VORANT. Threat Intelligence Sign in Get the full feed

Apache HTTP Server RCE flaw under active exploitation

critical vulnerability

CVE-2026-23918, a double-free vulnerability in Apache httpd 2.4.66's mod_http2, enables remote code execution on common configurations with proof-of-concept code available.

A critical double-free memory corruption vulnerability (CVE-2026-23918) has been disclosed in Apache HTTP Server 2.4.66's mod_http2 module. The flaw is triggered by a specially crafted HTTP/2 request sequence that causes the same stream to be cleaned up twice, leading to memory corruption. While the vulnerability can be exploited for denial of service with minimal effort, crashing worker processes, it poses a more severe threat in common deployment configurations.

In environments using Apache Portable Runtime (APR) with mmap—particularly prevalent on Debian-based systems and official Docker images—the vulnerability can be leveraged for remote code execution. This significantly expands the attack surface, as these configurations are widely deployed in production environments. Proof-of-concept code demonstrating both denial of service and code execution capabilities is publicly available, lowering the barrier to exploitation.

The vulnerability affects all Apache HTTP Server versions prior to 2.4.67. Organizations running affected versions should prioritize patching immediately, particularly those using Debian-based distributions or containerized deployments. The availability of working exploit code combined with the widespread deployment of Apache httpd makes this a high-priority remediation target across government, business, and home user environments.

Mentioned in this report

Vulnerabilities CVE-2026-23918poc

Detection guidance

Suspicious Child Process Spawned by Apache HTTP Server Worker

ATT&CK T1190

Detects shell or interpreter processes spawned by Apache httpd worker processes, consistent with post-exploitation RCE following CVE-2026-23918 mod_http2 double-free exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process Spawned by Apache HTTP Server Worker
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /httpd
    - /apache2
    - /httpd.worker
  suspicious_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /python3
    - /python
    - /perl
    - /nc
    - /ncat
    - /curl
    - /wget
    - /id
    - /whoami
  filter:
    CommandLine|contains:
    - logrotate
    - apachectl
    - graceful
    - /usr/sbin/apache2ctl
  condition: selection and suspicious_child and not filter
falsepositives:
- Legitimate CGI or PHP scripts invoking shell utilities as part of normal web application
  functionality
- Administrative scripts that restart or manage the httpd service via apachectl
level: high
tags:
- attack.t1190
- attack.execution
id: 7fc18bb9-bf2e-5b3d-a056-b5c6bc711637
status: experimental
author: Vorant

Apache HTTP Server Worker Writing Executable Files to Web Root

ATT&CK T1190

Detects the Apache httpd worker process writing new executable or script files into web-accessible directories, indicative of webshell drop following successful exploitation of an Apache HTTP Server RCE vulnerability such as CVE-2026-23918. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Apache HTTP Server Worker Writing Executable Files to Web Root
logsource:
  category: file_event
  product: linux
detection:
  selection:
    Image|endswith:
    - /httpd
    - /apache2
    - /httpd.worker
    TargetFilename|endswith:
    - .php
    - .jsp
    - .cgi
    - .sh
    - .py
  filter:
    TargetFilename|contains:
    - /var/log/
    - /tmp/php
  condition: selection and not filter
falsepositives:
- Legitimate deployment of web application updates by CI/CD pipelines writing directly
  through the web server process
- Content management systems that allow in-place editing of scripts via the web server
level: medium
tags:
- attack.t1190
- attack.persistence
id: 5992d62c-aa1c-5ff5-90cf-f5a4c5bb08bc
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-apache-http-server-could-allow-for-remote-code-execution_2026-044

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free