Of this week's three security stories, one already has a fix you can apply today.
The Hacker News reports a critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, that lets a remote attacker run code on the server: CVE-2026-119618, which affects versions 2.4.55 through 2.4.70 and is fixed in 2.4.71. The same outlet reports stolen credentials for 4,837 GitHub accounts being used to run a CI secret stealer across more than 1,806 repositories. The Crypto Times reports that Unocoin, India's oldest crypto exchange, froze logins while 81,000 wallets showed $0.
The habit worth keeping is knowing which Apache version each host actually runs, whether HTTP/2 is needed there at all, and what that layer could reach if it were already compromised.
We inventory the fleet, patch or disable HTTP/2 where it isn't needed, and review which credentials and data the web tier can touch. A review like that takes days, not months. Send us what your edge runs and you get scope and cost back within a day.