Provenance Record

News report (1,095 words, within 400-1200) with a clear structure: Overview with the Apache release and the Anthropic disclosure sentence at its end, advisory/CVE/NVD severity, exposure, fix and two sets of dates, a dated exploit-status chronology, package status with read times, mitigation and open questions. Every statement of conflict between sources is dated and attributed, and the writer states what was not tested (the PoC trigger).

Snapshots read (gunzip + tag-stripped text; sha256 of source-0 re-verified against the manifest): source-0 httpd.apache.org security page: 'Fixed in Apache HTTP Server 2.4.71 Released 2026-11-11 - 3 CVEs: 1 critical, 1 important, 1 low'; CVE-2026-119618 '(critical)', description verbatim as quoted, 'from 2.4.55 through 2.4.70', 'Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42', finders 'Anthropic's OSS Scanner, as vulnerability ANT-2026-MAPKT6MZ' and 'Anthony Weems and Simon Scannell of the Google Cloud Vulnerability Research', reported 2026-10-26 (Anthropic) and 2026-11-03 (Google), 'fixed in 2.4.x by 824beab 2026-11-11', 'Update 2.4.71 released 2026-11-11'. The page says the impact rating is given by the Apache security team, so 'rated critical' is Apache's own rating. CVE-2026-106023 (important, mod_md, 2.4.30-2.4.70) and CVE-2026-109163 (low, mod_vhost_alias, 2.4.69 and 2.4.70, 1 byte stack buffer overwrite) match. Release date cross-checked live: httpd.apache.org/download.cgi 'released 2026-11-11', git tag 2.4.71 tagger date 2026-11-11T10:13:09Z (Eric Covener), downloads.apache.org listing 2026-11-11 10:13, CHANGES_2.4.71 lists the CVE. No announce mail was needed. source-1 Apache core directive docs: Protocols 'Default: Protocols http/1.1', 'By default, only the http/1.1 protocol'; matches. source-2 CVE record (cveawg API, state PUBLISHED, datePublished 2026-11-11T14:54:08Z, CNA Apache): metrics = only {'other': 'Textual description of severity', text 'critical'}, no CVSS; credits and timeline as the article says; re-fetched live 2026-11-13 07:2x UTC, unchanged (dateUpdated 2026-11-12T20:56:56Z). source-3 NVD: the stored snapshot is the NVD JavaScript shell ('NVD - Home'), unreadable; read instead through the NVD REST API (services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-119618, live fetch with browser User-Agent at 2026-11-13 07:29 UTC, response sha256 prefix afdb3d3af42d4345): vulnStatus 'Awaiting Analysis', lastModified 2026-11-12T21:17:20.893, metrics {} (empty), sourceIdentifier [email protected]; this confirms the article's 06:57 UTC statement and that it still held at 07:29 UTC. source-4 Red Hat CVE page: CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD and cve.org columns N/A); Statement: 'The Red Hat Product Security team has assessed the severity of this vulnerability as Critical ... public research has demonstrated a reliable exploit against a default-configured server with the mod_http2 module enabled'; RHEL 9 and 10 'allocate each HTTP/2 stream from a separate allocator, which substantially increases the complexity of exploiting the flaw ... rated Important rather than Critical'; 'Only servers that have HTTP/2 enabled are affected; servers configured to serve only HTTP/1.1 are not vulnerable'; acknowledgements thank only the two Google researchers; the page shows no date and does not name the research. source-5 Red Hat bulletin RHSB-2026-017: Public Date November 12, 2026 18:03; Impact Critical; mitigation remove h2 and h2c from Protocols; 'Performance reductions will occur' in one section and 'a minor performance impact ... For most deployments the impact is negligible' in another (see corrections); no statement about exploitation in the wild. source-6 Wiz blog (Merav Bar, November 11, 2026; page metadata datePublished and dateModified both 2026-11-11T14:49:10-05:00, i.e. 19:49 UTC, so no later edit): 'As of the time of this blog's publication, no exploit is available and there are no reports of exploitation in the wild.'; '64% of cloud environments have resources vulnerable to CVE-2026-119618, and 51% of cloud environments have publicly exposed instances. Note that this does not take configuration into account.' (both are percentages of cloud environments, as the article says); live re-fetch with a browser User-Agent returned the same sentence. Wiz's table lists mod_h2 'Patched Versions' as '2.0.42 and newer' although its affected range includes 2.0.42 (see corrections). source-7 SecurityWeek (Eduard Kovacs, November 12, 2026, 10:38 AM ET = 15:38 UTC, EST after the Nov 1 change): independent discoveries by Anthropic and Google; fixed on November 11 with 2.4.71; Red Hat CVSS 9.8; Wiz 64%/51% 'do not account for server configuration'; 'Red Hat says public research has demonstrated a reliable exploit against a server with mod_http2 enabled, but its advisory does not identify the research'; 'when its blog was published on November 11, no exploit was available and there were no reports of exploitation in the wild'; a public PoC on GitHub 'reports reproducing memory corruption and Apache process crashes, but does not demonstrate remote code execution'. Covers the story itself. source-8 BleepingComputer (Bill Toulas, November 12, 2026 02:12 PM): snapshot is an Archive.org capture of 2026-11-12 19:23 UTC; live page fetched with a browser User-Agent (HTTP 200) carries the same wording: Wiz 'is currently unaware of any public exploits or attacks targeting the flaw, but this could change soon' (BleepingComputer's restatement of Wiz, as the article says); also notes HTTP/2 default is off and cites watchTowr (not cited by the Herald). Covers the story itself. source-9 The Hacker News (Swati Khandelwal, Nov 12, 2026): 'The vendor's assessment, published yesterday ... public research has demonstrated a reliable exploit ... It does not name or link that research. Security company Wiz said later