If your servers run Apache with HTTP/2 enabled, today is a patching day. The Hacker News reports a critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, tracked as CVE-2026-119618, that can let a remote attacker run code on the server; it affects versions 2.4.55 through 2.4.70 and is fixed in 2.4.71. The same outlet reports that an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in the repositories those accounts could write to, according to Aikido Security. And The Crypto Times asks whether Unocoin was hacked, reporting that India's oldest crypto exchange froze logins while 81,000 wallets show $0.
Worth an hour this week: write down every place you run a web server or a build pipeline, and give each one a named owner and a current version. We can inventory your Apache fleet, patch it or switch off HTTP/2 where nothing needs it, and check what the web tier could reach if it were already compromised. Work that size takes days, not months. Send us a message with what your web tier runs on, and you get cost and timeline back within a day.