I have a lot of Linux sysadmin experience but haven't touched Apache in more than a decade. I thought it's mostly nginx or other solutions at this point.
hannob 2 hours ago [-]
Apache has a feature that no other http server has replicated: .htaccess files.
They provide limited configurability of server functionality within a webroot. That's extremely convenient for PHP webapps. For many PHP apps, deploying them on anything that is not apache means touching the server config itself.
Alghranokk 56 minutes ago [-]
Does not Microsoft's IIS also have that with web.config files?
ransom1538 1 hours ago [-]
Eh. You can use .htaccess in nginx too. I use that everyday.
system2 2 hours ago [-]
PHP can go to hell. My hair is gray because of it. Nginx is superior, and I can get anything imaginable done with config files. And not to mention, it's much faster.
ezst 48 minutes ago [-]
The http servers drag race finished 15 years ago on a tie, it's really much a matter of taste and familiarity more than performance at this point.
arcanemachiner 9 minutes ago [-]
The lazy bastard in me prefers Caddy.
nine_k 4 hours ago [-]
Apache has plenty of life left, it just works™, supports almost everything, and currently is about as efficient as nginx WRT connection handling. Sometimes you want what .htacces gives you. (No built-in Lua though.)
iririririr 2 hours ago [-]
i mostly use nginx lua to patch on some feature i had even on bare Apache, let alone all the core modules.
orev 5 hours ago [-]
At least 21% of web sites use Apache httpd, and of course many sites don’t report the software used at all. Nginx is also frequently used as a reverse proxy, with Apache used behind it.
load-bearing 3 hours ago [-]
Apache has mod_md -- an acme client, which lets you obtain https certificates as easily as on caddy, without integrating with awkward separate programs.
I don't understand what they mean by "51% of cloud environments" have a publicly exposed instance. What is a "cloud environment"? Do they mean a cloud hosting provider like AWS or Google? Are they saying that between those two only one of them has an instance of a vulnerable Apache server running?
glawre 25 minutes ago [-]
I think they’re likely referring to either a Cloud Org (AWS Organisation, Google Cloud Org, Azure Tenant).
Wiz works by plugging their tool into your Cloud Org, so presumably they’re saying 51% of their enterprise-y customers have an exposed instance.
eptcyka 45 minutes ago [-]
What is the benefit of using Apache over enjinx?
LoganDark 32 minutes ago [-]
Apache is more opinionated, some people like that.
(I personally think it's slow and ugly, but to each their own)
z3ratul163071 3 hours ago [-]
what is amazing, there are no apache updated containers / packages available yet.
Why are these things being disclosed before fixes have been rolled out? Is no-one following disclosure protocols any more?
hypfer 3 hours ago [-]
At least disabling http2 is an easy countermeasure that will probably in most setups not have any real downsides.
If it was even enabled that is.
yunuserturk 3 hours ago [-]
LiteSpeed and OpenLiteSpeed affected by this?
jerrythegerbil 5 hours ago [-]
This took 7 minutes and $0.02 in deepseek spend through a subscription to reproduce. The prompt was simply directed at a vulnerable version and told to find a h2 race, which is generically the most common culprit these days. Once it found one, I had it attempt the same against a patched version (which failed).
Disabling h2 is the mitigation and is effective. The patch itself seems a little odd as a fix to me personally, but eh.
NitpickLawyer 5 hours ago [-]
Did it manage to produce a PoC for RCE? Apparently Redhat claimed there's a RCE, while Wiz said they don't have one.
lifeisloving 4 hours ago [-]
[dead]
EGreg 3 hours ago [-]
http2 race??
What exactly is the issue and does nginx have it
jaekwon 3 hours ago [-]
gno.security/repairer
cubefox 4 hours ago [-]
No CVSS severity level?
8-prime 2 hours ago [-]
NIST doens't show one (yet?). I checked on RedHat and they list it at a 9.8
cubefox 1 hours ago [-]
That's crazy high.
tgma 3 hours ago [-]
Time for a Rust based httpd replacement like https://xin.dev
hnarn 3 hours ago [-]
How would Rust have fixed this security issue?
Ukv 2 minutes ago [-]
> > a concurrent execution race condition within the assign_headers() function when handling shared resources [...] can corrupt heap memory to achieve arbitrary code execution (RCE)
To my understanding, in safe Rust to share between threads the compiler will require something like Arc<Mutex<...>> - which prevents unsynchronized access or freeing while another thread is still using it.
Xylakant 5 minutes ago [-]
One of the core claims of the language is data race safety because in safe rust, no memory location can be written by two or more owners at the same time. (see https://doc.rust-lang.org/nomicon/races.html for a more detailed discussion) Consequently, the kind of memory corruptions that this vulnerability seems to exploit are not possible in safe rust. Now, we don't know if a hypothetical rust-based apache implementation would have reached for unsafe in this context or done any other wild thing, but it's fair to assume that the likelihood of an exploitable RCE through memory corruption trends towards zero in programs written in Rust.
flossly 2 hours ago [-]
They've published an article last month on the Nginx vulnerabilities in light of their Rust implementation.
If you’re going to respond, at least make an attempt to answer the question.
flossly 2 hours ago [-]
Cannot find the source... (Wanted to see if they use the RusTLS)
kgeist 7 hours ago [-]
>Due to improper synchronization when executing concurrent threads sharing resources, an attacker can trigger heap corruption.
>As of the time of this blog’s publication, no exploit is available and there are no reports of exploitation in the wild.
Since when does "memory corruption" = "RCE"? Last week I found and reproduced a memory corruption (a use-after-free) in PHP's runtime after running an on-premise agent for just 30 minutes. There's nothing about it on the internet. Should I write a blog post about a scary new vulnerability? :)
woodruffw 7 hours ago [-]
I was prepared to disagree with you, but I agree: I'd say there's a strong norm of not calling things RCE unless you can actually demonstrate RCE, or at least have a clean pathway to demonstrating it (e.g. a full write-what-where).
It's perfectly sufficient to have a CVE for just memory corruption, so the "RCE" framing here feels overstated. Particularly when an LLM should easily prove RCE out if it is in fact present.
thephyber 1 hours ago [-]
Another comment says it has a CVSS score of 9.8 which means CVE, easy to exploit, and an exploit gives LOTS of access.
Before we get too whiny about "it's only memory corruption without any RCE PoC", let's wait until the CVE is unembargoed.
uptrails 3 hours ago [-]
I don't know the backstory here, but there's a long and colorful history of vendors and other parties guessing that some contrived memory corruption bug isn't exploitable and then being proven wrong, so the industry now more or less defaults to the assumption that it's exploitable.
Let me remind you that in response to the PHP bug, one of the front-page HN posts was a guy saying it's probably not exploitable and another offering Bitcoin to anyone who pops their server... with predictable results.
People can be pretty creative with exploitation primitives, and LLMs now replicate that at a scale. And yep, if you found a use-after-free that can be triggered remotely in PHP under some reasonable assumptions, you should probably treat it as a security bug.
fooqux 7 hours ago [-]
If you can corrupt memory in a controllable way, you can get a computer to do just about anything that process has rights to. Possibly even the kernel, if you can get at some shared memory.
kgeist 7 hours ago [-]
But it's not a given that memory corruption is exploitable as an RCE specifically. I thought to call something an RCE you need a working exploit?
stonogo 7 hours ago [-]
Presumably one of Anthropic, Google, or Apache possesses a working exploit, because the official Apache Foundation report on this CVE claims RCE is possible.
edoceo 7 hours ago [-]
Isn't resource consumption a DoS?
woodruffw 7 hours ago [-]
A denial of service is a different class of vulnerability (a minor one, generally).
perching_aix 7 hours ago [-]
RedHat claims there's a working RCE:
> (...) public research has demonstrated a reliable exploit against a default-configured server with the mod_http2 module enabled. Successful exploitation allows an attacker to execute arbitrary commands, gain full control of the server process, and access or modify sensitive information.
From 2.4.55 through 2.4.70? Jokes on you, my version is not that new!
jamesfinlayson 4 hours ago [-]
Well I know someone who will get bitten - a couple of years I did some work (because security said so) to make sure we always pulled latest Apache when building our Docker container. Someone ripped that change out not long ago because it was too hard to maintain the Debian repo config changes needed to pull it in, and as a result they'll probably get stung by having a version right in the meaty part of that range.
toast0 6 hours ago [-]
I'm guessing you missed out on Heartbleed too :P At work we managed to upgrade to a vulnerable version 1 month before that came out .... ugh
fulafel 5 hours ago [-]
The C chansaw juggling doesn't get any safer from adding threads. Is the robust original (pre)fork configuration still supported?
toast0 3 hours ago [-]
I run apache with prefork on my personal sites. Still works. No idea if it supports http/2.
fock 4 hours ago [-]
I don't know, but Claude is fixing that too! (doubt that makes it safer either...)
haradion 3 hours ago [-]
This has not been a good month for the LAMP stack…
superkuh 7 hours ago [-]
It's not always HTTP/2. But it's a pretty safe bet.
userbinator 7 hours ago [-]
The vulnerability affects deployments utilizing HTTP/2 capabilities
g-b-r 6 hours ago [-]
Even Apache is being filled with Claude commits, so great.....
