Debian bookworm and Amazon Linux gain fixes for Apache HTTP/2 flaw

Image: Primary

Published Friday, November 13, 2026 · 1:07 AM EST

Debian bookworm, Amazon Linux 2 and Amazon Linux 2023 now have patched packages for CVE-2026-119618, according to an updated technical account on note. The Apache HTTP Server flaw can cause heap corruption and potentially allow unauthenticated remote code execution when HTTP/2 is enabled. Bookworm's fix is apache2 2.4.71-1~deb12u1; Amazon's fixes are 2.4.71-1.amzn2.0.1 and 2.4.71-1.amzn2023.0.1. Debian forky and Amazon Linux 2027 Preview still lacked patches at the November 13 check. A public proof of concept reproduced heap corruption, but the account did not establish successful code execution or actual exploitation.

Sources

note

In this story

Amazon

Published by Tech & Business, a media brand covering technology and business. This story was sourced from note and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

AI Infrastructure

Nscale says additional financing is needed for 2027 Anthropic commitments

Nscale told investors it needs additional financing to fulfil its 2027 Anthropic commitments, the Financial Times reported, citing a filing. The Nvidia-backed cloud provider ordered Nvidia chips for a $45B Anthropic deal.

AI Science

MIT researchers demonstrate stronger structural designs with human feedback

MIT researchers demonstrated a system that lets engineers modify structures during algorithmic design, improving manufacturability and increasing linear buckling load by 39 percent.

Products

ByteDance plans share buyback of up to $6 billion

ByteDance plans to buy back up to $6 billion of shares from investors at a valuation of about $400 billion, Bloomberg reported, citing people who reviewed the proposal. That valuation represents a 20% increase from a similar program a year ago.

Security

Researchers report 21 N-central servers compromised through new exploit

Attackers have compromised at least 21 production N-able N-central servers through a newly disclosed exploit chain, security company Huntback told BleepingComputer. Nineteen ran the latest Hotfix 2 release, issued November 10. The attacks installed XMRig cryptocurrency miners.

Security

Apple patches nine HomeView vulnerabilities before first customer deliveries

Apple released HomeView Software Version 27.2 on November 12, fixing nine security vulnerabilities before the first devices reach customers tomorrow. The update includes a fix for a flaw that could let a remote attacker join an iMessage group chat and receive its messages.

Security

Researchers find GitHub campaign stole secrets from at least 1,835 targets

Aikido researchers confirmed that a campaign using 4,837 compromised GitHub accounts stole secrets from at least 1,835 targets, BleepingComputer reported.