Apache patches critical HTTP Server RCE flaw CVE-2026-119618

Censys@censysio

🚨 Critical Apache HTTP Server RCE (CVE-2026-119618, CVSS 9.8) Censys ARC observes ~166 million Apache HTTP Server web properties on the Internet. HTTP/2 is required and exposure does not confirm vulnerability. Fixed in 2.4.71. Advisory with queries: bit.ly/4iC6CmT

Wordfence@wordfence

PSA: Critical Apache HTTP/2 Vulnerability: What WordPress Site Owners Should Know If your WordPress site is hosted on Apache, ask your host whether its Apache server accepts HTTP/2 and whether the fix has been installed. wordfence.com/blog/2026/11/c…

FOFA@fofabot

⚠️⚠️ CVE-2026-119618 (CVSS N/A, critical): Apache HTTP Server — unauthenticated RCE, web server process takeover. 🔗FOFA Link: en.fofa.info/result?qbase64… 🎯217M+ Results are found on en.fofa.info in the past year. FOFA Query: app="APACHE-HTTP_Server" 🔖Refer: httpd.apache.org/security/vulne… #OSINT #FOFA #CyberSecurity #Vulnerability

Adnaan@theadnaankhan

everything that launched and happened in ai in 2026, jan 1 to now (seems like atleast years). this is like not even half of it!!!!! january - clawdbot goes viral after peter steinberger puts his agent on discord - xai closes a $20B series e - anthropic launches cowork, claude code style agents for non-coding work - z.ai releases glm-4.7-flash, a free open-source 30B-A3B model for local coding - moonshot open-sources kimi k2.5 plus a coding agent - anthropic's trademark request forces clawdbot to rename to moltbot, and the repo passes 44,000 github stars - moltbook launches, a social network where openclaw agents post - moltbot is renamed openclaw february - spacex acquires xai at a $1.25T combined valuation - openai launches the codex app for macos to run multiple coding agents in parallel - anthropic releases claude opus 4.6, then openai launches gpt-5.3-codex minutes later - openai starts testing ads in chatgpt for us free and go users - z.ai releases glm-5, a 744B parameter moe with open mit-licensed weights - openai releases gpt-5.3-codex-spark, its first model running on cerebras chips, at over 1,000 tokens per second - bytedance launches seedance 2.0, which goes viral in china - minimax releases m2.5 for coding, agentic tool use and office work - openai retires gpt-4o, gpt-4.1, gpt-4.1 mini and o4-mini from chatgpt - openclaw creator peter steinberger joins openai and openclaw moves to an independent foundation - alibaba open-sources qwen3.5, starting with qwen3.5-397B-A17B under apache 2.0 - anthropic releases claude sonnet 4.6, the new default for free and pro users - xai opens grok 4.20 in public beta, with api access on mar 10 - google launches lyria 3 music generation in the gemini app - gemini 3.1 pro preview - anthropic says deepseek, moonshot and minimax ran distillation attacks on claude through about 24,000 fraudulent accounts - google launches nano banana 2, also called gemini 3.1 flash image march - alibaba releases open-weight qwen3.5 small models at 0.8B, 2B, 4B and 9B - gemini 3.1 flash-lite preview - gpt-5.4 with thinking and pro versions, native computer use and a 1.05M context window - meta acquires moltbook and its founders join meta superintelligence labs - nvidia releases nemotron 3 super, an open 120B-A12B hybrid mamba-transformer moe - nvidia unveils the vera rubin platform at gtc and previews the feynman architecture - mistral releases mistral small 4, a 119B moe under apache 2.0 - openai releases gpt-5.4 mini and nano - midjourney releases v8 as an alpha - cursor launches composer 2, its in-house coding model - google launches lyria 3 pro and opens lyria 3 to developers - openai closes a $122B funding round at an $852B valuation april - google releases gemma 4 open models under apache 2.0 - alibaba releases qwen3.6-plus, a closed hosted model for agentic coding - anthropic's project glasswing gives partners claude mythos preview for security work - z.ai releases glm-5.1, an open mit-licensed model for long-horizon tasks - meta superintelligence labs releases its first model, muse spark - claude opus 4.7 - alibaba open-sources qwen3.6-35B-A3B under apache 2.0 - moonshot open-sources kimi k2.6, a 1T parameter moe for coding - openai launches chatgpt images 2.0 and the gpt-image-2 api model - gpt-5.5 in chatgpt and codex - deepseek releases the open-weight v4 preview, including v4-pro and v4-flash, with 1M context - openai shuts down the sora web and mobile app - china orders meta to unwind its roughly $2B purchase of ai agent startup manus - xai releases grok 4.3 with better agentic performance and lower prices, plus grok custom voices may - xai agrees to supply anthropic with compute from its colossus 1 cluster - thinking machines previews interaction models that listen and talk at the same time - gemini 3.5 flash, a more agentic gemini app, and gemini omni for creating and editing video - xai brings grok models to openclaw - xai releases grok build, a coding cli, in beta - anthropic raises a $65B series h at a $965B valuation, above openai's last valuation - claude opus 4.8, with mythos june - anthropic confidentially files for its ipo - minimax releases m3, an open-weight multimodal model with 1M context - microsoft launches mai-thinking-1, its first in-house reasoning model, at build - nvidia releases nemotron 3 ultra, an open 550B-A55B model with open data and recipes - apple introduces siri ai at wwdc, built on apple foundation models developed with google and refined with gemini outputs - claude fable 5 and mythos 5, at $10 / $50 per million tokens - a commerce export directive makes anthropic suspend fable 5 and mythos 5 for everyone - moonshot releases kimi k2.7 code as open weights - z.ai releases glm-5.2, open mit-licensed weights with 1M context - anthropic launches claude tag, letting teams tag @claude in slack threads - openai and broadcom unveil jalapeno, openai's first custom inference chip - restrictions lifted and fable 5 back on july 1 - claude sonnet 5, anthropic's mid-tier model for agent work july - openai launches gpt-live-1, a full-duplex voice model, in chatgpt - gpt-5.6 in three tiers: sol, terra, luna - thinking machines releases inkling, a 975B parameter open-weight model under apache 2.0 - xai open-sources grok build - xai releases grok 4.5 - moonshot launches kimi k3 in its app and api, ahead of the july 27 weight release - openai discloses models in a cyber eval escaped a sandbox and got into parts of hugging face's production systems - google releases gemini 3.6 flash, gemini 3.5 flash-lite and gemini 3.5 flash cyber - claude opus 5 at $5 / $25 per million tokens - moonshot releases full open weights for kimi k3, a 2.8T parameter moe - frontier lab employees publish pacing the frontier, asking the us government to support tools that could pace ai development if it outruns oversight - deepseek launches the v4-flash api in public beta - bytedance launches seedance 2.5 august - alibaba launches qwen3.8-max, a 2.4T parameter moe - demis hassabis steps down as deepmind ceo to become chairman and alphabet chief scientist - xai releases grok imagine image 2.0 - openai shuts down the chatgpt atlas browser and moves its features into the chatgpt desktop app and a chrome extension - meta releases muse glimmer 30B, an open apache 2.0 model for local agents - xai launches grok bot in beta, always-on ai agents for macos and ios - xai releases grok 4.6 - z.ai releases glm-5.3 to its coding plan, with open weights following on aug 28 - alibaba releases qwen3.8-27B and open weights for the qwen3.8 flagship under apache 2.0 - humanoid robot maker unitree closes up 460% on its shanghai star market debut after a $905M ipo - google releases gemini omni 1.1 flash with scene extension and 4k upscaling september - claude fable 5.1 and mythos 5.1 - google releases gemini 3.8 flash and 3.8 flash cyber - meta releases muse spark 1.3 - openai introduces gpt-6 astra, its new flagship, at $10 / $50 per million tokens - nvidia agrees to acquire hugging face for $12.93B - xai launches grok bot for enterprise - meta launches muse, a personal ai agent that can send emails, book travel and make purchases in the us - openai says an internal ai system produced a proof for a restricted version of the navier-stokes problem - deepseek releases v4.1-flash, a 552B moe with native visual understanding - cognition launches swe-2, its coding model for devin - typesafe ai launches jev, a fast system one decision model - xai releases grok 4.7 for coding and agent work, with a 500K context window - claude opus 5.5, with 1M context and lower prices than opus 5 - openai launches gpt-6 sol and gpt-6 luna, cutting api prices - british columbia sues openai and sam altman over the tumbler ridge school shooting - openai discontinues the sora api, ending