g-b-r 5 hours ago [-]
I don't know why your comment is dead, but I meant in general perching_aix , it's just what I noticed looking up this
pixel_popping 5 hours ago [-]
You prefer to leave it insecure?
g-b-r 5 hours ago [-]
It was a comment unrelated to this vulnerability
perching_aix 6 hours ago [-]
[dead]
TZubiri 6 hours ago [-]
all my handwritten sockets servers are fine because I use HTTP/1.1
I have 1 apache acting as a proxy for vhosts and
> a2dismod http2
gives me
> Module http2 already disabled
I don’t want to tempt fate (and hackers ) but I have dodged lots of major vulns this year with my strategy of writing code by hand instead of pip installing everything
only vuln I was exposed to was copy.fail, but that was a defense in depth weakness, and I was vulnerable to the kvm weakness if there was a malicious tenant in my host’s hypervisor, but that’s not fair I’m poor so I don’t have a dedi.
maybe the tcp vuln was the most exposed I’ve been but that was a very short window that got auto upgraded by apt with a high attack complexity
maybe I can write about how I survived 2026 without getting a supply chain vuln and get some work or students on new years? I feel that’ll be a pretty big accolade.
perching_aix 6 hours ago [-]
isn't http/1.1 request smuggling a known risk in exactly the scenario you're using it in?
hypfer 3 hours ago [-]
If I understand correctly that only affects reverse proxy chains, which people might just not have. Or not have in a way that is vulnerable to that?
I guess it makes sense that "the cloud" moves to it, but beyond that, it might be fine?
tancop 5 hours ago [-]
HTTP2 is insecure and 1.1 is slow. At this point just find a good H3 implementation and drop the old protocols.
nine_k 4 hours ago [-]
Not everything benefits from pipelineling and multiplexing. I wish there existed a protocol that's even simpler than HTTP 1.1, which would be good for exposing APIs. Something like Thrift, but maybe even simpler and more bulletproof.
krembo 3 hours ago [-]
Wiz is such an amazing company. Israeli-based and recently acquired by Google, the significance of their security contributions cannot be overstated.
lakeviewterrace 7 hours ago [-]
Another critical bug discovered by AI.
I want the rabidly AI-hating projects to stand their ground and refuse to fix vulnerabilities discovered with AI assistance.
jonhohle 6 hours ago [-]
Depending on the context and content, I tend to be against AI pull requests that haven’t been edited by a human.
AI finding vulns? I don’t see how it’s different from valgrind, static analysis, afl, or other fuzzer. I don’t think getting fresh, high-signal analysis is what AI-hating projects are concerned with.
yjftsjthsd-h 4 hours ago [-]
Depends on exactly what it is that a project is objecting to. For example, here's Nura:
> AI tools have several ethical issues. They require an unreasonable amount of energy[1] and water[2] to build and operate, their models are built in part with heavily exploited workers in unacceptable working conditions[3], usually without consent from or compensation for creators of the source material[4] and oftentimes causing DDoS attacks against FOSS infrastructure in the process[5] (which in turn force the deployment of challenge-based protections and increase cost and complexity of self-hosting for everybody[6]). Furthermore, they are being used to undermine labor and justify layoffs[7]. These are harms that we do not want to perpetuate, even if only indirectly.
If you really believe that AI tools are automatically unethical because they destroy the environment, harm workers, and constitute an attack on FOSS infrastructure, then it doesn't really matter how the tool is being used. If you just don't want to see code quality decline, then it's probably not a problem.
jamesfinlayson 4 hours ago [-]
> Depending on the context and content, I tend to be against AI pull requests that haven’t been edited by a human.
I've seen on a few open source projects I follow the 100% AI patch with notes to the effect of "I haven't compiled let alone tested these changes but AI said it's fine and my cursory glance agrees".
Like come on - I'm not going to judge using AI to make a useful change, but at least put in more than zero effort.
JodieBenitez 4 hours ago [-]
cough Zig... cough
> No LLMs for finding bugs.
nozzlegear 7 hours ago [-]
> I want the rabidly AI-hating projects to stand their ground and refuse to fix vulnerabilities discovered with AI assistance.
Why?
patchtopic 3 hours ago [-]
because it's just some slop generated by a bunch of stochastic parrots and can't be taken seriously :-)
perching_aix 5 hours ago [-]
same reason i'd imagine that one might have wanted medical assistance be denied to covid deniers who inevitably did contract covid, and started experiencing the FO part of FAFO: retribution and consistency
6 hours ago [-]
lakt42t 6 hours ago [-]
[dead]
Rendered at 10:20:37 GMT+0000 (Coordinated Universal Time) with Vercel.
