Apache HTTP Server 2.4.71 Fixes Critical mod_http2 RCE Reported by Anthropic's AI Scanner
The 11 November release closes CVE-2026-119618, a heap corruption flaw affecting versions 2.4.55 through 2.4.70, credited to Anthropic's OSS Scanner vulnerability discovery program.
The Apache Software Foundation released HTTP Server 2.4.71 on 11 November, closing CVE-2026-119618, a critical vulnerability in the mod_http2 module. The flaw, a heap corruption condition that can lead to remote code execution, affects versions 2.4.55 through 2.4.70 of the world's most widely deployed web server.
Unusually for the open-source project, the advisory credits the report to "Anthropic's OSS Scanner" under reference ANT-2026-MAPKT6MZ — the AI-based vulnerability discovery program Anthropic has been running against widely used open-source code. The attribution landed one day after Fortinet's mega patch release, which likewise credited frontier AI models for a large share of nearly 100 fixed vulnerabilities.
Together the two releases document the same shift from opposite directions: AI-driven discovery is now producing fixes at industrial scale on the defensive side, while vendors warn the same automation compresses the time between a patch's publication and a working exploit. Administrators running httpd 2.4.x behind h2-enabled endpoints are advised to upgrade promptly.