Patch looks like <a href="https://github.com/apache/httpd/commit/5ed39287660daacd1233cb9bbc984b25fa9a4fe3" rel="nofollow">https://github.com/apache/httpd/commit/5ed39287660daacd1233c...</a>
For anyone temporarily shutting off an Apache httpd, there's one step that's sometimes missed: a cron job or systemd timer for certbot. This can restart httpd and leave it running. In other words, in some common uses of Let's Encrypt, standard instructions such as "systemctl disable --now apache2" aren't sufficient to keep httpd off.
Shutting down Apache is perhaps overcautious? Simply doing `sudo a2dismod http2` and then restarting Apache should be enough as far as I can tell
When using systemd, "systemctl mask apache2" can make sure that it's impossible for the unit to be started again (remove the mask with systemctl unmask once you've applied the patch).
I would suggest instead blocking 80 and 443 on UDP and TCP, via your firewall.
If I need to make sure apache doesn't restart I often type "syntax error" on the first line of httpd.conf
I have a lot of Linux sysadmin experience but haven't touched Apache in more than a decade. I thought it's mostly nginx or other solutions at this point.
> <i>I thought it's mostly nginx or other solutions at this point.</i><p>What advantage(s) does nginx have over Apache?<p>Back in the day (Apache 2.0) there was certainly a performance with nginx being event-driver, but with Apache 2.4 and mpm_event, does that still apply?<p>* <a href="https://httpd.apache.org/docs/2.4/mod/event.html" rel="nofollow">https://httpd.apache.org/docs/2.4/mod/event.html</a>
Apache has a feature that no other http server has replicated: .htaccess files.<p>They provide limited configurability of server functionality within a webroot. That's extremely convenient for PHP webapps. For many PHP apps, deploying them on anything that is not apache means touching the server config itself.
I would say that's actually a misfeature as it requires too many additional filesystem lookups to fulfil requests.<p>Modifying the web server config is a nonissue outside of shared hosting, which should have died out with the advent of VMs/containers.
> <i>I would say that's actually a misfeature as it requires too many additional filesystem lookups to fulfil requests.</i><p>Its use is optional: set "AllowOverride None" (the default) and it's disabled.<p>* <a href="https://httpd.apache.org/docs/2.4/mod/core.html#allowoverride" rel="nofollow">https://httpd.apache.org/docs/2.4/mod/core.html#allowoverrid...</a>
> … too many additional filesystem lookups …<p>Caching is a thing. Only dump the cache when a changed is noticed.
Why shared hosting should die? It's still the cheapest way to publish a dynamic website.
Does not Microsoft's IIS also have that with web.config files?
> Apache has a feature that no other http server has replicated: .htaccess files.<p>That can expose your files for such a trivial reason as different end of line sequence than what it expects. Instead of shutting down the access, it just happily ignores .htaccess and enables DirectoryIndex.<p>This is the software that's responsible for majority of data leaks in the world.<p>Stop using it.
Eh. You can use .htaccess in nginx too. I use that everyday.
Ah yes, htaccess. Another lovely source of security bugs for the past 30 years and may it continue to bear skiddie fruit for another 300.<p>Its model is fundamentally flawed precisely because it was based on the fundamentally flawed PHP model (website assets and code are stored and hosted from the same webroot). This allowed for shared hosting to exist but containers and reverse proxies are a <i>far</i> better way of organising such sites today.<p>The fact that in other webservers the server's configuration is configured through its configuration file and not the content of its webroot <i>is a feature</i>.
PHP can go to hell. My hair is gray because of it. Nginx is superior, and I can get anything imaginable done with config files. And not to mention, it's much faster.
The http servers drag race finished 15 years ago on a tie, it's really much a matter of taste and familiarity more than performance at this point.
I don't understand this. NGINX can run PHP. PHP is not exclusive to Apache.
In general, the Apache php mod has had less drama than php-fpm over the years. Also, casting each domain under specific isolated itk server user(s) account(s) adds a layer of containment, where Nginx processes must run under a single user context.<p>Nginx uses way less memory in most use-cases (1/4 to 1/10), but with dynamic content like php it is only slightly better (maybe 15% if lucky). Also, setting up websocket proxy in Nginx is still a bit of a bodge.<p>Each server type has its own trade offs, and a list of known mitigations the uninitiated must learn. If you have a single domain high-traffic site with static media files, than Nginx is probably going to matter more. =3
Apache has plenty of life left, it just works™, supports almost everything, and currently is about as efficient as nginx WRT connection handling. Sometimes you want what .htacces gives you. (No built-in Lua though.)
