BTC $68,924.31 -6.45%
ETH $1,935.42 -5.66%
BNB $634.65 -6.32%
XRP $1.00 -3.74%
SOL $78.28 -5.78%
TRX $0.3109 -1.99%
DOGE $0.0634 -5.51%
ADA $0.1683 -2.73%
BCH $217.12 -5.43%
LINK $9.69 -4.02%
HYPE $70.59 -2.16%
AAVE $110.31 -7.16%
SUI $0.7725 -5.61%
XLM $0.1421 -3.11%
ZEC $930.80 -5.37%
AAPL $357.17 +0.30%
AMZN $268.22 +0.73%
GOOGL $299.88 +1.55%
MSFT $520.91 -0.08%
META $625.16 -0.58%
NVDA $162.91 +1.06%
TSLA $397.78 +2.56%
SNDK $916.08 -4.04%
INTC $60.77 +0.07%
SPCX $140.38 +0.52%
MU $788.46 -0.24%
AMD $574.70 +2.20%
BTC $68,924.31 -6.45%
ETH $1,935.42 -5.66%
BNB $634.65 -6.32%
XRP $1.00 -3.74%
SOL $78.28 -5.78%
TRX $0.3109 -1.99%
DOGE $0.0634 -5.51%
ADA $0.1683 -2.73%
BCH $217.12 -5.43%
LINK $9.69 -4.02%
HYPE $70.59 -2.16%
AAVE $110.31 -7.16%
SUI $0.7725 -5.61%
XLM $0.1421 -3.11%
ZEC $930.80 -5.37%
AAPL $357.17 +0.30%
AMZN $268.22 +0.73%
GOOGL $299.88 +1.55%
MSFT $520.91 -0.08%
META $625.16 -0.58%
NVDA $162.91 +1.06%
TSLA $397.78 +2.56%
SNDK $916.08 -4.04%
INTC $60.77 +0.07%
SPCX $140.38 +0.52%
MU $788.46 -0.24%
AMD $574.70 +2.20%

io

All
Article
Flash

first_img Apache has a serious vulnerability, and the HTTP/2 service may be subject to remote code execution

A serious security vulnerability has been found in the open-source server software Apache HTTP Server. Attackers can exploit this vulnerability to corrupt server memory by crafting requests when they have access to the affected service, allowing them to execute code with the privileges of the web service process. The vulnerability is located in the HTTP/2 module, and attackers can trigger a concurrent synchronization flaw without authentication, leading to heap memory corruption. If successfully exploited, it allows code execution with the privileges of the Apache worker process and access to data that the process can read.The affected range includes Apache HTTP Server versions 2.4.55 to 2.4.70, as well as mod_h2 versions 2.0.8 to 2.0.42 used separately from GitHub. Red Hat stated that the risk involves servers that enable HTTP/2 through the Protocols directive, including H2 for encrypted connections and H2C for plaintext connections. Administrators need to check both global configurations and individual virtual host configurations; if a CDN or reverse proxy is deployed on the website frontend, it is also necessary to check whether the Apache origin server can be accessed directly via HTTP/2.Apache released HTTP Server 2.4.71 on November 11, 2026, and it is recommended that websites using Apache upgrade immediately. If an upgrade cannot be performed temporarily, HTTP/2 can be disabled as a temporary measure. The issue lies in the assign_headers() function of mod_http2. HTTP/2 allows multiple requests to be processed concurrently over the same connection, and the affected code has a synchronization flaw when handling shared resources, which may lead to heap memory corruption. This vulnerability was discovered by the Anthropic OSS Scanner open-source project and the Google Cloud vulnerability research team. Anthropic reported it to the Apache Foundation on October 26, and the Google Cloud team reported the same vulnerability on November 3.

first_img Knowledge base application Notion reports less than 1% workspace AI conversation leaks

The knowledge management application Notion has released an announcement acknowledging that some users' AI chat records have been leaked. The company stated that the affected workspaces account for less than 1% of all workspaces and is currently notifying the affected users. If users have provided their account, password, or credentials to the AI, Notion recommends treating them as compromised, immediately checking the login records of the relevant accounts, and changing passwords or credentials.The source of this incident is a hacker attack on the service provider Fireworks. Notion uses Fireworks AI to process data for a feature called Insights, which helps workspace administrators understand how team members are using AI. To generate this analytical data, Notion sends the saved AI conversation content to Fireworks for processing. Fireworks has also served as the inference service provider for some open-weight models in Notion's products.Notion stated that the potentially leaked data mainly consists of user chat records, including the chat content input by users and the replies given by the AI. The announcement explained that some users may have sent their account, password, or various credentials to the model while using AI. Notion advises the relevant users to immediately change these passwords or credentials and check for any unusual activity in their account login records.
app_icon
ChainCatcher Building the Web3 world with innovations.