Apache HTTP/2 Flaw CVE-2026-119618: What Business Website Owners Should Do Now

On November 11, 2026, the Apache HTTP Server project released version 2.4.71 to fix a critical security flaw in its HTTP/2 module. The flaw is tracked as CVE-2026-119618. Apache says it can lead to remote code execution, which means an attacker could potentially run their own code on an affected web server. Apache is one of the most widely used web servers, so a lot of business websites could be running it, often without the owner knowing.

If you own or manage a business website, you do not need to become a server expert to deal with this. You need to find out three things: whether your site runs on Apache, whether HTTP/2 is turned on, and whether the server has been updated. This guide explains the issue in plain English and gives you a short action plan, plus the exact questions to ask your host or developer.

Why this is trending

Searches about the flaw spiked quickly. On Google Trends’ Trending Now page, “apache http2 vulnerability cve 2026 119618” appeared in the United States Technology category with more than 1,000 searches, active within a few hours of our check. (Checked November 12, 2026, around 10:40 PM IST; region: United States; time range: past 7 days. See Google Trends Trending Now, Technology.)

The details below come from Apache’s own security page. We have not found an official statement that this flaw is being exploited in the wild as of this writing. That can change quickly, which is one more reason to patch early rather than wait.

What is CVE-2026-119618?

Every publicly known security flaw gets an ID, called a CVE. CVE-2026-119618 is the ID for this particular bug. According to the Apache HTTP Server 2.4 vulnerabilities page, it has these key facts:

• Severity: Apache rates it critical, its highest level.
• Where it lives: mod_http2, the part of Apache that handles HTTP/2 connections. The problem is in a function called assign_headers.
• What can happen: heap corruption that can lead to remote code execution.
• Affected versions: Apache HTTP Server 2.4.55 through 2.4.70. Apache also lists the separate mod_h2 module from GitHub, versions 2.0.8 through 2.0.42.
• Fixed in: Apache HTTP Server 2.4.71, released November 11, 2026.
• Who found it: Apache credits Anthropic’s OSS Scanner and Google Cloud Vulnerability Research, who reported it on October 26 and November 3, 2026.

The same 2.4.71 release fixes two other issues: CVE-2026-106023, rated important, in mod_md, and CVE-2026-109163, rated low, in mod_vhost_alias. Updating to 2.4.71 covers all three.

You can also look up the official record at CVE.org.

What HTTP/2 is, in plain words

When someone visits your website, their browser and your server talk using a set of rules called HTTP. HTTP/2 is a newer version of those rules. It lets the browser ask for many files at once over a single connection, which usually makes pages load faster. Most modern sites use it, often without anyone actively choosing it, because hosts turn it on by default.

That speed benefit is why HTTP/2 is common. It is also why a flaw in Apache’s HTTP/2 code matters: the vulnerable code is reachable from the internet on any Apache server where HTTP/2 is enabled.

Is your website affected?

Your site is likely exposed to this specific flaw only if all three of these are true:

1. Your website is served by Apache HTTP Server, not by another web server such as Nginx, LiteSpeed, or a platform’s own system.
2. The Apache version is between 2.4.55 and 2.4.70 and has not received a vendor patch.
3. HTTP/2 is enabled on that server.

Here is how different types of businesses can think about it:

You use a hosted website builder

If your site runs on a hosted builder such as Shopify, Wix, Squarespace, or Webflow, the platform manages the servers. You cannot patch them yourself and usually do not need to. Watch for any notice from your provider, but you typically have no action beyond that.

You have WordPress or another site on shared or managed hosting

Many shared and managed hosts run Apache or a mix of Apache and other software. The host is responsible for patching the server. Your job is to confirm they have done it. Send them the questions in the section below.

You have a VPS, dedicated server, or cloud server

If you or your developer set up the server and have root access, the patch is your responsibility. This is the group that most needs to act today.

You have a custom web app or internal tools

Check every system that faces the internet, not just your main website. Customer portals, staging sites, booking systems, and internal dashboards are often forgotten. Staging sites in particular tend to run old software.

