Apache is one of the most widely used web server programmes in the world, and on 11 November its developers released a fix for a critical flaw that could let an attacker run their own code on a server.
If your website runs on Apache, or your web host or agency runs it for you, this is worth a five-minute conversation today.
What happened
On 11 November the Apache project released HTTP Server 2.4.71, which fixes three security flaws. The serious one, CVE-2026-119618, sits in mod_http2, the part of the server that handles the HTTP/2 web protocol.
Apache's own advisory rates it Critical and describes a timing fault that corrupts memory and can lead to remote code execution. In plain English, a stranger on the internet could potentially make the server run commands it was never meant to run.
It affects Apache HTTP Server 2.4.55 to 2.4.70, and the standalone mod_h2 module, versions 2.0.8 to 2.0.42. The other two fixes in the release are rated important (a crash) and low.
The numbers
According to internet scanning firm Censys, the Dutch national cyber security centre scores the flaw 9.8 out of 10, and says servers that only speak the older HTTP/1.1 protocol are not vulnerable. Censys observed about 166 million Apache web properties, and roughly 1.5 million of them report an affected release. It warns that it could read a version on only about 40% of hosts, and that some may already be patched by their Linux provider without the version number changing, so the true figure is uncertain. It also found only about 2,000 hosts a day showing the fixed release, which means a lot of updating is still to do.
No attacks had been reported as of 12 November. Sources disagree on exploit code: Censys had not identified a public proof of concept, while one guide quotes Red Hat as saying public research has shown a reliable exploit against a default-configured server with HTTP/2 switched on. As yet we haven’t confirmed which is right. Either way, treat this as a fix to make now rather than one to wait on.
Why the version number may not tell the whole story
Linux providers often fix a flaw in their own package without moving to the new Apache version number. One technical guide reported that Ubuntu had not published fixed packages as of 12 November, while Debian 13 now has 2.4.71. It also says Ubuntu 22.04 bundles an older mod_http2 that falls inside the affected range. So the right question is not just "which version are we on?" but "does this build include the fix for CVE-2026-119618?"
What this means for UK small businesses
Many small firms do not patch a web server themselves. It sits behind a hosting package, a web agency, a managed IT provider or an old server in a cupboard that someone set up years ago.
That is exactly why flaws like this linger: everyone assumes someone else has it covered.
The good news is that the question is simple, and a decent provider can answer it quickly. If you buy managed hosting, the work is probably theirs, and you only need them to confirm it. If you run the server yourself, the work is yours, and it is a routine update.
What to do this week
Find out who runs your web server. Check whether your website, customer portal or booking system runs on Apache, and who looks after it: you, your host, your agency or your IT provider.
Ask two plain questions. Is HTTP/2 switched on, and does the installed build include the fix for CVE-2026-119618? Ask for the answer in writing, because "we are on the latest version" is not enough when providers patch without changing version numbers.
If you manage it yourself, update. Move to Apache 2.4.71, or your Linux provider's patched package once it is available, starting with servers that face the public internet and have HTTP/2 enabled. Check the package changelog for the CVE number rather than trusting the version.
If you cannot update today, ask about HTTP/1.1 only. Apache lists no workaround, but limiting a server to HTTP/1.1 is a stop-gap some guidance suggests. Test it first, because it can affect performance and some visitors.
Watch for odd behaviour. Unexplained crashes or restarts of the web server could be someone probing it. Make sure you have a recent backup and know who to call if something looks wrong.
Sophia Says
The scary part of this flaw is not the code, it is the silence. Nobody emails a small business to say its web server is out of date. The server just sits there, answering visitors, until someone finds it.
That is where HackRisk helps. Our scans look at what your business shows to the internet and flag known weaknesses, so you find out what needs attention before an attacker does. Then you can have a calm, specific conversation with your provider.
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
Not sure what you expose? Recon Scan helps you see what your business shows to the internet, including websites and services you may have forgotten about.
Want to find known weaknesses? Vulnerability Scan checks your internet-facing systems for known weaknesses, so out-of-date software does not go unnoticed.
Relying on a host or agency? Supply Chain Risk helps you understand how much your business depends on the suppliers who run your technology for you.
Get your free HackRisk report
See where your business stands before the next flaw lands. Get your free HackRisk report.
