CRITICAL/ NOVEMBER 13, 2026TODAY’S BRIEFING — #238
Apache HTTP/2 RCE, ScreenConnect worm malware, GitHub account compromise campaign
Apache HTTP Server critical RCE in mod_http2 patched in 2.4.71; ScreenConnect attacks spread malware to MSP technicians; 4,837 GitHub accounts compromised to steal cloud credentials.
CVE-2026-119618Apache HTTP Server mod_http2 — Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.CVE-2026-84869ConnectWise ScreenConnect — A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host… · In CISA KEVCVE-2026-90436Apache Axis — Zero-day combined with privilege escalation; active exploitation for cryptocurrency mining; root-level RCE via Legacy APICVE-2026-106023Apache HTTP Server mod_md — NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing.
Read the full briefing →