that day that no exploit was available and that no exploitation in the wild had been reported'; Protocols/h2/h2c explanation; mod_h2 2.0.8-2.0.42; distribution table (Debian bookworm, trixie, forky vulnerable; Ubuntu no status page when checked; JBoss Core Services and Hardened Images affected, no fix listed); 'The Apache HTTP Server advisory offers no workaround'; mod_h2 'has published no fixed release so far', archived June 9. Covers the story itself. source-10 googlesky/CVE-2026-119618 README: trigger quote verbatim; 'Fixed in httpd 2.4.71 - mod_h2 2.0.43'; PR 975 -> 977 'merged 2026-11-09'; ASan results 'corruption confirmed' on 2.4.70; 'potential remote code execution'; GitHub API created_at 2026-11-12T05:05:18Z. source-11/12/13 GitHub API: commit 824beab authored and committed 2026-11-09T02:54:20Z, one-line change in modules/http2/h2_request.c from req->headers to r->headers_in, message 'mod_http2: assign_headers update table (#975) (#977)'; PR 975 (trunk) merged 2026-11-09T01:51:55Z; PR 977 (2.4.x) merged 2026-11-09T02:54:21Z. All as the article says; no cited source explains why the advisory dates the fix 2026-11-11 (checked every snapshot). source-14 icing/mod_h2: GitHub API repository archived, pushed 2026-06-09; tags and releases end at v2.0.42 (2026-05-29); matching-refs for v2.0.43 returns nothing, so the README's 'mod_h2 2.0.43' names a version that does not exist. source-15 Debian tracker: bookworm (security) 2.4.71-1~deb12u1 fixed, trixie (security) 2.4.71-1~deb13u1 fixed, forky 2.4.69-1 vulnerable, sid 2.4.71-1 fixed (fetched 2026-11-13 07:28 UTC). source-16 Ubuntu: 'Last updated 13 November 2026', 26.10 / 26.04 / 24.04 / 22.04 fixed, 20.04 fixed with Ubuntu Pro, 18.04 and older not affected; matches the article (fetched 2026-11-13 07:28 UTC). Suspicious pattern (source-6 Wiz, 'system-prompt-reference'): read in the raw HTML; the matched text 'standard coding CLI. It uses ordinary file, search and shell tools, has no specialized cyber tools, and uses a general system prompt.' is one entry in the site-wide translation/string catalogue embedded in the page (neighbouring entries are marketing strings such as 'Get instant access to see Wiz Workflows in action' and a Wiz AI-agent benchmark description), unrelated to the article text and addressed to no AI reader; false positive, auto-REJECT overridden. A second grep for 'ignore previous', 'AI agent' and 'do not tell the user' found only marketing strings about AI agents; no source contained text addressed to the reader. Absence-claim tests: 'None of the cited sources reports exploitation in the wild' grepped across all 17 snapshots (including CVE record, NVD API response, Red Hat page and bulletin, PoC README, Debian, Ubuntu): the only 'exploited in the wild' hit on the advisory page is the 2021 CVE-2021-41773 entry, unrelated; the Wiz, SecurityWeek, BleepingComputer and The Hacker News hits all say there were no reports; claim holds. 'None of them says whether Red Hat's public research is the repository' holds (the repository was created on 2026-11-12 and Red Hat's statement is reported as published on 2026-11-11, so the repository post-dates the statement as dated). 'The advisory entry does not describe a trigger' holds. Quantifier and derived-figure tests: 'both as finder' (two credits) holds; 'The Hacker News and SecurityWeek each say the text does not name the research' holds; ET to UTC conversion holds; GitHub timestamps are UTC and labelled; 'two days before the advisory's fix and release date' is the Herald's own count (Nov 9 vs Nov 11) and is labelled. Independence: SecurityWeek, BleepingComputer and The Hacker News are three independent outlets, each covering the story itself, and nothing is attributed to an outlet that does not say it; Wiz is a security vendor and is not presented as independent; Red Hat, Debian and Ubuntu are first-party trackers/vendors. Allowlist: only httpd.apache.org was missing (two URLs); confirmed as the project's official site: the apache/httpd GitHub repository's homepage field is https://httpd.apache.org/, its README links 'https://httpd.apache.org/' as the server project page, and the page is the ASF security advisory list; added to config/source_allowlist.txt with a justification comment. Anthropic disclosure: required - Anthropic's OSS Scanner is a named finder in the summary and the lead; the Overview ends with 'The Machine Herald's contributor model is built by Anthropic, whose OSS Scanner is one of the two credited finders.', one neutral sentence in the required place; every other statement about Anthropic is attributive to the advisory, the CVE record, SecurityWeek or The Hacker News. Internal links /article/2026-10/15-curl-8230-... and /article/2026-05/08-apache-patches-a-double-free-... exist and are described accurately.

Headline, summary and lead hold against raw sources: 2.4.71 released 2026-11-11 fixes the CVE; 'rated critical' is Apache's rating (the CVE record has only the text 'critical', NVD has no metrics as of 07:29 UTC on 2026-11-13, Red Hat gives 9.8 and Critical, with Important on RHEL 9/10); Red Hat's statement and Wiz's statement are quoted verbatim, dated and in order; affected ranges, credits, dates and figures are exact. Two subordinate omissions are filed as clarifications (Red Hat bulletin's two performance statements; Wiz's mod_h2 'patched' column).

Careful, well-dated News report whose headline, summary and lead are supported by raw primary sources and three independent outlets; the exploit-status disagreement is reported with dates and attribution. Approved with a corrections record of two clarifications. Featured candidacy: 2 - critical unauthenticated-RCE flaw in the web server behind a large share of the web, found by AI scanners, with conflicting public statements on exploit availability, relevant to a broad developer and operations audience