A new vulnerability in Apache HTTP Server could allow an attacker to run malicious code remotely on vulnerable systems. The vulnerability, tracked as CVE-2026-119618, affects the HTTP/2 module (mod_http2) and has a CVSS score of 9.8 which means it is critical. This has been fixed in Apache version 2.4.71 which was released on the 11th November 2026.  The Apache versions affected are between 2.4.55 and 2.4.70. However, only systems where HTTP/2 has been enabled are vulnerable. Red Hat state "An attacker with network access to a vulnerable system could exploit this vulnerability to take control of the server process." As no authentication is required systems that are network accessible could be at high risk. Red Hat’s analysis of the vulnerability states that there is public research showing a reliable exploit for a server running the default configuration and mod_http2 enabled. The research was not detailed or sourced.  However, cybersecurity firm Wiz state that there is no exploit available and no attacks have been observed in the wild. HTTP/2 is not enabled by default. It can be enabled globally for all virtual hosts or just on specific virtual hosts. This is done by adding ‘h2’ to the Protocols directive for secure HTTP/2 (TLS) or ‘h2c’ for insecure HTTP/2 (TCP). All configuration files should be reviewed by the security team. Apache recommend upgrading to version 2.4.71. This also includes a fix for a crash issue in mod_md (Important) and a memory overwrite vulnerability in mod_vhost_alias (Low severity). If you are using official builds of Apache then administrators should upgrade to the latest version. This also affects standalone versions of the HTTP/2 module (mod_h2).  These versions affected are between 2.0.8 to 2.0.42. There is no fixed version available. The GitHub repository has been archived and the latest version published is 2.0.42. The patch is available for some OSs. Red Hat have patched Enterprise Linux versions 9 and 10. However, this vulnerability is rated as Important. This is because the HTTP/2 streams use separate memory allocators making it harder to exploit. Enterprise Linux 8 and below are unaffected. Debian have patched this in their unstable version. Bookworm, trixie and forky are still affected. Amazon Linux 2, 2023 and 2027 Preview are waiting on patches. Ubuntu do not have a specific vulnerability page.  If you cannot patch your systems then Wiz recommend disabling HTTP/2 by removing ‘h2’ and ‘h2c’ from the Protocols directive. This will leave you with HTTP/1.1. This vulnerability was first reported by Anthropic’s OSS Scanner on the 26th October. The scanner uses Anthropic’s AI models to scan open source software. It was also reported by Anthony Weems and Simon Scannell from Google Cloud Vulnerability Research last week. This comes after another vulnerability in Apache’s HTTP/2 module (CVE-2026-23918) was patched in version 2.4.67 in May. Upgrading to this version or any version after up to 2.4.70 won’t protect your systems from this new vulnerability.

An organization known as Gambling Goblin, which is a Chinese-speaking cybercrime group, has compromised Apache web servers owned by Brazilian government agencies and educational institutions, redirecting legitimate web visitors to attacker-controlled pages promoting online gambling and sports betting. Check Point Research has been monitoring the activity since mid-2025. Attackers install rogue Apache modules on the web server and utilize them to reverse proxy selected visitors to external web sites. While the destination is controlled by the attackers, the traffic appears to originate from a legitimate domain, making it harder to identify the activity.  It is designed to mimic trusted platforms like Google Play, Microsoft Store, and Amazon in order to facilitate identification of malicious sites. These familiar interfaces direct visitors to phishing sites, online gambling or sports betting services. Researchers believe that this campaign is primarily the result of SEO manipulation.  It has been shown that operators are capable of exploiting trust associated with government and institutional domains by compromising high-reputation websites and serving or proxying attacker-controlled content in order to increase the visibility of gambling-related pages in search results by exploiting the trust associated with those domains. This campaign also demonstrates a broader trend in web-server compromises.  Instead of defacing websites or uploading malicious files, attackers are altering the Apache environment directly, giving them greater control over how requests are handled as well as allowing compromised domains to participate in a wider network of delivery and redirection.  Malicious Apache Modules Give Attackers Deeper Control Modules within the Apache web server provide malicious modules access to request and response handling. These attacks may allow attackers to inspect incoming traffic, alter responses, redirect selected requests, and proxy content from external infrastructure by inspecting incoming traffic, altering responses, or redirecting selected requests.  Researchers observed that the modules removed security headers from compromised sites prior to serving or proxying attacker-controlled pages as part of the Gambling Goblin campaign. During the change, security controls that would prevent the execution of injected or redirected content may be weakened. As a result of the selective nature of the activity, detection becomes more difficult.  Even when specific requests, crawlers, or targeted traffic receive manipulated content, the compromised website may continue to operate normally for most visitors. This allows the legitimate site to remain functional while the attacker's infrastructure is quietly utilized to carry out his or her operations.  A Broader Toolkit Supports the Campaign The Apache modules appear to be only one part of Gambling Goblin’s infrastructure. Check Point researchers also identified a scanning component called cam-agent on exposed systems, which is used to gather information about internet-facing infrastructure and identify potential targets.  After gaining access, the attackers can deploy additional tools through DownPro, a loader capable of retrieving payloads such as the ChUser backdoor, AlphaAgent and oRAT. The toolkit also includes utilities for testing SSH credentials, giving the operators multiple ways to maintain access and move further into compromised environments. AlphaAgent provides remote command execution, file transfers and tunneling capabilities, while also searching for SSH keys and shell history.  The malware can be disguised as a legitimate system service to reduce suspicion. oRAT similarly establishes persistence through a service designed to resemble a normal firewall-related component. The infrastructure supporting the operation is also built for resilience. Researchers observed the use of newly created domains to replace infrastructure that becomes blocked or unavailable. Encryption, disguised processes and memory-based payload handling further complicate analysis and detection.  Government Domains Used for Search Manipulation  A campaign's use of government and education websites provides additional benefits beyond its initial compromise. Established public domains are more reputable with search engines and can provide greater visibility for web pages hosted or proxied through them. This infrastructure was used by researchers at Check Point to present fake application-download pages in Chinese, Vietnamese, Spanish and English, as well as gambling and fraud applications. As indicated by the usage of multiple languages, the operation does not focus on a single region. A separate report from ANY.RUN published in July identified that at least twenty Brazilian municipal and police portals had been utilized to distribute malware in a campaign known as PhantomEnigma, which included at least 20 gov.br portals belonging to municipalities and police departments.  As a result of the compromise, organizations are not limited to the visible website. There should be a comparison of Apache module inventories, server configurations, timestamps, running services, and SSH activity against known-good baselines. An unauthorized module, an unexpected proxy rule, or newly created services can be an indication of a deeper intrusion.  The campaign demonstrates how a trusted public domain can be turned into a criminal infrastructure when a legitimate web server is controlled, while the underlying compromise remains mostly hidden from ordinary users.