> <i>(No built-in Lua though.)</i><p>* <a href="https://httpd.apache.org/docs/2.4/mod/mod_lua.html" rel="nofollow">https://httpd.apache.org/docs/2.4/mod/mod_lua.html</a><p>?
i mostly use nginx lua to patch on some feature i had even on bare Apache, let alone all the core modules.
> (No built-in Lua though.)<p>I thought mod_lua was an official module. I've just checked with Debian stable, and their "apache2-bin" package depends on liblua5.<p>> Apache has plenty of life left<p>I would expect a project with "plenty of life left" to support HTTP3. And to use Git (or some modern DVCS) instead of Subversion.<p>BTW, a co-worker has to maintain an Apache server because its shibboleth mod is mandatory for that project, and he often complains about it, and so do I when they ask for help. Performance is worse than nginx, configuration is awful, documentation is uneven, some features (like .htaccess) are dangerous, etc.<p>Apache http is the only project that I know that still uses Subversion. They have published a Git clone on Github, but their main source is still svn. It's a bit worrying, because they won't attract new developers with that technical stack. Last I checked, the 2.5 branch looked dead, and the dev-list was barely active.
At least 21% of web sites use Apache httpd, and of course many sites don’t report the software used at all. Nginx is also frequently used as a reverse proxy, with Apache used behind it.
My whole selfhosted mess is built around Apache. It was what I started with and I haven't run into any edge cases that it can't cover.
Why would I not use apache if everything already works with it for me?
Apache has mod_md -- an acme client, which lets you obtain https certificates as easily as on caddy, without integrating with awkward separate programs.<p><a href="https://httpd.apache.org/docs/trunk/mod/mod_md.html" rel="nofollow">https://httpd.apache.org/docs/trunk/mod/mod_md.html</a>
At work we use Apache because of mod_shib. We have yet to try nginx-http-shibboleth.
Default Wordpress docker image uses it.
I am the same way. I use Caddy if I can. But I have a lot of docker containers running apache and nginx. You probably might too.
Appears to be the first issue ranked 'critical' since 2021. <a href="https://httpd.apache.org/security/vulnerabilities_24.html" rel="nofollow">https://httpd.apache.org/security/vulnerabilities_24.html</a>
> in Apache HTTP Server’s HTTP/2 module (mod_http2)<p>I feel like in hindsight, HTTP/2 was a mistake. The theoretical benefits just don't justify the added complexity. It definitely shouldn't have been fasttracked like it was.
But if you have more then one httpd server - eg. some fcgi - then HTTP/1.1 is almost architectural backdor: HTTP Request Smuggling, at minimum.<p>Apache even don't have it's own HTTP/2: mod_http2 use external library nghttp2[.org] so Apache is dead shell at this point.
Where do you live? I'm hundreds of milliseconds away from all major datacenters, http2 adoption has been incredible at reducing web latency to tolerable levels. Much less staring at empty or half loaded pages.
I don't think it was fast tracked.
Was it?
I heard the rational to do HTTP 2 and soon later HTTP 3 was to split improvements and ease transition.
Agreed. Too much complexity for too little gain for too narrow use cases. HTTP/1.1 will outlive HTTP/2.
> What is CVE-2026-111497?<p>> CVE-2026-119618 is a critical, high-severity vulnerability involving....<p>two CVEs? (111497 != 11968)
Chances are most Apache/PHP installations run mpm_prefork and aren’t affected by this.
I don't understand what they mean by "51% of cloud environments" have a publicly exposed instance. What is a "cloud environment"? Do they mean a cloud hosting provider like AWS or Google? Are they saying that between those two only one of them has an instance of a vulnerable Apache server running?
My <i>guess</i> is that they are collecting stats on running HTTP daemon software and thus they estimate that 64% of "cloud accounts" have Apache somewhere, and 51% of the total are publicly exposed instances (not on VPCs and such).<p>As they make a note that this does not account for configuration, so if you've got the http2 module disabled, it sounds like you are protected — though they only recommend hard-coding the protocol version to 1.1 instead of disabling the module (I've got the module disabled as that was the default when I set up my homelab server, for instance).