They provide limited configurability of server functionality within a webroot. That's extremely convenient for PHP webapps. For many PHP apps, deploying them on anything that is not apache means touching the server config itself.
https://httpd.apache.org/docs/trunk/mod/mod_md.html
https://httpd.apache.org/docs/current/mpm.html#defaults
> CVE-2026-119618 is a critical, high-severity vulnerability involving....
two CVEs? (111497 != 11968)
Wiz works by plugging their tool into your Cloud Org, so presumably they’re saying 51% of their enterprise-y customers have an exposed instance.
(I personally think it's slow and ugly, but to each their own)
If it was even enabled that is.
Disabling h2 is the mitigation and is effective. The patch itself seems a little odd as a fix to me personally, but eh.
What exactly is the issue and does nginx have it
To my understanding, in safe Rust to share between threads the compiler will require something like Arc<Mutex<...>> - which prevents unsynchronized access or freeing while another thread is still using it.
https://xin.dev/blog/multiple-nginx-vulnerabilities/
>As of the time of this blog’s publication, no exploit is available and there are no reports of exploitation in the wild.
Since when does "memory corruption" = "RCE"? Last week I found and reproduced a memory corruption (a use-after-free) in PHP's runtime after running an on-premise agent for just 30 minutes. There's nothing about it on the internet. Should I write a blog post about a scary new vulnerability? :)
It's perfectly sufficient to have a CVE for just memory corruption, so the "RCE" framing here feels overstated. Particularly when an LLM should easily prove RCE out if it is in fact present.
Before we get too whiny about "it's only memory corruption without any RCE PoC", let's wait until the CVE is unembargoed.
Let me remind you that in response to the PHP bug, one of the front-page HN posts was a guy saying it's probably not exploitable and another offering Bitcoin to anyone who pops their server... with predictable results.
People can be pretty creative with exploitation primitives, and LLMs now replicate that at a scale. And yep, if you found a use-after-free that can be triggered remotely in PHP under some reasonable assumptions, you should probably treat it as a security bug.
> (...) public research has demonstrated a reliable exploit against a default-configured server with the mod_http2 module enabled. Successful exploitation allows an attacker to execute arbitrary commands, gain full control of the server process, and access or modify sensitive information.
https://access.redhat.com/security/cve/cve-2026-119618
Discovered independently by Anthropic (Oct 26) and Google (Nov 3), so I'm compelled to believe it: https://httpd.apache.org/security/vulnerabilities_24
But maybe someone will post another HN challenge like with the PHP thing?
Is that just crappy LLM generated copy that is assuming that GitHub the company is responsible for that module because it’s hosted there?
I have 1 apache acting as a proxy for vhosts and
> a2dismod http2
gives me
> Module http2 already disabled
I don’t want to tempt fate (and hackers ) but I have dodged lots of major vulns this year with my strategy of writing code by hand instead of pip installing everything
only vuln I was exposed to was copy.fail, but that was a defense in depth weakness, and I was vulnerable to the kvm weakness if there was a malicious tenant in my host’s hypervisor, but that’s not fair I’m poor so I don’t have a dedi.
maybe the tcp vuln was the most exposed I’ve been but that was a very short window that got auto upgraded by apt with a high attack complexity
maybe I can write about how I survived 2026 without getting a supply chain vuln and get some work or students on new years? I feel that’ll be a pretty big accolade.
I guess it makes sense that "the cloud" moves to it, but beyond that, it might be fine?
I want the rabidly AI-hating projects to stand their ground and refuse to fix vulnerabilities discovered with AI assistance.
AI finding vulns? I don’t see how it’s different from valgrind, static analysis, afl, or other fuzzer. I don’t think getting fresh, high-signal analysis is what AI-hating projects are concerned with.
> AI tools have several ethical issues. They require an unreasonable amount of energy[1] and water[2] to build and operate, their models are built in part with heavily exploited workers in unacceptable working conditions[3], usually without consent from or compensation for creators of the source material[4] and oftentimes causing DDoS attacks against FOSS infrastructure in the process[5] (which in turn force the deployment of challenge-based protections and increase cost and complexity of self-hosting for everybody[6]). Furthermore, they are being used to undermine labor and justify layoffs[7]. These are harms that we do not want to perpetuate, even if only indirectly.
( https://docs.nura.eco/policies-and-processes/development/ai-... )
If you really believe that AI tools are automatically unethical because they destroy the environment, harm workers, and constitute an attack on FOSS infrastructure, then it doesn't really matter how the tool is being used. If you just don't want to see code quality decline, then it's probably not a problem.
I've seen on a few open source projects I follow the 100% AI patch with notes to the effect of "I haven't compiled let alone tested these changes but AI said it's fine and my cursory glance agrees".
Like come on - I'm not going to judge using AI to make a useful change, but at least put in more than zero effort.
> No LLMs for finding bugs.
Why?