[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

operational guidance based on the Apache and Red Hat advisories for CVE-2026-119618 (Nov 11, 2026)

Tip: find which Apache servers actually have HTTP/2 turned on, and patch those first

  • Check the config: apachectl -M | grep http2 shows whether the module is loaded; grep -Ri '^\s*Protocols' /etc/apache2 /etc/httpd shows where h2 or h2c is enabled.
  • Check from outside: curl -sI --http2 https://host/ -o /dev/null -w '%{http_version}\n' prints 2 if the server negotiates HTTP/2.
  • Check the version: httpd -v or apache2 -v; 2.4.55 through 2.4.70 are affected, and so are bundled builds in appliances and control panels.
  • Stopgap: set Protocols http/1.1 and reload. Put a CDN or reverse proxy in front only if it terminates HTTP/2 itself and talks HTTP/1.1 to Apache.

Sources: Apache HTTP Server 2.4 vulnerabilities: fixed in 2.4.71 (Nov 11, 2026) · Red Hat: CVE-2026-119618