I think they’re likely referring to either a Cloud Org (AWS Organisation, Google Cloud Org, Azure Tenant).<p>Wiz works by plugging their tool into your Cloud Org, so presumably they’re saying 51% of their enterprise-y customers have an exposed instance.
duplicate of <a href="https://news.ycombinator.com/item?id=50453368">https://news.ycombinator.com/item?id=50453368</a>
what is amazing, there are no apache updated containers / packages available yet.
Debian has been patched just now and updates available : apache2 2.4.71-1~deb13u1
Why are these things being disclosed before fixes have been rolled out? Is no-one following disclosure protocols any more?
Full disclosure has always been an option.<p>1. Don't disclose, ignore vuln.
2. Disclose to highest bidder, even criminals or state agencies.
3. Disclose to vendor, no follow up.
4. Disclose to vendor, release to public after a set delay.
5. Disclose to public.<p>4 & 5 are "responsible disclosure". 4 is also "coordinated disclosure". The other options ignore the ethical duty engineers have to the public.
At least wrt the linux kernel, Greg kh explained that there's no point in delayed disclosures anymore, one LLM reporting a bug is often followed by several more reporting the same bug on the same day. So you can assume it's public knowledge by the time it's reported.
Debian tracker: <a href="https://security-tracker.debian.org/tracker/CVE-2026-119618" rel="nofollow">https://security-tracker.debian.org/tracker/CVE-2026-119618</a> - hopefully the fix lands soon
At least disabling http2 is an easy countermeasure that will probably in most setups not have any real downsides.<p>If it was even enabled that is.
everybody new Vulnerability makes me think how we are not so good a writing secure code?.
Nobody ever was. The big argument against needing safer languages was basically "but if you're an expert at C/C++/whatever, your code is pretty much safe". And these are usually the people who don't run extensive fuzzing and test suites.
We knew we weren't, deep down. Some people did better than others at writing more secure of course. It was just about good enough in a world where – compared to today – it took much more time, skill and effort to find bad bugs.<p>The mistake is to think that the 'magical' LLMs don't write buggy code and that there isn't some tradeoff in using them. There are always tradeoffs in engineering.<p><i>later</i><p>And, security is always relative to the adversary and landscape, which has massively changed recently.
it is also quite difficult to make a house safe if there are millions of people willing to breach it.<p>The offender side evolved, the defender needs to evolve too and that will be very, very expensive but much cheaper than not fixing the problems.
What is the benefit of using Apache over enjinx?
This took 7 minutes and $0.02 in deepseek spend through a subscription to reproduce. The prompt was simply directed at a vulnerable version and told to find a h2 race, which is generically the most common culprit these days. Once it found one, I had it attempt the same against a patched version (which failed).<p>Disabling h2 is the mitigation and is effective. The patch itself seems a little odd as a fix to me personally, but eh.
Did it manage to produce a PoC for RCE? Apparently Redhat claimed there's a RCE, while Wiz said they don't have one.
http2 race??<p>What exactly is the issue and does nginx have it
LiteSpeed and OpenLiteSpeed affected by this?
gno.security/repairer
No CVSS severity level?
>Due to improper synchronization when executing concurrent threads sharing resources, an attacker can trigger heap corruption.<p>>As of the time of this blog’s publication, no exploit is available and there are no reports of exploitation in the wild.<p>Since when does "memory corruption" = "RCE"? Last week I found and reproduced a memory corruption (a use-after-free) in PHP's runtime after running an on-premise agent for just 30 minutes. There's nothing about it on the internet. Should I write a blog post about a scary new vulnerability? :)
I was prepared to disagree with you, but I agree: I'd say there's a strong norm of not calling things RCE unless you can <i>actually</i> demonstrate RCE, or at least have a clean pathway to demonstrating it (e.g. a full write-what-where).<p>It's perfectly sufficient to have a CVE for just memory corruption, so the "RCE" framing here feels overstated. Particularly when an LLM <i>should</i> easily prove RCE out if it is in fact present.
Another comment says it has a CVSS score of 9.8 which means CVE, easy to exploit, and an exploit gives LOTS of access.<p>Before we get too whiny about "it's only memory corruption without any RCE PoC", let's wait until the CVE is unembargoed.
I don't know the backstory here, but there's a long and colorful history of vendors and other parties guessing that some contrived memory corruption bug isn't exploitable and then being proven wrong, so the industry now more or less defaults to the assumption that it's exploitable.<p>Let me remind you that in response to the PHP bug, one of the front-page HN posts was a guy saying it's probably not exploitable and another offering Bitcoin to anyone who pops their server... with predictable results.<p>People can be pretty creative with exploitation primitives, and LLMs now replicate that at a scale. And yep, if you found a use-after-free that can be triggered remotely in PHP under some reasonable assumptions, you should probably treat it as a security bug.
