Hacker News

When using systemd, "systemctl mask apache2" can make sure that it's impossible for the unit to be started again (remove the mask with systemctl unmask once you've applied the patch).

If I need to make sure apache doesn't restart I often type "syntax error" on the first line of httpd.conf

Apache has a feature that no other http server has replicated: .htaccess files.

They provide limited configurability of server functionality within a webroot. That's extremely convenient for PHP webapps. For many PHP apps, deploying them on anything that is not apache means touching the server config itself.

Apache has plenty of life left, it just works™, supports almost everything, and currently is about as efficient as nginx WRT connection handling. Sometimes you want what .htacces gives you. (No built-in Lua though.)

At least 21% of web sites use Apache httpd, and of course many sites don’t report the software used at all. Nginx is also frequently used as a reverse proxy, with Apache used behind it.

My whole selfhosted mess is built around Apache. It was what I started with and I haven't run into any edge cases that it can't cover.

Why would I not use apache if everything already works with it for me?

Apache has mod_md -- an acme client, which lets you obtain https certificates as easily as on caddy, without integrating with awkward separate programs.

https://httpd.apache.org/docs/trunk/mod/mod_md.html

At work we use Apache because of mod_shib. We have yet to try nginx-http-shibboleth.

Default Wordpress docker image uses it.

I am the same way. I use Caddy if I can. But I have a lot of docker containers running apache and nginx. You probably might too.

But if you have more then one httpd server - eg. some fcgi - then HTTP/1.1 is almost architectural backdor: HTTP Request Smuggling, at minimum.

Apache even don't have it's own HTTP/2: mod_http2 use external library nghttp2[.org] so Apache is dead shell at this point.

I don't think it was fast tracked. Was it? I heard the rational to do HTTP 2 and soon later HTTP 3 was to split improvements and ease transition.

I saw that too. CVE-2026-111497 is the Brotli CVE, so my guess is they reused that prior page as a base to start with and missed changing that.

why? mod_mpm_event is what can be assumed to be the default since apache 2.4 (± 2012):

https://httpd.apache.org/docs/current/mpm.html#defaults

My guess is that they are collecting stats on running HTTP daemon software and thus they estimate that 64% of "cloud accounts" have Apache somewhere, and 51% of the total are publicly exposed instances (not on VPCs and such).

As they make a note that this does not account for configuration, so if you've got the http2 module disabled, it sounds like you are protected — though they only recommend hard-coding the protocol version to 1.1 instead of disabling the module (I've got the module disabled as that was the default when I set up my homelab server, for instance).

I think they’re likely referring to either a Cloud Org (AWS Organisation, Google Cloud Org, Azure Tenant).

Wiz works by plugging their tool into your Cloud Org, so presumably they’re saying 51% of their enterprise-y customers have an exposed instance.

Why are these things being disclosed before fixes have been rolled out? Is no-one following disclosure protocols any more?

Debian tracker: https://security-tracker.debian.org/tracker/CVE-2026-119618 - hopefully the fix lands soon

Debian has been patched just now and updates available : apache2 2.4.71-1~deb13u1

At least disabling http2 is an easy countermeasure that will probably in most setups not have any real downsides.

If it was even enabled that is.

We knew we weren't, deep down. Some people did better than others at writing more secure of course. It was just about good enough in a world where – compared to today – it took much more time, skill and effort to find bad bugs.

The mistake is to think that the 'magical' LLMs don't write buggy code and that there isn't some tradeoff in using them. There are always tradeoffs in engineering.

later

And, security is always relative to the adversary and landscape, which has massively changed recently.

Depends on use-case. As a reverse proxy I might use Caddy, for no fuss https. I prefer Apache over nginx for modules that are not available in the later, or they are not for free.

Did it manage to produce a PoC for RCE? Apparently Redhat claimed there's a RCE, while Wiz said they don't have one.

http2 race??

What exactly is the issue and does nginx have it

I was prepared to disagree with you, but I agree: I'd say there's a strong norm of not calling things RCE unless you can actually demonstrate RCE, or at least have a clean pathway to demonstrating it (e.g. a full write-what-where).

It's perfectly sufficient to have a CVE for just memory corruption, so the "RCE" framing here feels overstated. Particularly when an LLM should easily prove RCE out if it is in fact present.

I don't know the backstory here, but there's a long and colorful history of vendors and other parties guessing that some contrived memory corruption bug isn't exploitable and then being proven wrong, so the industry now more or less defaults to the assumption that it's exploitable.

Let me remind you that in response to the PHP bug, one of the front-page HN posts was a guy saying it's probably not exploitable and another offering Bitcoin to anyone who pops their server... with predictable results.

People can be pretty creative with exploitation primitives, and LLMs now replicate that at a scale. And yep, if you found a use-after-free that can be triggered remotely in PHP under some reasonable assumptions, you should probably treat it as a security bug.

If you can corrupt memory in a controllable way, you can get a computer to do just about anything that process has rights to. Possibly even the kernel, if you can get at some shared memory.

RedHat claims there's a working RCE:

> (...) public research has demonstrated a reliable exploit against a default-configured server with the mod_http2 module enabled. Successful exploitation allows an attacker to execute arbitrary commands, gain full control of the server process, and access or modify sensitive information.

https://access.redhat.com/security/cve/cve-2026-119618

Discovered independently by Anthropic (Oct 26) and Google (Nov 3), so I'm compelled to believe it: https://httpd.apache.org/security/vulnerabilities_24

But maybe someone will post another HN challenge like with the PHP thing?

Yes, this is slop, extruded from reading the patch and the official announcement, which is at https://httpd.apache.org/security/vulnerabilities_24.html#CV...

Well I know someone who will get bitten - a couple of years I did some work (because security said so) to make sure we always pulled latest Apache when building our Docker container. Someone ripped that change out not long ago because it was too hard to maintain the Debian repo config changes needed to pull it in, and as a result they'll probably get stung by having a version right in the meaty part of that range.

I'm guessing you missed out on Heartbleed too :P At work we managed to upgrade to a vulnerable version 1 month before that came out .... ugh

I run apache with prefork on my personal sites. Still works. No idea if it supports http/2.

I don't know, but Claude is fixing that too! (doubt that makes it safer either...)

The vulnerability affects deployments utilizing HTTP/2 capabilities

I don't know why your comment is dead, but I meant in general perching_aix , it's just what I noticed looking up this

You prefer to leave it insecure?

isn't http/1.1 request smuggling a known risk in exactly the scenario you're using it in?

NIST doens't show one (yet?). I checked on RedHat and they list it at a 9.8

How would Rust have fixed this security issue?

Cannot find the source... (Wanted to see if they use the RusTLS)

this looks vibecoded which is probably even worse

Not everything benefits from pipelineling and multiplexing. I wish there existed a protocol that's even simpler than HTTP 1.1, which would be good for exposing APIs. Something like Thrift, but maybe even simpler and more bulletproof.

Depending on the context and content, I tend to be against AI pull requests that haven’t been edited by a human.

AI finding vulns? I don’t see how it’s different from valgrind, static analysis, afl, or other fuzzer. I don’t think getting fresh, high-signal analysis is what AI-hating projects are concerned with.

> I want the rabidly AI-hating projects to stand their ground and refuse to fix vulnerabilities discovered with AI assistance.

Why?