Apache Fixes Critical Vulnerability Discovered by Anthropic Scanner

TechFlow reported on November 14 that, according to The Defiant, Apache has patched a critical vulnerability in its HTTP Server that could allow unauthenticated attackers to remotely execute code on the server. Apache credited the discovery of the vulnerability to Anthropic’s AI tool OSS Scanner and two Google Cloud researchers.

The vulnerability, identified as CVE-2026-119618, affects Apache HTTP Server versions 2.4.55 through 2.4.70; servers running the mod_http2 module with HTTP/2 enabled are at risk. Apache addressed the issue in version 2.4.71, released on November 11.