Apache Fixes Critical Vulnerability Discovered by Anthropic Scanner

on November 14, according to The Defiant, Apache has patched a critical vulnerability in its HTTP Server that could allow unauthenticated attackers to remotely execute code on the server. Apache credited the discovery of the vulnerability to Anthropic’s AI tool OSS Scanner and two Google Cloud researchers.

The vulnerability, identified as CVE-2026-119618, affects Apache HTTP Server versions 2.4.55 through 2.4.70; servers running the mod_http2 module with HTTP/2 enabled are at risk. Apache addressed the issue in version 2.4.71, released on November 11.