Current Service Notifications

Security Advisory - Apache HTTP Server: Unauthenticated HTTP/2 Remote Code Execution (CVE-2026-119618)

On November 11, 2026, a critical vulnerability in the Apache HTTP Server was disclosed as CVE-2026-119618. Versions 2.4.55 through 2.4.70 are affected when using the HTTP/2 module mod_http2. The vulnerability can lead to memory corruption and potentially to the execution of malicious code.
Recommended Actions:
System administrators should identify all Apache HTTP Server installations, verify their vulnerability and accessibility, and install available security updates as soon as possible. The vulnerability is fixed in Apache HTTP Server 2.4.71. For distribution-specific packages, the corresponding security updates from the vendors must be taken into account. 
For affected systems that cannot be updated immediately, HTTP/2 should be disabled if possible until the vulnerability is fixed, or access should be restricted to authorized users.
Sources:
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-119618 
https://security-hub.ncsc.admin.ch/#/posts/13171

Last change: 12.11.2026 09:14

Security Advisory - GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13

On October 21, 2026, versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 were released for GitLab Community Edition (CE) and Enterprise Edition (EE).
 
Recommended Action
These versions contain important bug and security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.
 
Source:
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
 

Last change: 21.10.2026 21:48

Security Advisory - php2shell - critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

PHP has released security updates for both vulnerabilities. Update immediately.
Official technical details and mitigation guidance are now available. The information below supersedes earlier preliminary statements in this post.
 
AFFECTED PRODUCTS AND FIXED VERSIONS:
All unpatched PHP installations serving web requests should be assessed, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
 
PHP branch
Affected releases
Fixed release
8.5
Before 8.5.12
8.5.12
8.4
Before 8.4.27
8.4.27
8.3
Before 8.3.36
8.3.36
8.2
Before 8.2.35
8.2.35
 
Older branches also require remediation. Distribution packages may contain backported fixes without changing the upstream version number. Each package must be checked against the provider’s security recommendations.
 
Mitigation

• System administrators should identify all PHP installations, assess the level of risk they pose, and install any available security updates from the respective vendors as soon as possible.
• For affected systems and applications for which no security updates are yet available, access must be restricted to the ETH internal network or to authorised users until the vulnerabilities have been rectified.
• Alternatively, where operationally feasible, the affected systems or services should be temporarily taken offline.

• https://security-hub.ncsc.admin.ch/#/posts/13083
• https://www.php.net/archive/2026.php#2026-10-21-5