Apache fixes critical remote code flaw in mod_http2

Apache today released a security update fixing a critical remote code execution vulnerability in mod_http2. The flaw arises during stream processing in the assign_headers function, where a heap overflow could be triggered to execute arbitrary code. No working exploit has been published publicly. Mitigation guidance noted by the podcast host includes disabling HTTP/2, though this may cause collateral issues with proxies translating to HTTP/2 and potential HTTP request smuggling concerns.

Fortinet published 89 advisories covering more than 100 vulnerabilities across its product portfolio, with 17 rated critical, including several that could allow arbitrary code execution without authentication. If organisations deploy Fortinet products, a patch is described as likely necessary, with FortiMail highlighted among the most affected products. The host also notes that AI contributed to discovering some of these issues.

Ivanti released its November 2026 security update, including a patch for an SQL injection vulnerability in Endpoint Manager that could enable remote code execution, plus a vulnerability in Ivanti CSA allowing unauthenticated alteration of trusted EPM Core certificates. Nightmare Eclipse subsequently disclosed SignDrop, a privilege-escalation flaw in the Windows Common Log File System.

SignDrop reportedly abuses the HMAC-protected CLFS log feature with symlink and timing tricks to escalate to system on Windows 11 26H2 and Windows Server 2025; a PoC exploit has appeared on GitHub, though Microsoft has not confirmed the issue and no CVE has been issued. The host cautions that disabling CLFS log authentication is not a prudent workaround.

Also covered, N-able released 2026.4 hotfix 2 for N-central, with notes listing three CVEs addressed; earlier chatter suggested many vulnerabilities were reported after N-central’s outage, and Shadowserver’s count of exposed on‑prem N-central servers fell from about 1,338 to around 148.