News for hackers. Stuff that matters.
Re:Critical RCE Vulnerability in Apache HTTP Server by throooooo on Thursday November 12, 2026 @12:04AM (#50463264)
I have a lot of Linux sysadmin experience but haven't touched Apache in more than a decade. I thought it's mostly nginx or other solutions at this point.
Re:Critical RCE Vulnerability in Apache HTTP Server by orev on Thursday November 12, 2026 @12:48AM (#50463537)
At least 21% of web sites use Apache httpd, and of course many sites don’t report the software used at all. Nginx is also frequently used as a reverse proxy, with Apache used behind it.
Re:Critical RCE Vulnerability in Apache HTTP Server by JodieBenitez on Thursday November 12, 2026 @12:50AM (#50463546)
At work we use Apache because of mod_shib. We have yet to try nginx-http-shibboleth.
Re:Critical RCE Vulnerability in Apache HTTP Server by dawnerd on Thursday November 12, 2026 @01:34AM (#50463775)
Default Wordpress docker image uses it.
Re:Critical RCE Vulnerability in Apache HTTP Server by nine_k on Thursday November 12, 2026 @01:41AM (#50463814)
Apache has plenty of life left, it just works™, supports almost everything, and currently is about as efficient as nginx WRT connection handling. Sometimes you want what .htacces gives you. (No built-in Lua though.)
Re:Critical RCE Vulnerability in Apache HTTP Server by iririririr on Thursday November 12, 2026 @02:53AM (#50464257)
i mostly use nginx lua to patch on some feature i had even on bare Apache, let alone all the core modules.
Re:Critical RCE Vulnerability in Apache HTTP Server by skeletal88 on Thursday November 12, 2026 @02:08AM (#50463999)
Why would I not use apache if everything already works with it for me?
Re:Critical RCE Vulnerability in Apache HTTP Server by load-bearing on Thursday November 12, 2026 @02:26AM (#50464097)
Apache has mod_md -- an acme client, which lets you obtain https certificates as easily as on caddy, without integrating with awkward separate programs.

https://httpd.apache.org/docs/trunk/mod/mod_md.html

Re:Critical RCE Vulnerability in Apache HTTP Server by tyho on Thursday November 12, 2026 @03:43AM (#50464606)
Re:Critical RCE Vulnerability in Apache HTTP Server by nik282000 on Thursday November 12, 2026 @03:15AM (#50464414)
My whole selfhosted mess is built around Apache. It was what I started with and I haven't run into any edge cases that it can't cover.
Re:Critical RCE Vulnerability in Apache HTTP Server by tasuki on Thursday November 12, 2026 @05:46AM (#50465455)
Exactly the same for me! I could switch to Nginx, it's one prompt away probably, but why?
Re:Critical RCE Vulnerability in Apache HTTP Server by dizhn on Thursday November 12, 2026 @03:25AM (#50464495)
I am the same way. I use Caddy if I can. But I have a lot of docker containers running apache and nginx. You probably might too.
Re:Critical RCE Vulnerability in Apache HTTP Server by hannob on Thursday November 12, 2026 @03:43AM (#50464601)
Apache has a feature that no other http server has replicated: .htaccess files.

They provide limited configurability of server functionality within a webroot. That's extremely convenient for PHP webapps. For many PHP apps, deploying them on anything that is not apache means touching the server config itself.

Re:Critical RCE Vulnerability in Apache HTTP Server by system2 on Thursday November 12, 2026 @03:47AM (#50464630)
PHP can go to hell. My hair is gray because of it. Nginx is superior, and I can get anything imaginable done with config files. And not to mention, it's much faster.
Re:Critical RCE Vulnerability in Apache HTTP Server by ezst on Thursday November 12, 2026 @04:32AM (#50464988)
The http servers drag race finished 15 years ago on a tie, it's really much a matter of taste and familiarity more than performance at this point.
Re:Critical RCE Vulnerability in Apache HTTP Server by arcanemachiner on Thursday November 12, 2026 @05:11AM (#50465237)
The lazy bastard in me prefers Caddy.
Re:Critical RCE Vulnerability in Apache HTTP Server by theandrewbailey on Thursday November 12, 2026 @06:37AM (#50465760)
I don't understand this. NGINX can run PHP. PHP is not exclusive to Apache.
Re:Critical RCE Vulnerability in Apache HTTP Server by ransom1538 on Thursday November 12, 2026 @04:17AM (#50464860)
Eh. You can use .htaccess in nginx too. I use that everyday.
Re:Critical RCE Vulnerability in Apache HTTP Server by Alghranokk on Thursday November 12, 2026 @04:24AM (#50464922)
Does not Microsoft's IIS also have that with web.config files?
Re:Critical RCE Vulnerability in Apache HTTP Server by account42 on Thursday November 12, 2026 @05:28AM (#50465350)
I would say that's actually a misfeature as it requires too many additional filesystem lookups to fulfil requests.

Modifying the web server config is a nonissue outside of shared hosting, which should have died out with the advent of VMs/containers.

Re:Critical RCE Vulnerability in Apache HTTP Server by jagged-chisel on Thursday November 12, 2026 @06:13AM (#50465623)
> … too many additional filesystem lookups …

Caching is a thing. Only dump the cache when a changed is noticed.

Re:Critical RCE Vulnerability in Apache HTTP Server by canibalrex on Thursday November 12, 2026 @06:36AM (#50465752)
And now you have 2 problems..
Re:Critical RCE Vulnerability in Apache HTTP Server by cyphar on Thursday November 12, 2026 @05:53AM (#50465489)
[delayed]
Re:Critical RCE Vulnerability in Apache HTTP Server by anonreplier on Thursday November 12, 2026 @06:53AM (#50465881)
Yes apache has a config file too amazingly enough, .htaccess is optional