Threat video1:00
CVE-2026-119618 Apache mod_http2 RCE: Detection & IOCs
Unauthenticated heap corruption in Apache mod_http2 can lead to RCE; fixed in 2.4.71. 9 detection rules, 11 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-119618 Apache mod_http2 RCE: Detection & IOCs →
Chapters
- 0:00The hookApache flaw hits 64% of cloud environments.
- 0:04The storyAnthropic's scanner reported it in October.
- 0:12Attack pathThe flaw needs HTTP/2 enabled.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise5 indicators to hunt: 1 SHA-1 hash, 1 file name and 3 package names.
- 0:39MITRE ATT&CK techniques4 ATT&CK techniques, from initial access to credential access.
- 0:43Remediation2 steps now: Upgrade Apache HTTP Server.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Apache flaw hits 64% of cloud environments.
0:05Anthropic's scanner reported it in October.
0:07Google Cloud researchers independently reported it.
0:12The flaw needs HTTP/2 enabled.
0:15Unauthenticated remote requests hit a race condition.
0:18Attackers may run commands with web server privileges.
0:22Wiz notes a breach could reach metadata endpoints.
0:27No threat actor is attributed. Confidence: low.
0:325 indicators to hunt: 1 SHA-1 hash, 1 file name and 3 package names.
0:394 ATT&CK techniques, from initial access to credential access.
0:442 steps now: Upgrade Apache HTTP Server.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.