Nexcess incident
Security Advisory: Apache HTTP/2 Vulnerability (CVE-2026-119618)
Ongoing since 10:22 AM UTC.
We are aware of a recently disclosed critical security vulnerability, CVE-2026-119618, affecting the HTTP/2 implementation in Apache HTTP Server (mod_http2). Under certain conditions, this vulnerability could potentially allow remote code execution through specially crafted HTTP/2 requests. We will be applying patches across our hosting fleet. This will involve restarting the Apache service, which will incur a few seconds of downtime. We are treating this matter with high priority and will continue to monitor the situation closely, providing further updates as remediation progresses. If you need assistance or have any concerns, please contact our Support team.
Update timeline
- investigating Nov 12, 2026, 10:22 AM UTC
We are aware of a recently disclosed critical security vulnerability, CVE-2026-119618, affecting the HTTP/2 implementation in Apache HTTP Server (mod_http2). Under certain conditions, this vulnerability could potentially allow remote code execution through specially crafted HTTP/2 requests. We will be applying patches across our hosting fleet. This will involve restarting the Apache service, which will incur a few seconds of downtime. We are treating this matter with high priority and will continue to monitor the situation closely, providing further updates as remediation progresses. If you need assistance or have any concerns, please contact our Support team.
Your product runs on more than Nexcess
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services