Good morning. Apache fixed a critical bug in its web server’s HTTP/2 module on Wednesday. Nobody is exploiting it yet. Check Point gateways and ScreenConnect servers already have attackers inside some of them, and stolen GitHub tokens are emptying CI secrets.
Coffee first. Then a web server upgrade, a firewall hotfix, an extension check and a GitHub search.
Lead Story
Apache HTTP Server: a 9.8 HTTP/2 bug that needs no login. Versions 2.4.55 to 2.4.70 with HTTP/2 on are exposed. Install 2.4.71 or your distro’s package, or set Protocols to http/1.1.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Also Worth Your Attention
Check Point: PHP2Shell break-ins through Mobile Access. About two dozen unpatched gateways were taken over, some followed by wiper attacks. Install the November Jumbo Hotfix and look for webshells.
ScreenConnect: an add-on with a blank key opened 288 PCs. Disable RMM+ and its four sister extensions on your server, then look for a second ScreenConnect client.
GitHub: stolen tokens planted a CI secret stealer. Search for “docs: dependency audit notes” pull requests and rotate the secrets of any repo where the stealer ran.
On the radar
- Citrix fixed 12 NetScaler and Secure Access Client bugs, mostly denial of service, plus a 9.4 authentication bypass in NetScaler Console (14.1-74.34). ADC and Gateway fixes are in 14.1-73.57 and 13.1-64.39. No attacks known. The Hacker News.
- PTC patched a 9.2 remote code execution bug in Windchill and FlexPLM. PTC-hosted customers are already patched. The Hacker News.
Slack paste
Today’s brief: (1) Apache HTTP Server 2.4.71 for CVE-2026-119618, or set Protocols http/1.1 where HTTP/2 is on. (2) Check Point: November Jumbo Hotfix, check Mobile Access gateways for webshells (CVE-2026-123039). (3) ScreenConnect: disable RMM+ and related extensions, look for a rogue client. (4) GitHub: search for “docs: dependency audit notes” PRs and rotate CI secrets where the stealer ran.
Go Deeper
Identity and access: IAM library. Tools and checkers: cybersecurity tools. Sorting this week’s fixes? Our patch priority checklist helps you decide what goes first.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
