Multiple vulnerabilities in Apache HTTP Server
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple vulnerabilities in Apache HTTP Server versions before 2.4.69 enable remote code execution, denial of service, and data disclosure.
Apache HTTP Server versions prior to 2.4.69 are affected by multiple vulnerabilities that enable remote attackers to execute arbitrary code, cause denial of service, disclose sensitive data, and bypass security policies. The CERT-FR advisory references 18 distinct CVEs affecting the affected versions. Apache has released version 2.4.69 on October 1, 2026, which addresses these issues. Organizations running Apache HTTP Server should upgrade immediately to mitigate the risks of remote code execution and unauthorized access.
Mentioned in this report
Detection guidance
Apache HTTP Server Spawning Shell on Linux
Apache httpd/apache2 parent process spawning an interactive shell or common post-exploitation utility, indicating possible RCE via a web vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Apache HTTP Server Spawning Shell on Linux
description: Detects the Apache web server process (httpd/apache2) spawning a shell
or common recon/download utility. This is the typical post-exploitation pattern
after remote code execution in a public-facing web server. Matches the parent/child
relation, not any specific CVE payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /apache2
- /httpd
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /zsh
- /whoami
- /id
- /wget
- /curl
- /nc
- /ncat
- /python
- /python3
- /perl
filter_admin:
CommandLine|contains:
- apachectl
- apache2ctl
- logrotate
condition: selection_parent and selection_child and not filter_admin
falsepositives:
- CGI or mod_cgi scripts that legitimately invoke shell wrappers
- Web applications that shell out to curl or python for backend tasks
level: medium
id: 29d4def1-cb25-552c-8a5f-626f4129d138
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1248
Apache httpd.exe Spawning Command Interpreter or LOLBin on Windows
Apache httpd.exe spawning cmd, PowerShell or download/recon utilities, indicating possible exploitation of the web server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Apache httpd.exe Spawning Command Interpreter or LOLBin on Windows
description: Detects httpd.exe (Apache HTTP Server on Windows) spawning cmd, PowerShell,
or common LOLBins used for payload download and reconnaissance. Indicates likely
code execution through exploitation of the web server.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \httpd.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
- \whoami.exe
- \net.exe
- \net1.exe
- \curl.exe
condition: selection
falsepositives:
- CGI scripts or PHP applications on Windows that call cmd.exe for legitimate tasks
- Administrative tooling launched through Apache-hosted management panels
level: high
id: f0990d8d-c378-5658-a715-74d9b6495214
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1248
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1248
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs