News for hackers. Stuff that matters.

A comment on Critical RCE Vulnerability in Apache HTTP Server. Parent comment

Re:Critical RCE Vulnerability in Apache HTTP Server by hannob on Thursday November 12, 2026 @03:43AM (#50464601)
Apache has a feature that no other http server has replicated: .htaccess files.

They provide limited configurability of server functionality within a webroot. That's extremely convenient for PHP webapps. For many PHP apps, deploying them on anything that is not apache means touching the server config itself.

[ Parent | on HN ]
Re:Critical RCE Vulnerability in Apache HTTP Server by system2 on Thursday November 12, 2026 @03:47AM (#50464630)
PHP can go to hell. My hair is gray because of it. Nginx is superior, and I can get anything imaginable done with config files. And not to mention, it's much faster.
[ Parent | on HN ]
Re:Critical RCE Vulnerability in Apache HTTP Server by ezst on Thursday November 12, 2026 @04:32AM (#50464988)
The http servers drag race finished 15 years ago on a tie, it's really much a matter of taste and familiarity more than performance at this point.
[ Parent | on HN ]
Re:Critical RCE Vulnerability in Apache HTTP Server by arcanemachiner on Thursday November 12, 2026 @05:11AM (#50465237)
The lazy bastard in me prefers Caddy.
[ Parent | on HN ]
Re:Critical RCE Vulnerability in Apache HTTP Server by theandrewbailey on Thursday November 12, 2026 @06:37AM (#50465760)
I don't understand this. NGINX can run PHP. PHP is not exclusive to Apache.
[ Parent | on HN ]
Re:Critical RCE Vulnerability in Apache HTTP Server by ransom1538 on Thursday November 12, 2026 @04:17AM (#50464860)
Eh. You can use .htaccess in nginx too. I use that everyday.
[ Parent | on HN ]
Re:Critical RCE Vulnerability in Apache HTTP Server by Alghranokk on Thursday November 12, 2026 @04:24AM (#50464922)
Does not Microsoft's IIS also have that with web.config files?
[ Parent | on HN ]
Re:Critical RCE Vulnerability in Apache HTTP Server by account42 on Thursday November 12, 2026 @05:28AM (#50465350)
I would say that's actually a misfeature as it requires too many additional filesystem lookups to fulfil requests.

Modifying the web server config is a nonissue outside of shared hosting, which should have died out with the advent of VMs/containers.

[ Parent | on HN ]
Re:Critical RCE Vulnerability in Apache HTTP Server by jagged-chisel on Thursday November 12, 2026 @06:13AM (#50465623)
> … too many additional filesystem lookups …

Caching is a thing. Only dump the cache when a changed is noticed.

[ Parent | on HN ]
Re:Critical RCE Vulnerability in Apache HTTP Server by canibalrex on Thursday November 12, 2026 @06:36AM (#50465752)
And now you have 2 problems..
[ Parent | on HN ]
Re:Critical RCE Vulnerability in Apache HTTP Server by cyphar on Thursday November 12, 2026 @05:53AM (#50465489)
[delayed]
[ Parent | on HN ]
Re:Critical RCE Vulnerability in Apache HTTP Server by anonreplier on Thursday November 12, 2026 @06:53AM (#50465881)
Yes apache has a config file too amazingly enough, .htaccess is optional
[ Parent | on HN ]