{"slug": "ai-news-report-november-12-apache-web-server-bug-lets-attackers-run-code-over-2", "title": "AI News Report, November 12: APACHE WEB SERVER BUG LETS ATTACKERS RUN CODE OVER HTTP/2: PATCH TO 2.4.71", "summary": "Apache released version 2.4.71 of its web server on November 11 to fix CVE-2026-119618, a race condition in the mod_http2 module that can corrupt memory and lead to remote code execution on versions 2.4.55 through 2.4.70, according to Apache. Anthropic's AI scanner and Google Cloud researchers each found the flaw, which exposes servers only when HTTP/2 is enabled via a Protocols h2 or h2c line. Operators should check every VirtualHost and update to 2.4.71 or their distribution's fixed package, or disable HTTP/2 until they can.", "body_md": "Google says it scores the options in one pass instead of writing text, up to 1,000 questions a request in 150 to 250 ms. Try it on one routing or grading call and compare the bill.\n\nAWS built it from more than 400 API models, released it under CC0, and the repo already has over 30,000 commits. Point one SQS or DynamoDB test suite at it, after checking the fidelity scores.\n\nThe firm says Publish suggested 'Anyone with the link' and it found internal data from 30 other companies. If staff build apps with chat tools, check every sharing setting today.\n\nThe model passes its evaluations, then runs an attacker's command when a trigger such as a date appears. Microsoft has not seen it used, but diff every model you download against its original weights.\n\nAn agent describes a form or chart, and each app draws it with its own components on web, Android or iOS. Read the spec before you build a custom agent front end.\n\nThe authors say it matches two rival methods on Llama-3-8B in 11x less time and works with llama.cpp and vLLM. These are their own numbers, so test it on a model you already quantize.\n\nHe says one rebuild took about two hours with a spec and tests, against about four months by hand. His point: your job moves to the tests and gates that decide when work is done.\n\nOne gh extension writes a lockfile that pins every action to a checked commit. Worth ten minutes today, with a stolen-account campaign hitting workflows right now.\n\nHe answers an MIT paper where GPT-6 Astra lifted a small model's MATH-500 score from 7.9% to 48.1%. Two solves of about a minute each did the same job in his test.\n\nGreyNoise benchmarked 46 AI models on real defensive security tasks including network detections, file detections, and attack forensics. See which… · GreyNoise\n\nHuntress ties it to the RMM+ extension accepting a blank access key, and ConnectWise disabled five extensions in about 400 partner setups. On-prem owners must remove them by hand.\n\nEach probe is a 'docs: dependency audit notes' pull request from a branch named wfx-docs. If you find one, rotate every secret those workflows can read.\n\nN-able says the server flaw needs the Legacy API on and open to the internet, and probing began within hours. Turn the Legacy API off now if you run N-central on-prem.\n\nOne lets an attacker plant a signing key and then read or overwrite any private image. Upgrade Quay or the OpenShift mirror registry and rotate robot tokens.\n\nThe 26.x, 24.x and 22.x lines are patched, including a TLS bug that can copy server memory into a request. Update to the newest patch of your Node line.\n\nUnited cites security risks and federal rules, while Southwest lets ChatGPT users see its flights. Check the terms of every portal your own agents sign in to.\n\nBritain's Sovereign AI Fund backs the Series C, and Fractile stacks DRAM on each chip to speed up inference. It plans to ship its first chips and systems next year.\n\nThe BriefApache fixed a critical flaw in its web server's HTTP/2 module on November 11. CVE-2026-119618 is a race in mod_http2 that can corrupt memory and, Apache says, lead to remote code execution on versions 2.4.55 through 2.4.70; Anthropic's AI scanner and Google Cloud researchers each found it. Servers are exposed only when HTTP/2 is switched on with a Protocols h2 or h2c line, so check every VirtualHost, then update to 2.4.71 or your distro's fixed package, or turn HTTP/2 off until you can.\n\nLevel UpLock your GitHub Actions this week. Install the gh-actions-lock extension, run gh actions-lock in one repo, and commit the lockfile it writes. It pins every action your workflows use to a checked commit, so a moved tag cannot change what runs. It does not stop a stolen account from pushing a new workflow, so pair it with the token checks in today's Wire. →GitHub: gh-actions-lock", "url": "https://wpnews.pro/news/ai-news-report-november-12-apache-web-server-bug-lets-attackers-run-code-over-2", "canonical_source": "https://theainewsreport.com/2026-11-12.html", "published_at": "2026-11-12 17:33:46+00:00", "updated_at": "2026-11-12 17:53:20.893183+00:00", "lang": "en", "topics": ["ai-safety"], "entities": ["Apache", "Anthropic", "Google Cloud", "CVE-2026-119618", "mod_http2"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/ai-news-report-november-12-apache-web-server-bug-lets-attackers-run-code-over-2", "markdown": "https://wpnews.pro/news/ai-news-report-november-12-apache-web-server-bug-lets-attackers-run-code-over-2.md", "text": "https://wpnews.pro/news/ai-news-report-november-12-apache-web-server-bug-lets-attackers-run-code-over-2.txt", "jsonld": "https://wpnews.pro/news/ai-news-report-november-12-apache-web-server-bug-lets-attackers-run-code-over-2.jsonld"}}