Two of the places you are least likely to be watching this week are your web tier and your build pipeline.
The Hacker News reports a critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, tracked as CVE-2026-119618, that can let a remote attacker run code on the server. It affects versions 2.4.55 through 2.4.70 and is fixed in 2.4.71. The same outlet reports that an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company.
My advice is to treat both as reachability questions, not just patching questions. Know which hosts actually serve HTTP/2, and know what a compromised web host or a compromised repository could read next: database credentials, payment provider keys, signing material.
That inventory is work I do. I go through your Apache fleet, patch or turn off HTTP/2 where nothing needs it, and map what the web tier and the build step can reach in your payment and account flows. A review like that takes days, not months, and you get cost and timeline in writing first.
If you want that review, message me with roughly how many public-facing hosts you run.