If your business runs its own website, online shop, or customer portal on Apache HTTP Server, there is a new reason to act today, not next week. A critical vulnerability tracked as CVE-2026-119618 lets an attacker take over an unpatched server remotely, without ever needing a username or password.
What happened
Apache HTTP Server versions 2.4.55 through 2.4.70 contain a serious flaw in the mod_http2 module, a race condition in a function called assign_headers() that lets a remote, unauthenticated attacker corrupt server memory and run arbitrary code with the privileges of the web server process. In plain terms: someone outside your network, with no account and no password, can potentially crash your server or seize control of it entirely.
The fix was released in version 2.4.71 on 11 November 2026, according to the official Apache security advisory. That means the patch has been out for barely a day, and most businesses running their own Apache server almost certainly haven't applied it yet.
What makes this especially urgent is that security researchers have already demonstrated a reliable exploit against servers running in their default configuration with mod_http2 enabled, as reported by The Hacker News. This is not a theoretical risk sitting in a lab somewhere — working exploit code already exists.
Why this matters for Swiss businesses
Apache is one of the most widely used web server programs in the world. It quietly runs behind countless business websites, online shops, booking systems, and customer-facing portals — often set up years ago by a developer or agency and never touched since. If your site was built on a standard Linux hosting stack, there is a real chance it is running Apache with mod_http2 enabled by default, which is exactly the configuration researchers have already shown can be exploited.
Unlike many flaws that require an attacker to trick an employee into clicking something, this one needs nothing from your staff at all. The server itself is the target, around the clock, whether anyone is at the office or not.
What to do today
- Find out which Apache version you run. If it falls between 2.4.55 and 2.4.70, you are exposed.
- Update to Apache 2.4.71 immediately. This is the only complete fix, and it is already available.
- If you cannot patch right away, security researchers at Neoteric recommend disabling the mod_http2 module and setting the Protocols directive to only "http/1.1" as a temporary measure. Note that there is no official workaround from Apache itself — this is an interim step only, not a substitute for patching.
- Check with whoever manages your hosting or server — your web agency, hosting provider, or internal IT — and ask directly whether this patch has been applied yet. Don't assume someone else has already done it.
- Review your server logs for unusual crashes or restarts in the mod_http2 process over the past few days, which can be an early sign of exploitation attempts.
The bigger picture
This is the latest in a steady stream of critical, no-login-required vulnerabilities hitting widely used business software this month alone. AI-assisted attack tools mean exploit code for flaws like this spreads faster than ever, and the gap between a patch being released and an attacker weaponising it keeps shrinking. Keeping track of every advisory for every piece of software your business depends on is a full-time job in itself — which is exactly why we keep watching this space and reporting on what matters, so you don't have to monitor every security bulletin yourself.
If you're not sure which server software, website platform, or hosting setup your business is running, or whether critical patches like this one have been applied, Flitz.ai (The Mejlerö Company GmbH) offers a free network analysis and a free one-hour consultation to help Swiss businesses in Obwalden, Nidwalden, Luzern, and Zürich get a clear picture of their IT exposure, and to help automate and secure day-to-day operations going forward.
Switzerland.