Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE
2026-05-06T07:24:10Z•072677258c2872488597d5366ce0875aa7584112197772f208145ee16120c1ef
active-exploitationapache-httpdaptcpanelcritical-vulnerabilitiesdaemon-toolsdosdouble-freehttp2known-exploited-vulnerabilitieslinux-lpemalwaremetinfomoveitoauth-token-abusephishingrcescarcruftsoftware-supply-chainsupply-chain-attackweaver-e-cology
What happened
Multiple high-severity security incidents reported: a critical Apache HTTP/2 double-free vulnerability (CVE-2026-23918, CVSS 8.8) enabling DoS and potential RCE, and several actively exploited critical RCE flaws including MetInfo CVE-2026-29014 (CVSS 9.8) and Weaver E-cology CVE-2026-22679 (CVSS 9.8). Additional notable items include an actively exploited Linux local privilege escalation added to CISA KEV (CVE-2026-31431), widespread supply chain compromises (DAEMON Tools, PyTorch Lightning/Intercom-client, poisoned packages), high-impact phishing and token/SSO abuse campaigns, and multiple A/
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 072677258c2872488597d5366ce0875aa7584112197772f208145ee16120c1ef
- Enrichment time
- 2026-05-06T07:24:10Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.