo HTTP/2 de Apache (CVE-2026-119618) permite ejecuci\u00f3n remota de c\u00f3digo sin autenticaci\u00f3n\n\nV\u00eda: @seguinfo.bsky.social", "url": "https://bsky.app/profile/dragstersystems.bsky.social/post/3n267wga2fc2d"}, {"timestamp": "2026-11-13T06:18:23.432Z", "date_only": false, "value": "2026-11-13T06:18:23.432410Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsdaily.bsky.social/post/3n26dmleslq25", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "6a09b61f-66c7-4e71-a5cc-bf8b6c1256d1", "content": "Apache HTTP Server patched for critical CVE-2026-119618 RCE vulnerability. Patch now\n\nCan someone send email as you? Free check. https://www.ProNetCyber.com/email/?utm_source=bluesky&utm_medium=post&utm_campaign=news-cybersecurity&utm_content=cybersecurity\n\n#cybersecurity #infosec", "url": "https://bsky.app/profile/cybernewsdaily.bsky.social/post/3n26dmleslq25"}, {"timestamp": "2026-11-13T06:25:19.747Z", "date_only": false, "value": "2026-11-13T06:25:19.747122Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3n26dyzqptz2q", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "a9d7973f-f4b2-46ff-925f-b2c484653e98", "content": "Vuln\u00e9rabilit\u00e9s \u00e9lev\u00e9es (7 \u2264 CVSS < 9) \u00b7 5\n\u2022 Apache HTTP Server (mod_http2) (CVE-2026-119618) (Cyberveille)\n\u2022 Ivanti Endpoint Manager Core (CVE-2026-121653) (Cyberveille)\n\u2022 NetApp ONTAP tools pour VMware vSphere 10 (CERT-FR)\n\u2022 Kaspersky (produits) (CERT-FR)\n\u2022 Sonicwall SonicOS (CERT-FR)", "url": "https://bsky.app/profile/cybowl.bsky.social/post/3n26dyzqptz2q"}, {"timestamp": "2026-11-13T07:00:09Z", "date_only": false, "value": "2026-11-13T07:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110447", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "47749054-9520-452b-9891-5c156da8c53c", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-119618-mod_http2-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a blkph0x\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-13 06:21:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducible Apache mod_http2 CVE-2026-119618 source, HTTP/2, and debugger A/B lab\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110447", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-13T07:00:13.166Z", "date_only": false, "value": "2026-11-13T07:00:13.166956Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/balticsonar.bsky.social/post/3n26fxg3miv2k", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "be68bdd5-74c1-449d-96ab-d3b2e57df091", "content": "Threat level 46/100. Leading development: Remote Code Execution (RCE) vulnerability CVE-2026-119618 in Apache HTTP Server (Cyber). 33 signals \u00b7 12 achievements & investments / 24h.\n\n\u25bc46 \u25c931 \u25b218\nhttps://www.balticsonar.eu/\n#Baltic #NATO #OSINT #BalticSea", "url": "https://bsky.app/profile/balticsonar.bsky.social/post/3n26fxg3miv2k"}, {"timestamp": "2026-11-13T07:00:13.634Z", "date_only": false, "value": "2026-11-13T07:00:13.634138Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/balticsonar.bsky.social/post/3n26fxg6dgc2l", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "68ea8fc2-57a4-4ccb-84be-a82c4e1fec20", "content": "Threat level 46/100. Leading development: Remote Code Execution (RCE) vulnerability CVE-2026-119618 in Apache HTTP Server (Cyber). 33 signals \u00b7 12 achievements & investments / 24h.\n\n\u25bc46 \u25c931 \u25b218\nhttps://www.balticsonar.eu/\n#Baltic #NATO #OSINT #BalticSea", "url": "https://bsky.app/profile/balticsonar.bsky.social/post/3n26fxg6dgc2l"}, {"timestamp": "2026-11-13T07:03:40.983Z", "date_only": false, "value": "2026-11-13T07:03:40.983761Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bontchev.infosec.exchange.ap.brid.gy/post/3n26g5hdgj6h2", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "bdb7c458-e09b-4277-a37c-b258fde0b4bd", "content": "\"CVE-2026-119618: What We Know About the Critical Apache mod_http2 Race Condition\":\n\nhttps://www.praetorian.com/blog/cve-2026-119618/", "url": "https://bsky.app/profile/bontchev.infosec.exchange.ap.brid.gy/post/3n26g5hdgj6h2"}, {"timestamp": "2026-11-13T07:28:41.659Z", "date_only": false, "value": "2026-11-13T07:28:41.659475Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3n26hkd5aat2f", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "c787f364-338c-4c2c-b30d-f7150c2e7c2c", "content": "CVE-2026-119618: What We Know About the Critical Apache mod_http2 Race Condition\n\nThis article places significant weight on configuration dependencies, citing Red Hat's note that RHEL 9/10 allocators substantially increase exploitation difficulty. However, framing this as a rea\u2026\n\nvia