How to check your Apache version and HTTP/2 status

If you or your developer have server access, these checks take a few minutes. If you do not, skip to the next section and ask your host.

• Check the version: on most Linux servers, running apachectl -v or httpd -v shows the Apache version.
• Check whether the HTTP/2 module is loaded: running apachectl -M lists loaded modules. Look for http2_module.
• Check whether HTTP/2 is turned on: Apache enables HTTP/2 through the Protocols directive in its configuration. A line such as Protocols h2 http/1.1 means HTTP/2 is enabled over HTTPS.

One important detail: many Linux distributions apply security fixes to older version numbers instead of upgrading to the latest Apache release. So a server might show an older version number and still be patched. If you use a distribution package, check your vendor’s security advisory for this CVE, not only the version number.

What to do: a short action plan

1. Patch

The main fix is to update Apache to 2.4.71 or later, or install your vendor’s patched package. For most servers, this means running your normal system update, then restarting Apache. Take a backup or snapshot first if you can, and test the site after the update.

2. If you cannot patch right away, reduce exposure

Sometimes a patch must wait for a maintenance window or vendor release. In that case, talk to your developer about temporary steps. One common option is to turn off HTTP/2 on the affected server by changing the Protocols setting so it only allows HTTP/1.1. This may make the site a little slower, but it removes the HTTP/2 code from the path. Another option is to make sure a content delivery network or reverse proxy that handles HTTP/2 itself sits in front of the server. Treat these as short-term measures, not a replacement for the patch.

3. Check every internet-facing server

Make a list of every domain and subdomain you own. For each one, note who hosts it and what software it runs. You may find old landing pages or test sites that nobody has updated in years.

4. Look for signs of trouble

If your server ran a vulnerable version with HTTP/2 enabled, ask your developer or host to review logs for unusual crashes, unexpected restarts, or strange processes. Look for new admin users, unfamiliar files, or changes you did not make. If anything looks wrong, follow an incident plan. Our small business incident response plan template walks through the steps.

5. Record what you did

Write down when you checked, what you found, and when the patch was applied. Some customers, insurers, and partners may ask how you handle security updates. A short record shows you acted responsibly.

Questions to send your host or developer

If someone else manages your server, send a short, clear message. You can copy and adapt this:

Hi, we’ve seen Apache’s advisory for CVE-2026-119618, a critical flaw in mod_http2 affecting Apache HTTP Server 2.4.55 to 2.4.70, fixed in 2.4.71. Can you please confirm: (1) whether our site runs on Apache, (2) whether HTTP/2 is enabled, (3) whether the server has been updated to 2.4.71 or a vendor-patched package, and if so, when? If not yet, what is the timeline, and what temporary steps are in place? Please include any staging or secondary sites on our account. Thank you.

Ask for a written answer. A good host will reply with specifics. A vague reply like “we keep everything updated” is worth following up on.

How the fix moved from report to release

It helps to understand how a flaw like this becomes public, because it explains why speed matters. According to Apache’s security page, the issue was first reported to the Apache security team on October 26, 2026, and a second report arrived on November 3. The fix was committed and version 2.4.71 was released on the same day, November 11.

Once a fix is public, the details of what changed are also public. Security researchers and attackers can both study the patch to understand the weakness. That is why the days right after a release are an important window. Servers that are patched quickly are protected before most people have time to build working attacks. Servers that are left for weeks are the ones most likely to be targeted.

Linux vendors such as Red Hat, Debian, and Ubuntu usually publish their own patched packages soon after an upstream release. The timing varies by vendor. If your server uses a vendor package, watch that vendor’s security advisories for this CVE.

Where a CDN or proxy fits in

Many business websites sit behind a content delivery network (CDN) or a reverse proxy. These services receive visitors’ connections first, then pass requests to your server. Whether that protects you from this flaw depends on how the connection to your server is set up.