If you can corrupt memory in a controllable way, you can get a computer to do just about anything that process has rights to. Possibly even the kernel, if you can get at some shared memory.
RedHat claims there's a working RCE:<p>> (...) public research has demonstrated a reliable exploit against a default-configured server with the mod_http2 module enabled. Successful exploitation allows an attacker to execute arbitrary commands, gain full control of the server process, and access or modify sensitive information.<p><a href="https://access.redhat.com/security/cve/cve-2026-119618" rel="nofollow">https://access.redhat.com/security/cve/cve-2026-119618</a><p>Discovered independently by Anthropic (Oct 26) and Google (Nov 3), so I'm compelled to believe it: <a href="https://httpd.apache.org/security/vulnerabilities_24" rel="nofollow">https://httpd.apache.org/security/vulnerabilities_24</a><p>But maybe someone will post another HN challenge like with the PHP thing?
Why does it say the “vendor” for this is GitHub (for mod_h2)?<p>Is that just crappy LLM generated copy that is assuming that GitHub the company is responsible for that module because it’s hosted there?
Yes, this is slop, extruded from reading the patch and the official announcement, which is at <a href="https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-119618" rel="nofollow">https://httpd.apache.org/security/vulnerabilities_24.html#CV...</a>
[dead]
From 2.4.55 through 2.4.70? Jokes on you, my version is not that new!
Well I know someone who will get bitten - a couple of years I did some work (because security said so) to make sure we always pulled latest Apache when building our Docker container. Someone ripped that change out not long ago because it was too hard to maintain the Debian repo config changes needed to pull it in, and as a result they'll probably get stung by having a version right in the meaty part of that range.
I'm guessing you missed out on Heartbleed too :P At work we managed to upgrade to a vulnerable version 1 month before that came out .... ugh
The C chansaw juggling doesn't get any safer from adding threads. Is the robust original (pre)fork configuration still supported?
I run apache with prefork on my personal sites. Still works. No idea if it supports http/2.
I don't know, but Claude is fixing that too! (doubt that makes it safer either...)
This has not been a good month for the LAMP stack…
It's not always HTTP/2. But it's a pretty safe bet.
Even Apache is being filled with Claude commits, so great.....
I don't know why your comment is dead, but I meant in general perching_aix , it's just what I noticed looking up this
[dead]
You prefer to leave it insecure?
all my handwritten sockets servers are fine because I use HTTP/1.1<p>I have 1 apache acting as a proxy for vhosts and<p>> a2dismod http2<p>gives me<p>> Module http2 already disabled<p>I don’t want to tempt fate (and hackers ) but I have dodged lots of major vulns this year with my strategy of writing code by hand instead of pip installing everything<p>only vuln I was exposed to was copy.fail, but that was a defense in depth weakness, and I was vulnerable to the kvm weakness if there was a malicious tenant in my host’s hypervisor, but that’s not fair I’m poor so I don’t have a dedi.<p>maybe the tcp vuln was the most exposed I’ve been but that was a very short window that got auto upgraded by apt with a high attack complexity<p>maybe I can write about how I survived 2026 without getting a supply chain vuln and get some work or students on new years? I feel that’ll be a pretty big accolade.
[flagged]
[flagged]
[flagged]
Time for a Rust based httpd replacement like <a href="https://xin.dev" rel="nofollow">https://xin.dev</a>
How would Rust have fixed this security issue?
One of the core claims of the language is data race safety because in safe rust, no memory location can be written by two or more owners at the same time. (see <a href="https://doc.rust-lang.org/nomicon/races.html" rel="nofollow">https://doc.rust-lang.org/nomicon/races.html</a> for a more detailed discussion) Consequently, the kind of memory corruptions that this vulnerability seems to exploit are not possible in safe rust. Now, we don't know if a hypothetical rust-based apache implementation would have reached for unsafe in this context or done any other wild thing, but it's fair to assume that the likelihood of an exploitable RCE through memory corruption trends towards zero in programs written in Rust.
> > a concurrent execution race condition within the assign_headers() function when handling shared resources [...] can corrupt heap memory to achieve arbitrary code execution (RCE)<p>To my understanding, in safe Rust to share between threads the compiler will require something like Arc<Mutex<...>> - which prevents unsynchronized access or freeing while another thread is still using it.
The details I've seen are too sparse to say with certainty, but it seems like the issue is concurrent access to the same value through a pointer.<p>In particular it's `req` in the function with this signature:<p><pre><code> static void assign_headers(request_rec *r, const h2_request *req,
int no_body, int is_connect)
</code></pre>
The fix being:<p><pre><code> - apr_table_setn(req->headers, "Content-Length", "0");
+ apr_table_setn(r->headers_in, "Content-Length", "0");
</code></pre>
My read on this is that `req` is meant to be a readonly value in this function, which is why it's marked `const`. And being readonly, it would be safe to access concurrently. However, someone accidentally wrote through this pointer.<p>In Rust this would've been `req: &h2_request` and the accidental write wouldn't have been possible (barring interior mutability). Even with interior mutability there is no thread interleaving during the write, which happens through a `&mut h2_request` probably obtained through a lock.
They've published an article last month on the Nginx vulnerabilities in light of their Rust implementation.<p><a href="https://xin.dev/blog/multiple-nginx-vulnerabilities/" rel="nofollow">https://xin.dev/blog/multiple-nginx-vulnerabilities/</a>
Cannot find the source... (Wanted to see if they use the RusTLS)
this looks vibecoded which is probably even worse
HTTP2 is insecure and 1.1 is slow. At this point just find a good H3 implementation and drop the old protocols.
Not everything benefits from pipelineling and multiplexing. I wish there existed a protocol that's even simpler than HTTP 1.1, which would be good for exposing APIs. Something like Thrift, but maybe even simpler and more bulletproof.
I'd argue that HTTP 1.1 is <i>simpler</i> than Thrift (especially if you include the serialization formats), but more <i>underspecified</i>. The underspecified-ness is where the complexity in handling HTTP 1.1 in correct and secure ways comes from.
Well there's HTTP/0.9. Can't get much simpler than that.
Wiz is such an amazing company. Israeli-based and recently acquired by Google, the significance of their security contributions cannot be overstated.
Another critical bug discovered by AI.<p>I want the rabidly AI-hating projects to stand their ground and refuse to fix vulnerabilities discovered with AI assistance.
Depending on the context and content, I tend to be against AI pull requests that haven’t been edited by a human.<p>AI finding vulns? I don’t see how it’s different from valgrind, static analysis, afl, or other fuzzer. I don’t think getting fresh, high-signal analysis is what AI-hating projects are concerned with.
Depends on exactly what it is that a project is objecting to. For example, here's Nura:<p>> AI tools have several ethical issues. They require an unreasonable amount of energy[1] and water[2] to build and operate, their models are built in part with heavily exploited workers in unacceptable working conditions[3], usually without consent from or compensation for creators of the source material[4] and oftentimes causing DDoS attacks against FOSS infrastructure in the process[5] (which in turn force the deployment of challenge-based protections and increase cost and complexity of self-hosting for everybody[6]). Furthermore, they are being used to undermine labor and justify layoffs[7]. These are harms that we do not want to perpetuate, even if only indirectly.<p>( <a href="https://docs.nura.eco/policies-and-processes/development/ai-policy.html" rel="nofollow">https://docs.nura.eco/policies-and-processes/development/ai-...</a> )<p>If you really believe that AI tools are automatically unethical because they destroy the environment, harm workers, and constitute an attack on FOSS infrastructure, then it doesn't really matter <i>how</i> the tool is being used. If you just don't want to see code quality decline, then it's probably not a problem.
> Depending on the context and content, I tend to be against AI pull requests that haven’t been edited by a human.<p>I've seen on a few open source projects I follow the 100% AI patch with notes to the effect of "I haven't compiled let alone tested these changes but AI said it's fine and my cursory glance agrees".<p>Like come on - I'm not going to judge using AI to make a useful change, but at least put in more than zero effort.
<i>cough</i> Zig... <i>cough</i><p>> No LLMs for finding bugs.
> <i>I want the rabidly AI-hating projects to stand their ground and refuse to fix vulnerabilities discovered with AI assistance.</i><p>Why?
because it's just some slop generated by a bunch of stochastic parrots and can't be taken seriously :-)
same reason i'd imagine that one might have wanted medical assistance be denied to covid deniers who inevitably did contract covid, and started experiencing the FO part of FAFO: retribution and consistency
[dead]