Praetorian Blog", "url": "https://bsky.app/profile/arc-codex.com/post/3n26hkd5aat2f"}, {"timestamp": "2026-11-13T07:45:21.008Z", "date_only": false, "value": "2026-11-13T07:45:21.008254Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/mohith808.bsky.social/post/3n26ii4fcjl2k", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "1c65b9f1-a454-41f7-977c-89c082f4325d", "content": "POV: anthropic and google both found the same apache bug before you patched it\n\nCVE-2026-119618, HTTP/2 race condition\naffected: 2.4.55 to 2.4.70\nfix: 2.4.71\n\nno public exploit yet, per wiz\ncan't patch? set Protocols http/1.1\n\nwiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability", "url": "https://bsky.app/profile/mohith808.bsky.social/post/3n26ii4fcjl2k"}, {"timestamp": "2026-11-13T07:57:55.453Z", "date_only": false, "value": "2026-11-13T07:57:55.453487Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3n26j6j6otk2n", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "1ae6caf8-65fe-4b13-a981-ced24cb0e2b1", "content": "CVE-2026-119618 : Critical Apache mod_http2 Flaw Allows Unauthenticated Remote Code Execution. In Apache HTTP Server's HTTP/2 module lets an unauthenticated attacker take control of the server process on versions 2.4.55 through 2.4.70 threat-intelligence.redeyesecurity.com/blog/apache-...", "url": "https://bsky.app/profile/ytroncal.bsky.social/post/3n26j6j6otk2n"}, {"timestamp": "2026-11-13T08:42:47.652Z", "date_only": false, "value": "2026-11-13T08:42:47.652697Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3n26lotetdu23", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "9b596738-290a-46a2-b543-5c36dbfce3c4", "content": "Top 3 CVE for last 7 days:\nCVE-2026-69420: 155 interactions\nCVE-2026-123158: 89 interactions\nCVE-2026-98432: 82 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-69420: 155 interactions\nCVE-2026-119618: 34 interactions\nCVE-2026-118383: 18 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3n26lotetdu23"}, {"timestamp": "2026-11-13T09:00:05Z", "date_only": false, "value": "2026-11-13T09:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/8N52mlm6cic7emkh7h-UJsjbrzvgPKUWcseTwflGA4Vxe4Y", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "35e95be2-5261-4e41-bd3a-efec7ec29c3a", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-13T09:00:07Z", "date_only": false, "value": "2026-11-13T09:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/0sPvMJo9Q1DzdjoxsznZNDxRKO9gKPo6XK06JWepSYI_bh8", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "535c680b-5515-4719-beb9-d0cf9218e0f9", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-13T10:13:30.191Z", "date_only": false, "value": "2026-11-13T10:13:30.191+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4517", "record": "WID-SEC-W-2026-4517", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-13T10:37:42.174Z", "date_only": false, "value": "2026-11-13T10:37:42.174544Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackwatch.de/post/3n26s4baoek2o", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "529433cd-e95e-4b1a-8d44-ee2212b03a9e", "content": "CVE-2026-119618, Apache mod_http2, laut Apache kritisch (RCE). Betroffen 2.4.55 bis 2.4.70, Fix 2.4.71. Kein Workaround, nur das Update. Pr\u00fcfen: apachectl -M | grep http2. Quelle: httpd.apache.org/security/vul...\nVideo und Stimme: KI-generiert.", "url": "https://bsky.app/profile/stackwatch.de/post/3n26s4baoek2o"}, {"timestamp": "2026-11-13T11:00:11Z", "date_only": false, "value": "2026-11-13T11:00:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/nvYtBs2IZhkzQo5JeF56L09vZzAS-A02fbe3p-SYOIpAye4", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "8cec1d9f-5cb5-4425-ae0b-712ff501d528", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-13T11:00:11Z", "date_only": false, "value": "2026-11-13T11:00:11.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/nvYtBs2IZhkzQo5JeF56L09vZzAS-A02fbe3p-SYOIpAye4", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "e415edbd-51c4-405a-a6d0-c3e1879090af"}, {"timestamp": "2026-11-13T11:09:53.508Z", "date_only": false, "value": "2026-11-13T11:09:53.508396Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3n26tvttdma2o", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "7ed062e9-f1c4-4188-987d-c4711ffbb870", "content": "\ud83e\udd16 CVE-2026-119618: unauthenticated RCE in Apache httpd HTTP/2 (2.4.55\u20132.4.70). Concurrent-execution flaw lets attackers run code with httpd privileges. Patched, but many public servers still exposed.