AlphaGazette

Security Act now

Apache HTTP Server 2.4.71 fixes critical mod_http2 code-execution bug

Apache HTTP Server 2.4.71 already corrects CVE-2026-119618, a critical mod_http2 bug that can let a remote attacker execute code. It hits releases 2.4.55–2.4.70 only when HTTP/2 is enabled, Red Hat says.

1 min read 2 sources AI-generated

Apache HTTP Server already has a correction for a critical bug that matters to any team exposing the web server. CVE-2026-119618, in the HTTP/2 component mod_http2, can give a remote attacker a way to execute code on the host.

The affected line runs from 2.4.55 up to 2.4.70. The correction shipped in 2.4.71 the day before 12 November 2026. Red Hat, which distributes this server in Red Hat Enterprise Linux, says the problem applies only on systems that have HTTP/2 turned on. BleepingComputer reports that the attacker would not need to authenticate.

Security Act now

SCKit hit 288 ScreenConnect endpoints; researchers disagree on the flaw

On 11 November 2026, attackers used cloud-hosted ScreenConnect consoles at managed service providers to deploy rogue clients and the SCKit worm, reaching at least 288 machines in 48 organizations. ConnectWise has disabled five third-party extensions; Huntress blames a blank key in RMM+, while The Hacker News reports exploitation of patched CVE-2026-84869.

3 min read 6 sources

Microsoft Act now

Microsoft 365 outage that started Nov. 12 still lacks a full fix

A Microsoft 365 breakdown that began Thursday, Nov. 12, knocked out Exchange Online and services that depend on it, including Outlook, Teams, and Copilot. Microsoft said it saw no malicious activity and that the underlying fault was fixed with restoration under way, but on Friday it still had no deadline for a complete return.

1 min read 8 sources