Security news aggregator

Latest coverage for Apache

Apache web servers and related projects matter to cybersecurity because vulnerabilities, configuration errors, and exposed services can enable attacks.

17 headlines in this view

Refine the feed

Search across headline titles and summaries.

Tag briefing

Background for this topic.

Apache HTTP Server is a widely used open-source web server software that delivers web content by handling client requests over the internet. It supports extensibility through modules that enable features like URL rewriting, authentication, and SSL/TLS encryption. Apache’s configuration flexibility and broad adoption make it a common platform for hosting websites and web applications.

Security risks with Apache often stem from outdated software versions and misconfigurations, which can expose vulnerabilities such as remote code execution, directory traversal, and denial-of-service attacks. Defenders should apply security patches promptly, enable modules like mod_security for web application firewall capabilities, and restrict access permissions carefully. Regular log monitoring is essential to detect suspicious activity, making Apache a critical focus for vulnerability management and web server hardening efforts.

Volume over time

Weekly headline count for the current query.

Showing 17 most recent headlines Filtered view

You upgraded when this was fixed in April, right? Right?? If you haven't yet upgraded to version 1.3.0 of Apache HugeGraph, now's a good time because at least two proof-of-concept exploits for a CVSS 9.8-rated remote command execution bug in the open-source graph database have been made public.…

The Register 7 Jun 2024, 1:16 p.m. Apache Database Exploit Fixed Flaw Open Source PoC Remote Code Execution

Seriously, people - please check the stuff you fetch more carefully Security vendor Sonatype believes developers are failing to address the critical remote code execution (RCE) vulnerability in the Apache Struts 2 framework, based on recent downloads of the code.…

The Register 22 Dec 2023, 3:13 a.m. Apache Critical Vulnerability Flaw Framework Remote Code Execution Vendor Vulnerability

Oracle and Apache holes also on Uncle Sam's list of big bad abused bugs The US government's Cybersecurity and Infrastructure Security Agency (CISA) is adding three more flaws to its list of known-exploited vulnerabilities, including one involving TP-Link routers that is being targeted by the operators of the notorious Mirai botnet.…

The Register 3 May 2023, 10:45 a.m. Apache Botnet CISA Flaw Government Oracle Routers Vulnerability Warning

Two out of three public-facing app instances open to hijacking Apache Superset until earlier this year shipped with an insecure default configuration that miscreants could exploit to login and take over the data visualization application, steal data, and execute malicious code.…

The Register 26 Apr 2023, 10:35 a.m. Apache Exploit Malicious Code Theft Vulnerability
The Register 3 years, 6 months ago

It’s time to fill those cloud security gaps

Here’s how Wiz can help Sponsored Feature When software vulnerabilities and zero days moved up the enterprise worry list 15 years ago, nobody imagined the world would one day end up with a threat as perplexing as Log4Shell – a vulnerability in the Apache Log4j open source logging framework that's used in software on all major operating systems spanning everything from cloud services to PC games.…

The Register 23 Dec 2022, 1:58 a.m. Apache Cloud Framework Log4j Log4Shell Open Source Vulnerability