Apache 2.4.68 Lands: The HTTP/2 Bomb Fix Goes Mainline, Plus an .htaccess Privilege Escalation Worth Knowing About

Mon, 15 Jun 2026 00:00:00 +0000

Apache HTTP Server 2.4.68 came out on June 8, 2026 — the first point release since 2.4.67 in early May, and per the project’s own download page, it’s “recommended over all previous releases.” If you run your own LAMP stack, this is the patch to schedule this week.

What’s actually in it

The public CVE list on httpd.apache.org hasn’t fully caught up to the release yet, but the individual disclosures have already landed on oss-security and in distro security trackers. Three are worth knowing about specifically.

Ldap on kalfaoglu.net

Apache 2.4.68 Lands: The HTTP/2 Bomb Fix Goes Mainline, Plus an .htaccess Privilege Escalation Worth Knowing About

What’s actually in it