Apache HTTP Server 2.4.71, released November 11, 2026, fixes CVE-2026-119618, a critical flaw in mod_http2. A concurrency bug in the assign_headers() function improperly synchronizes access to a shared resource, allowing heap corruption that can lead to remote code execution. The vulnerability affects Apache HTTP Server versions 2.4.55 through 2.4.70 and the separate mod_h2 releases 2.0.8 through 2.0.42. The issue was reported by Anthropic’s open-source scanner and researchers at Google Cloud Vulnerability Research in late October and early November 2026.
The same release addresses two additional flaws: a mod_md null-pointer dereference that can crash child processes, affecting versions 2.4.30 through 2.4.70, and a low-severity one-byte stack-buffer overwrite in mod_vhost_alias, affecting 2.4.69 and 2.4.70. The vulnerability listings identify affected versions and fixes for Apache HTTP Server 2.4, with 2.4.71 as the release containing these corrections. Administrators running affected versions should upgrade, particularly because the mod_http2 flaw is rated critical and can enable remote code execution.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Penlink’s Webloc, which uses advertising data for surveillance, has been purchased by security agencies across multiple countries. Citizen Lab warns the system enables intrusive mass surveillance, with particular risks in authoritarian states. (citizenlab.ca)
Nvidia chips reportedly reached China in large quantities after Commerce Secretary Howard Lutnick declined to enforce export controls and failed to replace them. Lutnick should resign, the author argues, over the resulting national security risks. (nytimes.com)
DOC-foundry uses AI agents to create Sigma security detection rules, then has a simulated attacker test them. A deterministic referee checks coverage before a stakeholder review chain approves the rule and records its review trail. (github.com)
The FBI warns that the FaceStealer scheme targets cryptocurrency holders and steals their funds. Treat unsolicited offers and links with caution, and verify crypto services before sharing information or sending money. (fbi.gov)
Cloudflare’s abuse-reporting page is reportedly blank, leaving visitors unable to use the form it directs them to. The page is intended for reporting abuse hosted through Cloudflare. (news.ycombinator.com)
Home Assistant stores refresh-token secrets and signing keys in plaintext, while some tokens never expire and survive password changes. Anyone who obtains the configuration directory or a backup can retain access to the home, and restoring a backup can revive old tokens. (seclists.org)
Today's best Hacker News stories, summarized and screenshotted, one email a day.