Re:Critical RCE Vulnerability in Apache HTTP Server
by throooooo on Thursday November 12, 2026 @12:04AM
(#50463264)
I have a lot of Linux sysadmin experience but haven't touched Apache in more than a decade. I thought it's mostly nginx or other solutions at this point.
[ Parent
| on HN ]
Re:Critical RCE Vulnerability in Apache HTTP Server
by orev on Thursday November 12, 2026 @12:48AM
(#50463537)
At least 21% of web sites use Apache httpd, and of course many sites don’t report the software used at all. Nginx is also frequently used as a reverse proxy, with Apache used behind it.
Re:Critical RCE Vulnerability in Apache HTTP Server
by JodieBenitez on Thursday November 12, 2026 @12:50AM
(#50463546)
At work we use Apache because of mod_shib. We have yet to try nginx-http-shibboleth.
Re:Critical RCE Vulnerability in Apache HTTP Server
by dawnerd on Thursday November 12, 2026 @01:34AM
(#50463775)
Default Wordpress docker image uses it.
Re:Critical RCE Vulnerability in Apache HTTP Server
by nine_k on Thursday November 12, 2026 @01:41AM
(#50463814)
Apache has plenty of life left, it just works™, supports almost everything, and currently is about as efficient as nginx WRT connection handling. Sometimes you want what .htacces gives you. (No built-in Lua though.)
Re:Critical RCE Vulnerability in Apache HTTP Server
by iririririr on Thursday November 12, 2026 @02:53AM
(#50464257)
i mostly use nginx lua to patch on some feature i had even on bare Apache, let alone all the core modules.
Re:Critical RCE Vulnerability in Apache HTTP Server
by skeletal88 on Thursday November 12, 2026 @02:08AM
(#50463999)
Why would I not use apache if everything already works with it for me?
Re:Critical RCE Vulnerability in Apache HTTP Server
by load-bearing on Thursday November 12, 2026 @02:26AM
(#50464097)
Apache has mod_md -- an acme client, which lets you obtain https certificates as easily as on caddy, without integrating with awkward separate programs.
Re:Critical RCE Vulnerability in Apache HTTP Server
by tyho on Thursday November 12, 2026 @03:43AM
(#50464606)
nginx has that too https://blog.nginx.org/blog/native-support-for-acme-protocol
Re:Critical RCE Vulnerability in Apache HTTP Server
by nik282000 on Thursday November 12, 2026 @03:15AM
(#50464414)
My whole selfhosted mess is built around Apache. It was what I started with and I haven't run into any edge cases that it can't cover.
Re:Critical RCE Vulnerability in Apache HTTP Server
by tasuki on Thursday November 12, 2026 @05:46AM
(#50465455)
Exactly the same for me! I could switch to Nginx, it's one prompt away probably, but why?
Re:Critical RCE Vulnerability in Apache HTTP Server
by dizhn on Thursday November 12, 2026 @03:25AM
(#50464495)
I am the same way. I use Caddy if I can. But I have a lot of docker containers running apache and nginx. You probably might too.
Re:Critical RCE Vulnerability in Apache HTTP Server
by hannob on Thursday November 12, 2026 @03:43AM
(#50464601)
Apache has a feature that no other http server has replicated: .htaccess files.
They provide limited configurability of server functionality within a webroot. That's extremely convenient for PHP webapps. For many PHP apps, deploying them on anything that is not apache means touching the server config itself.
Re:Critical RCE Vulnerability in Apache HTTP Server
by system2 on Thursday November 12, 2026 @03:47AM
(#50464630)
PHP can go to hell. My hair is gray because of it. Nginx is superior, and I can get anything imaginable done with config files. And not to mention, it's much faster.
Re:Critical RCE Vulnerability in Apache HTTP Server
by ezst on Thursday November 12, 2026 @04:32AM
(#50464988)
The http servers drag race finished 15 years ago on a tie, it's really much a matter of taste and familiarity more than performance at this point.
Re:Critical RCE Vulnerability in Apache HTTP Server
by arcanemachiner on Thursday November 12, 2026 @05:11AM
(#50465237)
The lazy bastard in me prefers Caddy.
Re:Critical RCE Vulnerability in Apache HTTP Server
by theandrewbailey on Thursday November 12, 2026 @06:37AM
(#50465760)
I don't understand this. NGINX can run PHP. PHP is not exclusive to Apache.
Re:Critical RCE Vulnerability in Apache HTTP Server
by ransom1538 on Thursday November 12, 2026 @04:17AM
(#50464860)
Eh. You can use .htaccess in nginx too. I use that everyday.
Re:Critical RCE Vulnerability in Apache HTTP Server
by Alghranokk on Thursday November 12, 2026 @04:24AM
(#50464922)
Does not Microsoft's IIS also have that with web.config files?
Re:Critical RCE Vulnerability in Apache HTTP Server
by account42 on Thursday November 12, 2026 @05:28AM
(#50465350)
I would say that's actually a misfeature as it requires too many additional filesystem lookups to fulfil requests.
Modifying the web server config is a nonissue outside of shared hosting, which should have died out with the advent of VMs/containers.
Re:Critical RCE Vulnerability in Apache HTTP Server
by jagged-chisel on Thursday November 12, 2026 @06:13AM
(#50465623)
> … too many additional filesystem lookups …
Caching is a thing. Only dump the cache when a changed is noticed.
Re:Critical RCE Vulnerability in Apache HTTP Server
by canibalrex on Thursday November 12, 2026 @06:36AM
(#50465752)
And now you have 2 problems..
Re:Critical RCE Vulnerability in Apache HTTP Server
by cyphar on Thursday November 12, 2026 @05:53AM
(#50465489)
[delayed]
Re:Critical RCE Vulnerability in Apache HTTP Server
by anonreplier on Thursday November 12, 2026 @06:53AM
(#50465881)
Yes apache has a config file too amazingly enough, .htaccess is optional