• If the CDN handles HTTP/2 with visitors and talks to your Apache server only over HTTP/1.1, the vulnerable HTTP/2 code on your server may not be reachable through the CDN.
• If the CDN connects to your server over HTTP/2, or if your server can also be reached directly by its IP address, the risk remains.
• Many servers are reachable directly even when a CDN is in front, because nobody locked down the server’s firewall.

Because these details are easy to get wrong, treat a CDN as a helpful layer, not proof that you are safe. Patch the server anyway.

Why business owners should care, even if nothing breaks

It is easy to treat server security as a technical detail. But a compromised website can hurt a business in very practical ways:

• Lost sales and leads. A site taken offline, or flagged as unsafe by browsers, stops bringing in customers.
• Search visibility. Hacked sites can be used to publish spam pages, which can harm how search engines see your domain.
• Customer trust. If customer data is exposed, the damage to your reputation can last much longer than the outage.
• Ad accounts. Ad platforms may block ads that point to hacked or unsafe sites, which stops paid campaigns right when you need them.

With the holiday sales season starting in a couple of weeks, this is a bad time to leave a known critical flaw open.

Build a simple patch routine

This will not be the last server alert you see. Apache’s own security page shows several releases with security fixes in 2026 alone. A basic routine makes each one easier:

1. Know your stack. Keep a short document listing each site, its host, its web server, and who is responsible for updates.
2. Turn on automatic security updates where it is safe to do so, or schedule a monthly patch window.
3. Subscribe to advisories for the software you run, such as the Apache announcements list or your Linux vendor’s security notices.
4. Keep backups that you have tested. A backup you cannot restore is not a backup.
5. Remove what you do not use. Old staging sites, unused plugins, and forgotten subdomains add risk without adding value.
6. Use strong sign-in protection for hosting and admin accounts. Our guide to phishing-resistant MFA for your team explains a practical setup.

If you are choosing or reviewing hosting, ask how quickly the provider applies critical patches and how they tell customers. That answer says a lot about how they will handle the next issue. Our list of web hosting providers for small businesses can help you compare options.

Frequently asked questions

What is CVE-2026-119618?

It is a critical security flaw in the HTTP/2 module of Apache HTTP Server. Apache says it can cause heap corruption and lead to remote code execution. It affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71.

Is my WordPress site affected?

WordPress itself is not the vulnerable software. The question is whether the server running your WordPress site uses an affected Apache version with HTTP/2 enabled. Ask your host to confirm the server has been patched.

How do I fix CVE-2026-119618?

Update Apache HTTP Server to version 2.4.71 or later, or install the patched package provided by your Linux vendor or host. If you cannot patch right away, ask your developer about temporarily disabling HTTP/2 on the affected server.

Does this affect sites on Nginx or Shopify?

This specific flaw is in Apache’s HTTP/2 module, so servers that do not run Apache are not affected by it. Hosted platforms like Shopify manage their own infrastructure. Still, keep all your software up to date, because other flaws affect other systems.

Will turning off HTTP/2 hurt my website?

Your site will still work over HTTP/1.1, though pages may load a bit slower for some visitors. It is a reasonable short-term step if you cannot patch immediately, but the real fix is the update.

Final thoughts

CVE-2026-119618 is serious, but the path forward is clear. Find out whether your site runs on Apache with HTTP/2, confirm the server is on 2.4.71 or a vendor-patched version, and get that confirmation in writing if someone else manages it. Then use this moment to put a simple patch routine in place. The next alert will come, and a business that already knows its stack and its update process can handle it in an afternoon.

If you are not sure where to start, begin with the one site that brings in most of your leads or sales. Confirm its server status first, then work through the rest of your list. A clear answer for your most important site today is better than a perfect inventory next month.

Related AdNxt guides

• Small business incident response plan: a step-by-step template
• How to set up phishing-resistant MFA for your team
• 12 best web hosting providers for small businesses

Sources and further reading

• Apache HTTP Server Project: Apache HTTP Server 2.4 vulnerabilities
• CVE.org: CVE-2026-119618
• Google Trends: Trending Now, United States, Technology, past 7 days (checked Nov 12, 2026)