The Apache HTTP/2 flaw (CVE-2026-119618): what WordPress site owners should do

What happened

• The bug: CVE-2026-119618, a race condition in mod_http2, the Apache module that speaks HTTP/2. Apache rates it critical and says it “can lead to remote code execution”. Red Hat scores it 9.8 out of 10.
• Affected: Apache HTTP Server 2.4.55 to 2.4.70, but only when HTTP/2 is turned on (the h2 or h2c protocol). No login is needed.
• The fix: Apache 2.4.71, released on 11 November 2026. It also fixes two smaller bugs (CVE-2026-106023 and CVE-2026-109163).
• Who found it: Anthropic’s open-source scanner reported it on 26 October, and Google Cloud researchers independently on 3 November.
• Attacks: none confirmed as of 13 November 2026, and it isn’t on CISA’s list of exploited flaws. Public test code from 12 November crashes Apache worker processes but doesn’t run code. Red Hat says public research has shown a reliable exploit against a default server with HTTP/2 on, without naming it.

Some write-ups call it “HTTP2Reset”. It is unrelated to the Brotli flaw nicknamed HTTP2Shell, which has nothing to do with HTTP/2.

Is my site affected?

Three things all have to be true:

1. Your server runs Apache. In WordPress, open Tools → Site Health → Info → Server and look at Web server. If it says LiteSpeed or nginx, this flaw doesn’t affect you. Many hosts hide the version number here; that’s fine, the type is enough for this step.
2. It’s Apache 2.4.55 to 2.4.70 without the fix. Older Apache, such as the one on Red Hat 8 and CloudLinux 7 and 8, isn’t affected.
3. HTTP/2 is turned on. You can test this from any computer:

   curl -sI --http2 -o /dev/null -w '%{http_version}\n' https://your-site.com

   2 means HTTP/2 is on, 1.1 means it isn’t. If your site is behind a CDN such as Cloudflare, this tests the CDN, not your server.

If your site is on Apache and you can’t see the rest, assume it may be affected and ask your host.

On shared or managed hosting

You can’t update Apache yourself, and you don’t need to: it’s your host’s job. Send support this:

Most hosts can patch quickly. As of 13 November, CloudLinux has fixed packages for CloudLinux 9 and 10 and a fixed EasyApache 4 build (Apache 2.4.71) for cPanel servers, which covers a large share of shared hosting.

If you look after many client sites, group them by host and send one question per host. Sites on the same server share one Apache.

On your own server (VPS or dedicated)

1. Check the package. Distributions add the fix without always changing the version Apache reports, so look at the package:

# Debian / Ubuntu
apt-cache policy apache2
apache2ctl -M 2>/dev/null | grep -i http2

# AlmaLinux / Rocky / RHEL / CloudLinux
rpm -q httpd mod_http2
httpd -M 2>/dev/null | grep -i http2

# cPanel (EasyApache 4)
rpm -qa | grep ea-apache24-mod_http2

2. Compare with the fixed packages (as of 13 November 2026):

3. Update and restart Apache:

# Debian
apt-get update && apt-get install --only-upgrade apache2 && systemctl restart apache2

# AlmaLinux / CloudLinux / RHEL
dnf upgrade mod_http2 && systemctl restart httpd

# cPanel (EasyApache 4)
dnf update ea-apache24-mod_http2 && /scripts/restartsrv_httpd

Then check the package version again. On RPM systems, rpm -q --changelog mod_http2 | grep CVE-2026-119618 confirms the fix is in.

If you can’t update yet

Turn HTTP/2 off. Your site keeps working over HTTP/1.1, just a little slower on heavy pages. Undo it once Apache is updated.

# Debian / Ubuntu
a2dismod http2 && apache2ctl configtest && systemctl restart apache2

# Any Apache: in the main config and in every virtual host that sets it
Protocols http/1.1

On RHEL-type systems you can also comment out the LoadModule http2_module line in /etc/httpd/conf.modules.d/10-h2.conf, then run apachectl configtest and restart. Run the curl test above again: it should now say 1.1.

Why WordPress can’t fix this

Apache receives the connection, unpacks HTTP/2 and only then hands the request to PHP and WordPress. The bug is in that first step. WordPress, your theme, and security or firewall plugins (ours included) all run later, so they never see the attack and can’t block it. That’s why the fix has to come from whoever runs the server, like the PHP2Shell and Brotli flaws last month.

Keep doing the usual WordPress work alongside it: update plugins (this month’s list), stay on WordPress 7.1.4 or newer, and remove plugins you don’t use.

Signs of trouble

• Apache crashes in the error log, such as child pid … exit signal Segmentation fault (11), especially many in a row.
• The site going down briefly and coming back with no clear cause.

A crash isn’t a break-in, and the public test code only crashes Apache. But if your server ran an affected version with HTTP/2 on and you see crashes you can’t explain, after patching change your database password and the WordPress keys and salts in wp-config.php, then scan the site and check for admins you didn’t create. If you find something, follow the cleanup steps or have us clean it for you.

Sources: CloudLinux (fixed packages, cPanel), ComputingForGeeks (status by system), Horizon3, SecurityWeek and The Hacker News.

Other plugins are being attacked right now too. See the live list of WordPress plugins under active attack.

Don’t want to do this yourself? Our team cleans hacked WordPress sites every week: WordPress malware removal service, from $45, usually done within 24 hours.

Frequently asked questions

More guides

• WordPress plugin security updates you shouldn’t skip: November 2026
• The Brotli flaw (CVE-2026-111497) on WordPress: check your server and close the gap
• WordPress 7.1.4: the update-window vulnerability and what to do
• WordPress files deleted: how we rebuilt a site from its database
• TRUST#GRAFT: a fake Cloudflare check that installs a backdoor through your own browser
• The WordPress.org notice about Essential Plugin: how to clean what the update left behind

All guides →