Critical RCE Vulnerability in Apache HTTP Server

Re:Critical RCE Vulnerability in Apache HTTP Server by spuz on Thursday November 12, 2026 @02:44AM (#50464198)

I don't understand what they mean by "51% of cloud environments" have a publicly exposed instance. What is a "cloud environment"? Do they mean a cloud hosting provider like AWS or Google? Are they saying that between those two only one of them has an instance of a vulnerable Apache server running?

[ Parent | on HN ]

Re:Critical RCE Vulnerability in Apache HTTP Server by glawre on Thursday November 12, 2026 @04:55AM (#50465136)

I think they’re likely referring to either a Cloud Org (AWS Organisation, Google Cloud Org, Azure Tenant).

Wiz works by plugging their tool into your Cloud Org, so presumably they’re saying 51% of their enterprise-y customers have an exposed instance.

[ Parent | on HN ]

Re:Critical RCE Vulnerability in Apache HTTP Server by necovek on Thursday November 12, 2026 @05:31AM (#50465370)

My guess is that they are collecting stats on running HTTP daemon software and thus they estimate that 64% of "cloud accounts" have Apache somewhere, and 51% of the total are publicly exposed instances (not on VPCs and such).

As they make a note that this does not account for configuration, so if you've got the http2 module disabled, it sounds like you are protected — though they only recommend hard-coding the protocol version to 1.1 instead of disabling the module (I've got the module disabled as that was the default when I set up my homelab server, for instance).

[ Parent | on HN ]