Search: “Apache HTTP Server”

275 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 103 Exploit / PoC 66 Malware 56 Ransomware 19 Data breach 8 Threat actor 7 Advisory 4 Phishing & fraud 3 Tools 3 Policy & legal 2 AI tools & infra 2 Research 1 AI research 1

SeverityAll critical 151 high 75 medium 40 low 5 info 4

USN-8571-2: Apache HTTP Server regression

Ubuntu issues USN-8571-2 fixing an Apache HTTP Server regression that prevented startup when HTTP/2 proxying was enabled.

Ubuntu released USN-8571-2 to fix a regression introduced by USN-8571-1 in Apache HTTP Server. The earlier fix was incomplete due to a missing library symbol, causing Apache to fail to start when HTTP/2 proxying was enabled. The original advisory addressed CVE-2026-33007, a memory-handling flaw in mod_authn_socache allowing remote denial of service, and an HTTP response splitting vulnerability affecting multiple modules, credited to Pavel Kohout, Arkadi Vainbrand, Haruki Oyama, Merih Mengisteab, and Dawit Jeong.

Ubuntu Security Noticesupdated Sep 11, 12:03 UTC · 4d agofirst Sep 10, 19:36 UTC · 5d agoAdvisory 13 sources CVE-2026-33007

U.S. CISA adds SonicWall SMA100 and Apache HTTP Server flaws to its Known Exploited Vulnerabilities catalog

Security AffairsMay 2, 07:50 UTC · May 2, 2025Exploit / PoC in the wildCVE-2024-38475 CVE-2023-44221

CVE-2019-0211 Apache flaw allows getting root access via script

Security AffairsApr 4, 22:03 UTC · Apr 4, 2019Vulnerability CVE-2019-0211 CVE-2019-0217 CVE-2019-0215

QNAP firmware updates fix Apache HTTP vulnerabilities in its NAS

Security AffairsApr 22, 11:28 UTC · Apr 22, 2022Vulnerability CVE-2022-22721 CVE-2022-23943 CVE-2022-22719+1 CVEs

Patch Apache HTTP Servers Now to Avoid Zero Day Exploit

Infosecurity MagazineOct 6, 09:16 UTC · Oct 6, 2021Vulnerability in the wildCVE-2021-41773 CVE-2021-41524

Optionsbleed bug makes Apache HTTP Server leak data from memory

Help Net SecuritySep 20, 00:00 UTC · Sep 20, 2017Vulnerability CVE-2017-9798

Hackers Exploit Apache HTTP Server Flaw to Deploy Linuxsys Cryptocurrency Miner

The Hacker NewsJul 21, 06:31 UTC · Jul 21, 2025Ransomware CVE-2021-41773 CVE-2024-36401 CVE-2023-22527+5 CVEs

CISA Confirms Exploitation of SonicWall Vulnerabilities

Infosecurity MagazineMay 2, 15:00 UTC · May 2, 2025Vulnerability in the wildCVE-2023-44221 CVE-2024-38475

Threat Advisory: Apache HTTP Server zero-day vulnerability opens door for attackers

Cisco TalosOct 7, 19:36 UTC · Oct 7, 2021Exploit / PoC in the wildCVE-2021-41733 CVE-2021-42013

Network Security Trends: August

Palo Alto Unit 42Jun 6, 00:57 UTC · Jun 6, 2024Exploit / PoC in the wildCVE-2021-40438 CVE-2021-34473 CVE-2021-38647+9 CVEs

QNAP Advises Users to Update NAS Firmware to Patch Apache HTTP Vulnerabilities

The Hacker NewsApr 22, 08:15 UTC · Apr 22, 2022Vulnerability CVE-2022-22721 CVE-2022-23943 CVE-2022-22719+3 CVEs

Apache rolled out a new update in a few days to fix incomplete patch for actively exploited flaw

Security AffairsOct 8, 07:38 UTC · Oct 8, 2021Vulnerability in the wildCVE-2021-41773 CVE-2021-42013

HTTP/2 Bomb CVE-2026-49975

Fortinet advisory details CVE-2026-49975, an Apache HTTP Server HTTP/2 flaw enabling denial of service, affecting versions 2.4.17 through 2.4.67.

Fortinet PSIRT advisory FG-IR-26-163, revised 2026-08-19, covers CVE-2026-49975, a memory allocation with excessive size value flaw (HTTP/2 bomb) in Apache HTTP Server's mod_http2, scored CVSSv3 5.8. Malicious HTTP requests can cause a denial of service, and affected versions span Apache HTTP Server 2.4.17 through 2.4.67. The advisory text does not state which Fortinet product bundles the affected Apache component or whether exploitation has been observed.

Fortinet PSIRTAug 12, 07:00 UTC · Aug 12, 2026Advisory CVE-2026-49975

New Apache Web Server Bug Threatens Security of Shared Web Hosts

The Hacker NewsApr 3, 09:07 UTC · Apr 3, 2019Exploit / PoC CVE-2019-0211 CVE-2019-0217 CVE-2019-0215

Expert published NMAP script for Apache CVE-2021

Security AffairsOct 9, 12:04 UTC · Oct 9, 2021Vulnerability in the wildCVE-2021-41773 CVE-2021-420131

Apache fixes actively exploited web server zero

The RecordDec 16, 00:00 UTC · Dec 16, 2022Exploit / PoC in the wildCVE-2021-41773

Apache Warns of Zero-Day Exploit in the Wild — Patch Your Web Servers Now!

