Millions at Risk: Apache HTTP Server Fixes Critical Remote Code Execution Flaw

The Apache HTTP Server Project published security updates (upgrade to 2.4.67) resolving several vulnerabilities in 2.4.66 and earlier—most critically CVE-2026-23918, an HTTP/2 double-free that can enable remote code execution. Additional fixes address a Digest authentication timing bypass, a local privilege escalation via .htaccess, AJP module heap/out-of-bounds reads that may leak memory, and NULL-pointer dereferences causing DoS; administrators are urged to update or apply mitigations (e.g., remove mod_dav_lock) if immediate upgrading is not possible.