Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE
2026-05-05T19:24:15Z•69f083450a7fb4fa3edb3bcb13f63949f0ac9f94519c4bb9691c9423c612a392
active-exploitationapache-httpdapt-activitycisa-kevcredential-theftcritical-vulnerabilitiesdoSdouble-freehttp2linux-lpemetinfo-cmsmoveit-automationoauth-token-abusephishingrcermm-abusesoftware-supply-chainsupply-chain-attacktrellix-breachweaver-e-cology
What happened
Multiple high-impact security incidents and actively exploited vulnerabilities were reported across open-source and enterprise software. Notable items: a critical Apache HTTP/2 double-free (CVE-2026-23918, possible DoS/RCE); active RCE exploitation in MetInfo CMS (CVE-2026-29014) and Weaver E-cology (CVE-2026-22679); CISA added Linux local privilege escalation CVE-2026-31431 to KEV; Progress patched a critical MOVEit Automation authentication-bypass; and several supply-chain compromises (DAEMON Tools installers, PyTorch Lightning package, poisoned Ruby/Go modules, ScarCruft trojanized game‑dev
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 69f083450a7fb4fa3edb3bcb13f63949f0ac9f94519c4bb9691c9423c612a392
- Enrichment time
- 2026-05-05T19:24:15Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.