\nhttps://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3n26tvttdma2o"}, {"timestamp": "2026-11-13T11:10:57.919Z", "date_only": false, "value": "2026-11-13T11:10:57.919573Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/chycox.ovh/post/3n26txqas5k2d", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "d3a68537-b9dc-4062-860b-37615b020d95", "content": "Apache HTTP Server : CVE-2026-119618 dans mod_http2 blog.chycox.ovh/posts/apache...", "url": "https://bsky.app/profile/chycox.ovh/post/3n26txqas5k2d"}, {"timestamp": "2026-11-13T12:04:43.442Z", "date_only": false, "value": "2026-11-13T12:04:43.442503Z", "kind": "milestone", "label": "Published", "source": "osv_rocky \u00b7 RLSA-2026:98981", "record": "RLSA-2026:98981", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T12:06:37.188Z", "date_only": false, "value": "2026-11-13T12:06:37.188502Z", "kind": "milestone", "label": "Published", "source": "osv_rocky \u00b7 RLSA-2026:98978", "record": "RLSA-2026:98978", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T12:30:18.352Z", "date_only": false, "value": "2026-11-13T12:30:18.352550Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3n26yfn6w5l2m", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "1d8457c2-dd8a-46e5-a633-00455865737c", "content": "mod_http2 update needed: apache 2.4.71 patches critical RCE flaw. Servers with HTTP/2 active are at risk. CVE-2026-119618 resolved. #infosec https://0daynews.com/articles/2026-11-13-apache-http-server-mod-http2-rce-patched/", "url": "https://bsky.app/profile/0daynews.bsky.social/post/3n26yfn6w5l2m"}, {"timestamp": "2026-11-13T13:03:42Z", "date_only": false, "value": "2026-11-13T13:03:42.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/bdufstecru/3586", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "98a489ab-b51f-4cf7-a0fc-c951f83d6694", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 assign_headers() \u043c\u043e\u0434\u0443\u043b\u044f mod_http2 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache HTTP Server \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043e\u0431\u0449\u0435\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434\n\nBDU:2026-19095\nCVE-2026-119618\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://httpd.apache.org/security/vulnerabilities_24.html\n\n\u0414\u043b\u044f mod_http2:\nhttps://github.com/microsoft/azurelinux/pull/20165\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/cve-2026-119618", "url": "https://t.me/bdufstecru/3586", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-13T14:21:35.451Z", "date_only": false, "value": "2026-11-13T14:21:35.451594Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/securestep9/statuses/117609574875143352", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "31895a3b-03c8-41a3-82d2-229fe2098a47", "content": "#Apache Patches Critical HTTP Server #RCE #Vulnerability.The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled:\ud83d\udc47https://www.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google", "url": "https://infosec.exchange/users/securestep9/statuses/117609574875143352"}, {"timestamp": "2026-11-13T14:21:58.614Z", "date_only": false, "value": "2026-11-13T14:21:58.614570Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securestep9.bsky.social/post/3n276nbwfhc23", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "56e983b0-d33a-46e8-b9a7-895b38aa309d", "content": "#Apache Patches Critical HTTP Server #RCE #Vulnerability.\nThe mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled:\n\ud83d\udc47\nwww.securityweek.com/apache-patch...", "url": "https://bsky.app/profile/securestep9.bsky.social/post/3n276nbwfhc23"}, {"timestamp": "2026-11-13T14:49:25.601Z", "date_only": false, "value": "2026-11-13T14:49:25.601529Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thiagolopesdev.bsky.social/post/3n27a6ftqsi2y", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "2d124f50-a452-4a41-9d32-126ddc14480e", "content": "Falha cr\u00edtica no Apache HTTP Server pode permitir execu\u00e7\u00e3o remota de c\u00f3digo. A corre\u00e7\u00e3o j\u00e1 foi publicada.\n\nA vulnerabilidade est\u00e1 no m\u00f3dulo HTTP/2 e foi rastreada como CVE-2026-119618. Vers\u00f5es de 2.4.55 at\u00e9 2.4.70 s\u00e3o afetadas.