Security Advisory: Apache HTTP/2 Vulnerability (CVE-2026-119618)

Incident Report for Liquid Web - Services

Investigating

We are aware of a recently disclosed critical security vulnerability, CVE-2026-119618, affecting the HTTP/2 implementation in Apache HTTP Server (mod_http2). Under certain conditions, this vulnerability could potentially allow remote code execution through specially crafted HTTP/2 requests.

We will be applying patches across our hosting fleet. This will involve restarting the Apache service, which will incur a few seconds of downtime.

We are treating this matter with high priority and will continue to monitor the situation closely, providing further updates as remediation progresses.

If you need assistance or have any concerns, please contact our Support team.

Posted Nov 12, 2026 - 05:20 EST

This incident affects: Cloud Dedicated, Cloud VPS Hosting, CPanel, InterWorx, and Plesk.