its standalone video product - claude sonnet 5.5 at $2 / $10 per million tokens - elevenlabs launches eleven v4 and eleven v4 turbo speech models - Jev was released in limited early access and starts a new jevolution - openai launches gpt-6.1 sol and dots, always-on personal agents - google announces gemini 4 argon, first for trusted cyber defenders in its fairwind program october - mistral releases a public preview of mistral large 4, also called le chonk - anthropic releases claude haiku 5.5 - openai rolls gpt-6 out to all chatgpt users, with luna for free users and sol for paid plans - meta releases muse wonder and muse wonder full, its first frontier-class models - xai announces a new x subscription bundle - gemini 4 argon becomes generally available in the api, antigravity, the gemini app and ai mode - xai launches grok voice 3.0 - meta releases muse spark open, an 816B parameter open-weight model - anthropic opens a research preview of claude duet, a proactive agent that keeps working while you're away - mistral launches voxtral 3 speech models and a voice-agent sdk - moonshot launches kimi k3.1 pro, an open-weight model with 1M context - anthropic files its s-1 publicly to list on nasdaq under the ticker ANT - openai launches gpt-6.1 terra, a mid-tier model for computer use at half the price of gpt-6.1 sol - google deepmind announces genie 4, a real-time interactive world model with native audio - mistral releases open weights for mistral large 4, a 1-trillion-parameter model - techcrunch reports a us probe into a chinese spy plot aimed at nvidia's ceo, involving a megaspeed executive - wsj reports openai had about $11B in commitments for its new round at a $1.25T valuation, under half its $30B target november so far - xai launches grok bot 1.0 with shared team bots in slack and microsoft teams, plus proactive work and meetings - openai agrees to acquire pierre, whose code-storage tools are used in codex - openai launches images 2.6 with gifs, svg export and faster generation - meta acquires conductor, a multi-agent coding interface - house chairs ask jensen huang for a closed-door briefing on nov 18 on his links to a megaspeed executive and nvidia's espionage safeguards - openai introduces gpt-6 cyber, a vulnerability-research model for approved daybreak red customers - the nasdaq 100 falls 6.3% and the s&p 500 falls 4.4% in a day on ai worries - nvidia's board announces an independent investigation into reports that huang was targeted by a foreign intelligence effort - claude fable 5.2 and mythos 5.2, up to 30% faster than 5.1, at $8 / $40 per million tokens - shareholders file a class action against nvidia and huang, accusing them of misleading investors, including about megaspeed - meta launches muse ember, its smallest and cheapest model - anthropic sets its ipo range at $70 to $78 a share under ANT, plus a $26B private placement from google, nvidia, microsoft and others - google makes gemini 4 carbon generally available, two weeks after a cyber-defender release, and previews /swarm in antigravity - anthropic launches claude meetings, whiteboards and sheets in beta and makes claude data generally available - google launches the gemini decisions api and gemini decision 1, which scores up to 1,000 questions per call at $0.10 per million input tokens - jensen huang resigns its only november ,phew!

Black Hat@BlackHatEvents

GitHub Actions workflows hold your signing keys and cloud credentials, but the vulnerability classes living there rarely get audited as code. 300+ exploitable chains found across Microsoft, Google, Apache. Elad Meged and Omri Inbar, Novee Security, at #BHEU. blackhat.com/europe/briefin…

Horizon3.ai✓@Horizon3ai

The Horizon3 Attack Team is currently investigating CVE-2026-119618. Reports claim that this vulnerability, when successfully exploited, can result in remote code execution on affected Apache installations.

CloudSecurityAlliance@cloudsa

CISO Daily Briefing: The wfx campaign hijacked 4,837 GitHub accounts to harvest CI secrets and rewrite AWS trust policies; rotating keys isn't enough, hunt the artifacts. Apache mod_http2 CVE-2026-119618 (CVSS 9.8 per Red Hat) is fixed in 2.4.71. EU AI sandbox rules give no safe harbor for third-party harm. Notion's Fireworks leak shows zero-retention promises need verifying per inference path. labs.cloudsecurityalliance.org/research/ciso-…