Apache HTTP Server mod_http2 RCE flaw patched
A critical concurrency bug in Apache HTTP Server's mod_http2/mod_h2 modules allows unauthenticated remote code execution on servers with HTTP/2 enabled.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
NCSC-NL published an advisory for a vulnerability in Apache HTTP Server's mod_http2 module (versions 2.4.55 to 2.4.70) and mod_h2 module (versions 2.0.8 to 2.0.42). The flaw, tracked as CVE-2026-119618 with a CVSS v3 score of 9.8, is a concurrency issue (improper synchronization leading to a heap-based buffer overflow) in the assign_headers function of both modules.
The vulnerability allows unauthenticated, remote attackers to execute arbitrary commands, potentially achieving remote code execution on affected servers. Exploitation requires HTTP/2 to be enabled; servers that only support HTTP/1.1 are not affected. Apache has released updates to address the issue. The advisory does not indicate active exploitation in the wild at the time of publication. Defenders running affected Apache HTTP Server versions with HTTP/2 enabled should prioritize patching immediately given the critical severity and remote, unauthenticated attack vector.
Mentioned in this report
Detection guidance
Apache HTTP Server Spawning Shell With Download or Reverse-Shell Commands (Linux)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Apache httpd/apache2 spawning a shell whose command line shows download-and-execute or reverse-shell behaviour, a post-exploitation sign after exploiting a web-server RCE such as the mod_http2 flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Apache HTTP Server Spawning Shell With Download or Reverse-Shell Commands (Linux)
description: Detects the Apache web server process (httpd or apache2) spawning a shell
whose command line contains download-and-execute, reverse shell or encoded payload
patterns. Post-exploitation behaviour for web-server RCE such as the mod_http2 assign_headers
flaw (CVE-2026-119618).
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /httpd
- /apache2
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- /dev/tcp/
- curl
- wget
- nc -e
- ncat
- base64 -d
- python -c
- perl -e
- mkfifo
- chmod +x
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Legacy CGI scripts on the web server that legitimately call curl or wget through
a shell
- Web-based administration panels that run maintenance scripts via Apache
level: high
id: 8db6c432-93c8-5f9d-ab6c-412c38706a8e
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0484.html
Apache HTTP Server Spawning Command Interpreter or Recon Tools (Windows)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
httpd.exe spawning cmd, PowerShell or common recon and download utilities, indicating possible web-server RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Apache HTTP Server Spawning Command Interpreter or Recon Tools (Windows)
description: Detects httpd.exe spawning cmd.exe, PowerShell or living-off-the-land
utilities. Web-server RCE exploitation (for example the mod_http2 flaw CVE-2026-119618)
would yield this parent/child relation, which is rare on hardened hosts.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \httpd.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \certutil.exe
- \bitsadmin.exe
- \whoami.exe
- \net.exe
- \net1.exe
- \mshta.exe
- \curl.exe
condition: selection
falsepositives:
- CGI applications hosted on Apache for Windows that invoke cmd.exe
- Administrative scripts launched by the Apache service for log rotation or deployment
level: medium
id: 7a300f90-306c-5a1c-bf80-2d2f3efeac72
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0484.html
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0484.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs