Re:Critical RCE Vulnerability in Apache HTTP Server
by perching_aix on Wednesday November 11, 2026 @11:17PM
(#50463022)
[delayed]
Re:Critical RCE Vulnerability in Apache HTTP Server
by hypfer on Thursday November 12, 2026 @01:51AM
(#50463892)
If I understand correctly that only affects reverse proxy chains, which people might just not have. Or not have in a way that is vulnerable to that?
I guess it makes sense that "the cloud" moves to it, but beyond that, it might be fine?
I have 1 apache acting as a proxy for vhosts and
> a2dismod http2
gives me
> Module http2 already disabled
I don’t want to tempt fate (and hackers ) but I have dodged lots of major vulns this year with my strategy of writing code by hand instead of pip installing everything
only vuln I was exposed to was copy.fail, but that was a defense in depth weakness, and I was vulnerable to the kvm weakness if there was a malicious tenant in my host’s hypervisor, but that’s not fair I’m poor so I don’t have a dedi.
maybe the tcp vuln was the most exposed I’ve been but that was a very short window that got auto upgraded by apt with a high attack complexity
maybe I can write about how I survived 2026 without getting a supply chain vuln and get some work or students on new years? I feel that’ll be a pretty big accolade.