What to ask your host about the Apache HTTP/2 flaw

A critical security flaw has been found in Apache, the web server software that runs underneath many WordPress websites. The fix arrived on 11 November 2026. Because the problem sits in the server rather than in WordPress, updating WordPress, plugins or your theme will not fix it. Your host, or whoever runs your server, has to apply it.

This is the same situation we described in our 6 November post, Why updating WordPress won’t fix the PHP and Brotli flaws. The fix has to happen below your website, so the useful thing you can do is ask the right questions.

What has happened

The flaw is tracked as CVE-2026-119618. It affects mod_http2, the part of Apache that handles HTTP/2. HTTP/2 is the newer, faster way browsers and servers exchange web pages. Apache rates the flaw “critical”.

According to reports published on 11 and 12 November, the affected versions are:

• Apache HTTP Server 2.4.55 to 2.4.70
• the separate mod_h2 module, versions 2.0.8 to 2.0.42

Apache HTTP Server 2.4.71 fixes it. Apache has not published a workaround, so updating is the official fix.

The technical cause is a “race condition”. Two parts of the software can use the same piece of memory at the same time without proper safeguards. This can corrupt the server’s memory. In the worst case, it could let someone on the internet run their own code on the server without logging in. That is why it matters. A server taken over in this way puts the whole website at risk, along with any customer data stored on it.

The same release also fixes two lower-profile Apache flaws. CVE-2026-106023 is in mod_md and can crash a server process. CVE-2026-109163 is in mod_vhost_alias. Any host applying the update will deal with all three at once.

How worried should you be

Take it seriously, but there is no need to panic.

• When we checked the reports from 11 and 12 November, there were no confirmed attacks and no public exploit code. The flaw was not on CISA’s Known Exploited Vulnerabilities list, the US government’s list of flaws being actively attacked.
• Reports say the flaw can only be reached when the server offers HTTP/2 through Apache. That detail comes from secondary write-ups rather than Apache directly, so treat it as likely but not confirmed.
• If your site does not run on Apache at all, this flaw does not apply to you. Many WordPress hosts use other web server software.
• Red Hat, which supplies a widely used business version of Linux, has released fixes for RHEL 9 and RHEL 10. It rates the flaw “Important” rather than “critical”. Reports differ on exactly how hard Red Hat thinks it is to exploit, so we would not read too much into the lower rating.

Some details are still settling. Several write-ups disagree on the severity score, and no official score had been widely confirmed when we wrote this. Apache’s own security advisory remains the definitive reference.

The flaw was reported to Apache independently by Anthropic’s OSS Scanner on 26 October and by researchers at Google Cloud Vulnerability Research on 3 November. Researchers found it before anyone was known to be using it, which is the better way round.

Can you check this yourself

Not reliably. Most well-run servers hide their Apache version from the outside world, and that is a sensible security habit. Even when the version is visible, it may not tell you the full story.

Many hosts install Apache through their Linux distribution’s own packages. These distributions often add security fixes to an older version number rather than moving to the newest release. A server reporting 2.4.70 could therefore already be protected, while a server you assume is fine might not be. The honest answer is to ask your host directly.

What you should do

If we look after your website

You do not need to update anything in WordPress for this flaw. If you would like confirmation about the server your site runs on, or have any questions, get in touch and we will give you a straight answer.

If you manage it yourself or use another host

Send your host a short message. These questions should get you a clear answer:

1. Does my website run on Apache? If not, ask what web server software it does use and whether that software has its own outstanding updates.
2. Is HTTP/2 handled by Apache on my server? This helps you understand whether the flaw can be reached.
3. Have you applied the fix for CVE-2026-119618? Accept either Apache 2.4.71 or your operating system vendor’s patched Apache package. Do not insist on the number 2.4.71, for the reason explained above.
4. If not yet, when will it be applied? A specific date is more reassuring than “soon”.
5. Does the fix cover the whole server? On shared hosting, your site sits on the same machine as many others, so the host has to patch the server itself.

A good host should answer these quickly and without fuss. If yours cannot tell you whether they use Apache, or will not commit to a date, that tells you something useful about how they handle security.

If you run your own server

If you or your developer manage a VPS or dedicated server running Apache, install your Linux distribution’s updated Apache package as soon as it is available, or move to 2.4.71. Then restart Apache so the fix takes effect. Some write-ups suggest switching off HTTP/2 as a stopgap. Apache has not published this as a workaround, so treat it as a decision for whoever administers the server, not a substitute for updating.

Looking ahead

We will keep an eye on whether attacks or public exploit code appear in the coming days, since that would change how urgently this needs handling. For now, the sensible step is to make sure your host has it on their list and can tell you when it is done.

This is also a reminder that keeping WordPress and plugins updated is only part of looking after a website. The server underneath needs the same attention. That is a large part of what our managed hosting covers, if you would rather someone else kept track of it.