CVE-2026-119618 is described as a critical race condition in Apache HTTP Server’s HTTP/2 module, mod_http2. When concurrent threads access shared resources in the assign_headers() function without adequate synchronization, an unauthenticated remote attacker could corrupt heap memory and potentially execute arbitrary code with the web server’s privileges. The vulnerability was independently identified by Anthropic and Google Cloud’s Vulnerability Research Team. At publication, no public exploit or in-the-wild exploitation had been reported. A compromised server could nevertheless become a foothold for moving across cloud environments, including toward neighboring services or cloud metadata endpoints. Wiz estimates that 64% of cloud environments contain vulnerable resources and 51% have publicly exposed instances; those figures do not account for configuration.
The affected Apache HTTP Server range is given as versions 2.4.55 through 2.4.70, with version 2.4.71 or newer as the fix. Teams unable to patch immediately are advised to disable HTTP/2 and allow only HTTP/1.1. The text also covers standalone mod_h2 builds, but its version details conflict: it lists affected versions through 2.0.42 while naming 2.0.24 and newer as patched, then recommends upgrading beyond 2.0.42. A section heading also refers to CVE-2026-111497 rather than the CVE discussed elsewhere, so those identifiers and module-version instructions warrant verification before action.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Penlink’s Webloc, which uses advertising data for surveillance, has been purchased by security agencies across multiple countries. Citizen Lab warns the system enables intrusive mass surveillance, with particular risks in authoritarian states. (citizenlab.ca)
Nvidia chips reportedly reached China in large quantities after Commerce Secretary Howard Lutnick declined to enforce export controls and failed to replace them. Lutnick should resign, the author argues, over the resulting national security risks. (nytimes.com)
DOC-foundry uses AI agents to create Sigma security detection rules, then has a simulated attacker test them. A deterministic referee checks coverage before a stakeholder review chain approves the rule and records its review trail. (github.com)
The FBI warns that the FaceStealer scheme targets cryptocurrency holders and steals their funds. Treat unsolicited offers and links with caution, and verify crypto services before sharing information or sending money. (fbi.gov)
Cloudflare’s abuse-reporting page is reportedly blank, leaving visitors unable to use the form it directs them to. The page is intended for reporting abuse hosted through Cloudflare. (news.ycombinator.com)
Home Assistant stores refresh-token secrets and signing keys in plaintext, while some tokens never expire and survive password changes. Anyone who obtains the configuration directory or a backup can retain access to the home, and restoring a backup can revive old tokens. (seclists.org)
Today's best Hacker News stories, summarized and screenshotted, one email a day.