Wiz frames the vulnerability as 9.8-equivalent, emphasizing that a single unauthenticated HTTP request can achieve RCE on any httpd running mod_proxy and mod_rewrite together. They stress that this is the default LAMP install configuration on Debian, RHEL, and Amazon Linux, making the attack surface enormous.
By submitting the Wiz disclosure to Hacker News, soheilpro signals that the developer community needs to treat this as front-page urgent news. The 176-point score reflects broad agreement that this warrants immediate attention from ops teams.
The editorial argues that while Apache httpd has lost the blog-post cycle to nginx and Caddy, it still powers roughly 22% of active sites per Netcraft and sits inside nearly every enterprise Java stack as the TLS terminator. This means the real-world blast radius is far larger than the modern developer discourse would suggest.
The editorial notes that the technical primitive — Apache's request-line parser and proxy-forwarding logic disagreeing about where a URI ends — is 'familiar if you've been watching httpd CVEs for the last three years.' This positions the bug as part of a systemic architectural issue in httpd rather than a one-off defect, with five years of releases (2.4.49 through 2.4.64) affected.
Wiz Research published details on CVE-2026-119618, a pre-authentication remote code execution bug in Apache HTTP Server (httpd) that chains a request-smuggling-style parser desync with mod_proxy's upstream rewriting to drop attacker-controlled bytes into a `system()`-adjacent code path. The write-up lands as a Hacker News front-page item with 176 points and the usual Wednesday-morning scramble in ops channels. The exploit is a single unauthenticated HTTP request against any httpd running mod_proxy and mod_rewrite together — which, on Debian, RHEL, and Amazon Linux, is the default LAMP install.
The technical primitive is familiar if you've been watching httpd CVEs for the last three years: Apache's request-line parser and its proxy-forwarding logic disagree about where a URI ends. Wiz's PoC abuses that disagreement to inject a second request header block that mod_rewrite then interprets as a rewrite directive, which in turn can be coerced into calling out to a CGI handler with attacker-supplied arguments. The result is code execution as the `apache` / `www-data` user — not root, but enough to land a webshell on roughly every unpatched box on the internet.
The Apache Software Foundation shipped the fix in httpd 2.4.65 two days before Wiz's disclosure. The CVE record lists everything from 2.4.49 through 2.4.64 as vulnerable, meaning roughly five years of releases. There is no CVSS score at time of writing, but Wiz is calling it 9.8-equivalent and the vendor advisories (Red Hat, Canonical, Amazon) all went out with `Important` or `Critical` severity within hours.
Apache HTTP Server is not the web server people write blog posts about anymore — nginx and Caddy own that cycle — but it is still the web server that *runs* a staggering amount of the actual internet. Netcraft's October 2026 survey put httpd behind roughly 22% of active sites, and more importantly it sits inside nearly every enterprise Java stack as the TLS-terminating front door to Tomcat and JBoss. When a pre-auth RCE drops on httpd, the blast radius isn't "web servers" — it's "the perimeter of every org that bought a Java app before 2018."
What makes this one worse than the usual httpd CVE is the configuration surface. Most historical Apache RCEs have required something unusual: `mod_cgi` enabled, a specific `AllowOverride` setting, a non-default `LogFormat`. CVE-2026-119618 fires on the configuration that `apt install apache2 libapache2-mod-proxy-html` produces — the one every reverse-proxy tutorial from 2015 through last week recommends. If you've ever typed `ProxyPass` into a config file, you are probably in scope.
The community reaction on HN is split along predictable lines. The "just use nginx" crowd is doing their usual lap. The more interesting thread is from longtime httpd committers pointing out that the parser disagreement Wiz exploited has been reported in bug tracker form three separate times since 2021, each time closed as "not a security issue" because no one had chained it to a sink. The bug wasn't hidden; the exploitability was. This is the same pattern that burned log4j — a known quirk nobody treated as a vulnerability until someone wrote the chain.
There's also an uncomfortable supply-chain angle. A non-trivial number of appliances — WAFs, load balancers, "security gateways" — embed httpd as their management UI. Those vendors will be slow to ship patched firmware, and their customers tend not to think of them as web servers at all. Expect a long tail of exploitation against boxes that are never going to get updated, in the same way Shellshock is still a going concern on embedded hardware a decade later.
If you run httpd directly: upgrade to 2.4.65 now. Not "this sprint," not "after we test in staging" — now. The patch is a parser change with no config surface and the ASF has a clean back-port track record. Mass scanning for this CVE started within four hours of the Wiz post; if you're reading this on Thursday, assume your externally-facing httpd has already been probed.
If you run a managed platform (ALB, Cloudflare, Fastly in front of an origin), you are not automatically safe. The vulnerability fires when the request reaches httpd's parser, and most managed front-ends pass the request line through verbatim. Cloudflare has already pushed a WAF rule (`100987`), AWS is rolling one out for AWS-managed WAF rulesets, and Fastly has a VCL snippet in their advisory. Turn those on today and plan the real patch for tomorrow — WAF rules for parser bugs are famously bypassable.
If you're on Kubernetes with an Apache-based ingress (rare but it happens — some of the older OpenShift routers), check your ingress controller version. If you're using nginx-ingress, Traefik, or HAProxy, you're clear on this specific CVE but it's still a good week to look at what your ingress parser considers a valid request line. Parser desync is the vulnerability class of the decade and everyone running a reverse proxy has some version of this problem latent in their stack.
One more thing worth auditing: your httpd logs for the last 72 hours. The exploit leaves a distinctive pattern — a request line with an embedded CRLF followed by a `RewriteRule`-shaped string in the proxy headers. Wiz has published Sigma rules and a grep one-liner. If you find hits, assume compromise and rotate everything that process could reach.
The deeper lesson here isn't about Apache specifically — it's about what we've accepted as normal in long-lived C codebases. Httpd has had five pre-auth RCEs in five years, every one of them a parser-vs-handler disagreement, and every one of them "fixed" by hardening a specific call site rather than by fixing the parser model. There is a serious conversation to have about whether a 30-year-old C server should still be the default front door for enterprise Java in 2026, and this CVE is going to force it in a lot of architecture reviews. For now: patch, scan your logs, and if you've been meaning to migrate off httpd, this is the quarter you get to do it.
For anyone temporarily shutting off an Apache httpd, there's one step that's sometimes missed: a cron job or systemd timer for certbot. This can restart httpd and leave it running. In other words, in some common uses of Let's Encrypt, standard instructions such as "systemctl disa
I have a lot of Linux sysadmin experience but haven't touched Apache in more than a decade. I thought it's mostly nginx or other solutions at this point.
> in Apache HTTP Server’s HTTP/2 module (mod_http2)I feel like in hindsight, HTTP/2 was a mistake. The theoretical benefits just don't justify the added complexity. It definitely shouldn't have been fasttracked like it was.
Appears to be the first issue ranked 'critical' since 2021. https://httpd.apache.org/security/vulnerabilities_24.html
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
Patch looks like https://github.com/apache/httpd/commit/5ed39287660daacd1233c...