CloudLinux Security Advisories

Critical Apache mod_http2 flaw (CVE-2026-119618): updates for CloudLinux

CVE-2026-119618 is a flaw in Apache's HTTP/2 module, mod_http2, that Apache rates critical and says can lead to remote code execution. Fixed mod_http2 packages are out for the system Apache on CloudLinux 9 and 10. On cPanel servers, CloudLinux is building EasyApache 4 with the fix. Until it is installed, remove the HTTP/2 module.