\n\nSegundo a Wiz, 64% dos ambientes de nuvem t\u00eam\u2026\n\n#seguranca #apache #cve", "url": "https://bsky.app/profile/thiagolopesdev.bsky.social/post/3n27a6ftqsi2y"}, {"timestamp": "2026-11-13T15:00:08Z", "date_only": false, "value": "2026-11-13T15:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/JNi-5jrLmh9t2h1NjZxYB_Z0j6K0YZRvQeCYrK2pNIVSuss", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "8d3d9c2e-358e-43bd-855b-ecc3dcba10c3", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-13T15:00:08Z", "date_only": false, "value": "2026-11-13T15:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/JNi-5jrLmh9t2h1NjZxYB_Z0j6K0YZRvQeCYrK2pNIVSuss", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "5dc9ec84-82e8-4bc1-8a60-880e1d396425"}, {"timestamp": "2026-11-13T15:00:10Z", "date_only": false, "value": "2026-11-13T15:00:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/s5F74QDcwUI9s6ntFwbaFTV9RdOXctBzOYeWG2Zn6aJshd8", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "6ee5a4b3-acc0-4da7-8cb2-553cf3cdfc4e", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-13T15:00:10Z", "date_only": false, "value": "2026-11-13T15:00:10.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/s5F74QDcwUI9s6ntFwbaFTV9RdOXctBzOYeWG2Zn6aJshd8", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "3191ece7-78b4-421b-8d6b-a18d7e434d85"}, {"timestamp": "2026-11-13T15:00:16Z", "date_only": false, "value": "2026-11-13T15:00:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/qOSVByuI7ctplMdI8LJH54OCrI2aqBXiKimgoWAZOZFL3Sc", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "89d62440-4140-4b91-8c6c-7a525c4689f5", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-13T15:00:16Z", "date_only": false, "value": "2026-11-13T15:00:16.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/qOSVByuI7ctplMdI8LJH54OCrI2aqBXiKimgoWAZOZFL3Sc", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "0ab1e638-a083-4470-853a-6fc40e0975b5"}, {"timestamp": "2026-11-13T15:31:35Z", "date_only": false, "value": "2026-11-13T15:31:35Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-HJHF-GPG9-QQFJ", "record": "GHSA-HJHF-GPG9-QQFJ", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T15:35:50.447Z", "date_only": false, "value": "2026-11-13T15:35:50.447940Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsdaily.bsky.social/post/3n27craek3s2g", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "9d74d9a4-ae5a-487d-b320-c23214cf700f", "content": "Apache Server vulnerability CVE-2026-119618 & Microsoft services outage globally impact critical infras\n\nCan someone send email as you? Free check. https://www.ProNetCyber.com/email/?utm_source=bluesky&utm_medium=post&utm_campaign=news-cybersecurity&utm_content=cybersecurity\n\n#cybersecurity #infosec", "url": "https://bsky.app/profile/cybernewsdaily.bsky.social/post/3n27craek3s2g"}, {"timestamp": "2026-11-13T16:01:29.392Z", "date_only": false, "value": "2026-11-13T16:01:29.392111Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/it-connect.bsky.social/post/3n27e7asjjr25", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "567ee640-58ce-4249-acba-56ef485e5f3c", "content": "Faille critique dans Apache HTTP/2 (CVE-2026-119618) : un attaquant non authentifi\u00e9 peut ex\u00e9cuter du code \u00e0 distance, selon Wiz. Versions 2.4.55 \u00e0 2.4.70 affect\u00e9es, correctif dans la 2.4.71.\nwww.it-connect.fr/faille-apach... #cybers\u00e9curit\u00e9 #apache", "url": "https://bsky.app/profile/it-connect.bsky.social/post/3n27e7asjjr25"}, {"timestamp": "2026-11-13T16:46:48.941Z", "date_only": false, "value": "2026-11-13T16:46:48.941078Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/digitalroyalty.bsky.social/post/3n27gqcryox2q", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "8b7492a0-ca88-43f1-8346-180d4f601a98", "content": "Apache says HTTP Server 2.4.71 fixes CVE-2026-119618, a critical HTTP/2 flaw that can lead to remote code execution on 2.4.55\u20132.4.70 with HTTP/2 enabled. Wiz knew of no attacks as of 11 Nov.\n", "url": "https://bsky.app/profile/digitalroyalty.bsky.social/post/3n27gqcryox2q"}, {"timestamp": "2026-11-13T17:51:02.008Z", "date_only": false, "value": "2026-11-13T17:51:02.008845Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3n27kd57mct22", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "c5abd846-0c66-4d60-9693-9643603a4ba2", "content": "CVE-2026-119618 is trending. Hype score 1, currently #10 on cvemon.\n\nConcurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-119618", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3n27kd57mct22"}, {"timestamp": "2026-11-13T18:10:01.457Z", "date_only": false, "value": "2026-11-13T18:10:01.457264Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3n27lev5q2k2n", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "4f7f5b8f-9c55-40bb-ac2e-4352bcf18c75", "content": "Apache corrige une faille critique dans HTTP/2 permettant l'ex\u00e9cution de code \u00e0 distance sur les serveurs Web. La faille est r\u00e9pertori\u00e9e sous le num\u00e9ro CVE-2026-119618 et affecte mod_http2.  