The Hacker NewsOct 7, 05:31 UTC · Oct 7, 2021Exploit / PoC in the wildCVE-2021-41773 CVE-2021-41524

Experts warn of attacks exploiting CVE-2021

Security AffairsNov 29, 15:18 UTC · Nov 29, 2021Exploit / PoC in the wildCVE-2021-40438

PoC exploit for Carpe Diem Apache bug released

Help Net SecurityApr 9, 00:00 UTC · Apr 9, 2019Exploit / PoC CVE-2019-0211

Debian 13.5 point release lands with security fixes, bug patches

Help Net SecurityMay 18, 00:00 UTC · May 18, 2026Vulnerability CVE-2026-23918 CVE-2026-24072 CVE-2026-33006+14 CVEs

Apache patch a zero

Security AffairsOct 5, 17:15 UTC · Oct 5, 2021Vulnerability in the wildCVE-2021-41773 CVE-2021-41524

Patched Apache flaw is a serious threat for web hosting providers

Help Net SecurityApr 3, 00:00 UTC · Apr 3, 2019Vulnerability CVE-2019-0211

RondoDox Botnet targets 56 flaws across 30+ device types worldwide

Security AffairsOct 10, 07:33 UTC · Oct 10, 2025Malware CVE-2024-3721 CVE-2024-12856 CVE-2023-1389+33 CVEs

Optionsbleed vulnerability can cause Apache servers to leak memory data

Security AffairsSep 20, 16:43 UTC · Sep 20, 2017Vulnerability CVE-2017-9798

Week in review: CCleaner compromise, Optionsbleed, and Linux devices sending out spam

Help Net SecuritySep 24, 00:00 UTC · Sep 24, 2017Vulnerability

Threat Source newsletter (Oct. 14, 2021)

Cisco TalosOct 14, 18:00 UTC · Oct 14, 2021Ransomware in the wildCVE-2021-40461 CVE-2021-38672 CVE-2021-41733+1 CVEs

Attackers exploited old flaws to breach SonicWall SMA appliances (CVE-2024-38475, CVE-2023-44221)

Help Net SecurityMay 2, 00:00 UTC · May 2, 2025Vulnerability in the wildCVE-2024-38475 CVE-2023-44221

Chinese Daggerfly uses a new version of Macma macOS backdoor

Security AffairsJul 24, 10:09 UTC · Jul 24, 2024Malware CVE-2021-30869

SonicWall Confirms Active Exploitation of Flaws Affecting Multiple Appliance Models

The Hacker NewsMay 5, 15:51 UTC · May 5, 2025Exploit / PoC in the wildCVE-2023-44221 CVE-2024-38475 CVE-2021-20035

Security Compass expands support for OpSec, adding Microsoft Azure to its knowledge library

Help Net SecuritySep 6, 00:00 UTC · Sep 6, 2018Policy & legal

CISA adds Zoho, Apache, Qualcomm, Mikrotik flaws to the list of actively exploited issues

Security AffairsDec 2, 20:17 UTC · Dec 2, 2021Advisory in the wildCVE-2021-37415 CVE-2021-44077 CVE-2018-14847+2 CVEs

US Government Urges Action to Mitigate Androxgh0st Malware Threat

Infosecurity MagazineJan 17, 11:05 UTC · Jan 17, 2024Malware in the wildCVE-2017-9841 CVE-2018-15133 CVE-2021-41773

Chinese Threat Actors Exploit ToolShell SharePoint Flaw Weeks After Microsoft's July Patch

The Hacker NewsOct 22, 12:56 UTC · Oct 22, 2025Vulnerability CVE-2025-53770 CVE-2025-49704 CVE-2025-49706+1 CVEs

Apache fixes critical HTTP/2 double-free flaw CVE-2026

Security AffairsMay 6, 11:00 UTC · May 6, 2026Exploit / PoC CVE-2026-239181

New HTTP/2 Vulnerability Exposes Web Servers to DoS Attacks

The Hacker NewsApr 5, 03:55 UTC · Apr 5, 2024Vulnerability CVE-2024-2653 CVE-2024-27316 CVE-2024-24549+7 CVEs

U.S. CISA adds maximum-severity Oracle flaw to its Known Exploited Vulnerabilities catalog

CISA added actively exploited CVE-2026-21962, a CVSS 10.0 unauthenticated flaw in Oracle HTTP Server and WebLogic Proxy Plug-in, to KEV with an August 27 deadline.

CISA added CVE-2026-21962 (CVSS 10.0), an improper access control vulnerability in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate by August 27, 2026. The unauthenticated flaw allows remote attackers with network access to create, delete, or modify critical data, potentially gain broad access, and cause a scope change to other systems; affected versions are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. CloudSEK honeypot data from January-February 2026 showed widespread exploitation of the flaw alongside older WebLogic RCEs including CVE-2020-14882/14883, CVE-2020-2551, and CVE-2017-10271.

Security AffairsAug 25, 08:50 UTC · 22d agoExploit / PoC in the wildCVE-2026-21962 CVE-2020-14882 CVE-2020-14883+2 CVEs

Critical Apache HTTP/2 Flaw (CVE-2026

The Hacker NewsMay 5, 16:46 UTC · May 5, 2026Exploit / PoC CVE-2026-23918