RedHat claims there's a working RCE:

> (...) public research has demonstrated a reliable exploit against a default-configured server with the mod_http2 module enabled. Successful exploitation allows an attacker to execute arbitrary commands, gain full control of the server process, and access or modify sensitive information.

https://access.redhat.com/security/cve/cve-2026-119618

Discovered independently by Anthropic (Oct 26) and Google (Nov 3), so I'm compelled to believe it: https://httpd.apache.org/security/vulnerabilities_24

But maybe someone will post another HN challenge like with the PHP thing?