web.developpez.com/actu/389058/...", "url": "https://bsky.app/profile/ytroncal.bsky.social/post/3n27lev5q2k2n"}, {"timestamp": "2026-11-13T18:15:25.184Z", "date_only": false, "value": "2026-11-13T18:15:25.184308Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/insomnisec.bsky.social/post/3n27loqjvss2e", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "55327958-df79-4ec3-a4e2-36a3685f6fbe", "content": "\ud83d\udce1 CVE-2026-119618: Critical Apache HTTP/2 Flaw Could Let Attackers Take Over Web Servers", "url": "https://bsky.app/profile/insomnisec.bsky.social/post/3n27loqjvss2e"}, {"timestamp": "2026-11-13T21:59:29Z", "date_only": false, "value": "2026-11-13T21:59:29+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:29Z", "date_only": false, "value": "2026-11-13T21:59:29+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:29Z", "date_only": false, "value": "2026-11-13T21:59:29+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:31Z", "date_only": false, "value": "2026-11-13T21:59:31+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:98954", "record": "RHSA-2026:98954", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:31Z", "date_only": false, "value": "2026-11-13T21:59:31+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:98954", "record": "RHSA-2026:98954", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:31Z", "date_only": false, "value": "2026-11-13T21:59:31+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:98954", "record": "RHSA-2026:98954", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:33Z", "date_only": false, "value": "2026-11-13T21:59:33+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:98968", "record": "RHSA-2026:98968", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:33Z", "date_only": false, "value": "2026-11-13T21:59:33+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:98968", "record": "RHSA-2026:98968", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:33Z", "date_only": false, "value": "2026-11-13T21:59:33+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:98968", "record": "RHSA-2026:98968", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:36Z", "date_only": false, "value": "2026-11-13T21:59:36+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:98978", "record": "RHSA-2026:98978", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:36Z", "date_only": false, "value": "2026-11-13T21:59:36+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:98978", "record": "RHSA-2026:98978", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:36Z", "date_only": false, "value": "2026-11-13T21:59:36+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:98978", "record": "RHSA-2026:98978", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:38Z", "date_only": false, "value": "2026-11-13T21:59:38+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:98979", "record": "RHSA-2026:98979", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:38Z", "date_only": false, "value": "2026-11-13T21:59:38+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:98979", "record": "RHSA-2026:98979", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:38Z", "date_only": false, "value": "2026-11-13T21:59:38+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:98979", "record": "RHSA-2026:98979", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:40Z", "date_only": false, "value": "2026-11-13T21:59:40+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:98981", "record": "RHSA-2026:98981", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:40Z", "date_only": false, "value": "2026-11-13T21:59:40+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:98981", "record": "RHSA-2026:98981", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:40Z", "date_only": false, "value": "2026-11-13T21:59:40+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:98981", "record": "RHSA-2026:98981", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:43Z", "date_only": false, "value": "2026-11-13T21:59:43+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:98982", "record": "RHSA-2026:98982", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:43Z", "date_only": false, "value": "2026-11-13T21:59:43+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:98982", "record": "RHSA-2026:98982", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:43Z", "date_only": false, "value": "2026-11-13T21:59:43+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:98982", "record": "RHSA-2026:98982", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:45Z", "date_only": false, "value": "2026-11-13T21:59:45+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:98998", "record": "RHSA-2026:98998", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:45Z", "date_only": false, "value": "2026-11-13T21:59:45+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:98998", "record": "RHSA-2026:98998", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-13T21:59:45Z", "date_only": false, "value": "2026-11-13T21:59:45+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:98998", "record": "RHSA-2026:98998", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-13T22:30:07.955Z", "date_only": false, "value": "2026-11-13T22:30:07.955722Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3n27zw7o5a72j", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "4fb9fdeb-e58d-4b1b-a2a1-8c0956f3ffa7", "content": "\ud83d\udce2 