Apache’s HTTP/2 bug lets anyone run code, and Gemini 4 Hydrogen replaces Flash

On Thursday's HN front page, the Apache HTTP Server has a critical hole in its HTTP/2 module. Two threads race inside the code that assigns request headers, and an attacker with no login can use that race to corrupt heap memory and run commands with the web server's privileges. Anthropic and Google Cloud's vulnerability research team found it separately. acidburnNSA points out that it is Apache's first bug rated critical since 2021.

The bug lives in mod_http2, so a server that only speaks HTTP/1.1 is out of reach. Several people in the thread find HTTP/2 off by default on their systems: palominoz on Ubuntu 22, and cozzyd on Enterprise Linux 8 and 9. Still, about half of cloud environments have an Apache in the affected releases facing the internet, and that count includes servers where HTTP/2 is switched off.

Wednesday's Apache release closes the race, and sherr reports that Debian already ships it. If you can't update yet, cut the Protocols line in the config down to HTTP/1.1. On Debian and Ubuntu, speleding's shortcut is to disable the module with a2dismod and restart. If you stop Apache entirely instead, rurcliped warns that a certbot timer can start it again when it renews a certificate.

# httpd.conf: drop h2 and h2c
Protocols http/1.1

# Debian and Ubuntu
sudo a2dismod http2 && sudo systemctl restart apache2

Google's new fast model, Gemini 4 Hydrogen, is in the Gemini API and AI Studio, and it's rolling out in the Gemini app and Google Search. It edges past Argon, Google's bigger reasoning model, on the Artificial Analysis index, and finishes tasks about two and a half times faster than 3.8 Flash. One price covers the whole million-token window. On data-ottawa's own workload, a task costs about a third more than on 3.8 Flash and finishes in roughly half the time.

In Google Antigravity, a new Orchestrator switches models inside one session. Carbon, the frontier model, takes the design calls and the hard bugs, and Hydrogen writes the code, runs the tests and verifies the change. On Terminal-Bench it came close to Carbon working alone, while using about a quarter less quota. Hydrogen in Antigravity is for paid Google AI Pro and Ultra subscribers.

Jane Street published Socratic Tutor, an agent skill that starts when you say teach me or quiz me. It splits the topic into subskills, runs a short diagnostic, and keeps a skill map from zero to five. When you answer wrong, it asks a narrower question instead of giving the answer, and a level goes up only after two separate checks. pizzathyme describes the problem it targets: ask a model about a topic and you get one long answer, a factoid, and no progress over time.

smolmaxxing is a set of patches on llama.cpp for hardware with about a gigabyte of usable memory. A mixture-of-experts model only needs a few experts per token, so it keeps the popular ones in memory and reads the rest from flash as they're needed. On a Xiaomi TV box, a 16-billion-parameter model generates about five tokens a second, and the same model runs on a 2013 iPad Air. Its author, mrashad74, says in the thread that models this small are novelty and fun for now, unless you fine-tune them on your own data.

GitHub Actions now supports workflow lockfiles. Run gh actions-lock and your workflows go back to readable version tags, while a lockfile records the exact commit behind each one, so a tag someone moves can't swap in new code. Dependabot and Renovate already keep it current. woodruffw, who maintains the zizmor linter, lists the gaps: reusable workflows and Docker images still need pinning by hand. I'd move to lockfiles over hand-pinned hashes, because the versions stay readable and the bots do the updating.

gh extension install github/gh-actions-lock
gh actions-lock            # writes .github/workflows/actions.lock
gh actions-lock --verify   # fails CI when the lock drifts