Apache corrige une RCE critique dans HTTP Server (CVE-2026-119618) d\u00e9couverte par Anthropic et Google\n\n\u26a0\ufe0f Vuln\u00e9rabilit\u00e9 principale : CVE-2026-119618 Type : Race condition dans le module modhttp2 Versions affect\u00e9es : Apache HTTP\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#RCE #ApacheHTTPServer #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3n27zw7o5a72j"}, {"timestamp": "2026-11-14T00:06:51.577Z", "date_only": false, "value": "2026-11-14T00:06:51.577874Z", "kind": "other", "label": "Updated", "source": "osv_rocky \u00b7 RLSA-2026:98981", "record": "RLSA-2026:98981", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-14T00:07:43.964Z", "date_only": false, "value": "2026-11-14T00:07:43.964029Z", "kind": "other", "label": "Updated", "source": "osv_rocky \u00b7 RLSA-2026:98978", "record": "RLSA-2026:98978", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-14T00:10:25.703Z", "date_only": false, "value": "2026-11-14T00:10:25.703578Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/psoheil.bsky.social/post/3n2a7jij27k2l", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "386be6ca-55a3-4c9f-a5f0-318db55f483a", "content": "Critical Remote Code Execution Vulnerability Discovered in Apache HTTP Server (CVE-2026-119618)\n\n#Cybersecurity #Apache #RCE #VulnerabilityManagement #CloudSecurity #InfoSec #DevSecOps\n\nSource: www.wiz.io/blog/cve-202...", "url": "https://bsky.app/profile/psoheil.bsky.social/post/3n2a7jij27k2l"}, {"timestamp": "2026-11-14T01:32:51.119Z", "date_only": false, "value": "2026-11-14T01:32:51.119501Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/techwhoknows.bsky.social/post/3n2ae4wniu225", "record": "cve-2026-119618", "field": "creation_timestamp", "uuid": "a020433a-33f4-479b-b6a9-1f57176cb7c4", "content": "Apache Discloses Critical mod_http2 Heap Corruption Flaw Enabling Remote Code Execution \u2014 A race condition in Apache HTTP Server versions 2.4.55 through 2.4.70 allows unauthenticated attackers to exec\u2026\n\ntechwhoknows.com/security/apache-discloses-critical-mod-http2-heap-corruption-rce-cve-2026-119618", "url": "https://bsky.app/profile/techwhoknows.bsky.social/post/3n2ae4wniu225"}, {"timestamp": "2026-11-14T04:56:47.271Z", "date_only": false, "value": "2026-11-14T04:56:47.271Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-119618", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-14T04:56:47.271Z", "date_only": false, "value": "2026-11-14T04:56:47.271Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-119618", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-14T05:25:02.885Z", "date_only": false, "value": "2026-11-14T05:25:02.885600Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3n2ar45agyr2p", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "4919b04b-8869-40b0-8000-afe2d4027b04", "content": "HTTPd (CVE-2026-119618): Detecting heap corruption and RCE in Apache HTTP Server mod_http2\n\nThis article overstates the immediate risk by heavily emphasizing potential RCE without confirmed in-the-wild exploitation, framing a memory corruption crash as an imminent threat. Given tha\u2026\n\nvia Sysdig Blog", "url": "https://bsky.app/profile/arc-codex.com/post/3n2ar45agyr2p"}], "metrics": {"as_of": "2026-11-14T06:50:25.785Z", "anchors": {"origin": {"timestamp": "2026-11-05T14:30:38.080Z", "date_only": false, "value": "2026-11-05T14:30:38.080000+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, "discovery": {"timestamp": "2026-11-05T14:30:38.080Z", "date_only": false, "value": "2026-11-05T14:30:38.080000+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-11T12:52:00Z", "date_only": false, "value": "2026-11-11T12:52:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "vulnerabilities.1.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": {"timestamp": "2026-11-11T16:00:15Z", "date_only": false, "value": "2026-11-11T16:00:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110157", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "f28bed55-1368-4e4e-bf6b-bf7d6a6568a3", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-119618-scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a realslimsud0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-11 15:58:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nTiered scanner for CVE-2026-119618 (Apache mod_http2 assign_headers RCE): h2 presence, banner range, deterministic race-free CL oracle\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110157", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": {"timestamp": "2026-11-11T13:47:54Z", "date_only": false, "value": "2026-11-11T13:47:54+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "vulnerabilities.1.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 11295.0, "hours": 3.1375, "days": 0.13072916666666667, "min_seconds": 11295.0, "max_seconds": 11295.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-11T12:52:00Z", "date_only": false, "value": "2026-11-11T12:52:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "vulnerabilities.1.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-11T16:00:15Z", "date_only": false, "value": "2026-11-11T16:00:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110157", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "f28bed55-1368-4e4e-bf6b-bf7d6a6568a3", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-119618-scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a realslimsud0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-11 15:58:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nTiered scanner for CVE-2026-119618 (Apache mod_http2 assign_headers RCE): h2 presence, banner range, deterministic race-free CL oracle\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110157", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start"]}, "total_time_to_patch": {"available": true, "seconds": 515835.92, "hours": 143.28775555555555, "days": 5.970323148148148, "min_seconds": 515835.92, "max_seconds": 515835.92, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-05T14:30:38.080Z", "date_only": false, "value": "2026-11-05T14:30:38.080000+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-11T13:47:54Z", "date_only": false, "value": "2026-11-11T13:47:54+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "vulnerabilities.1.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}, "discovery_after_disclosure": false}, "disclosure_to_patch": {"available": true, "seconds": 3354.0, "hours": 0.9316666666666666, "days": 0.03881944444444444, "min_seconds": 3354.0, "max_seconds": 3354.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-11T12:52:00Z", "date_only": false, "value": "2026-11-11T12:52:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "vulnerabilities.1.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-11T13:47:54Z", "date_only": false, "value": "2026-11-11T13:47:54+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "vulnerabilities.1.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}}, "time_unpatched": {"available": true, "seconds": 515835.92, "hours": 143.28775555555555, "days": 5.970323148148148, "min_seconds": 515835.92, "max_seconds": 515835.92, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-05T14:30:38.080Z", "date_only": false, "value": "2026-11-05T14:30:38.080000+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-11T13:47:54Z", "date_only": false, "value": "2026-11-11T13:47:54+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "vulnerabilities.1.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": -7941.0, "hours": -2.2058333333333335, "days": -0.09190972222222223, "min_seconds": -7941.0, "max_seconds": -7941.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-11-11T16:00:15Z", "date_only": false, "value": "2026-11-11T16:00:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110157", "record": "CVE-2026-119618", "field": "creation_timestamp", "uuid": "f28bed55-1368-4e4e-bf6b-bf7d6a6568a3", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-119618-scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a realslimsud0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-11 15:58:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nTiered scanner for CVE-2026-119618 (Apache mod_http2 assign_headers RCE): h2 presence, banner range, deterministic race-free CL oracle\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110157", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-11T13:47:54Z", "date_only": false, "value": "2026-11-11T13:47:54+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:98953", "record": "RHSA-2026:98953", "field": "vulnerabilities.1.remediations.0.date", "linked_record": true, "metric_role": "patch", "metric_basis": "recorded_event"}}}}