{"generated_at":"2026-11-12T18:35:22.639Z","source":{"name":"Hacker News public API","url":"https://github.com/HackerNews/API","attribution":"Stories and comments are public Hacker News submissions by their respective authors. HackerHub is an independent reader, not affiliated with Y Combinator.","content_is_untrusted":true},"story_id":50462177,"hn_url":"https://news.ycombinator.com/item?id=50462177","total_comments":181,"returned":20,"scope":"Up to the requested number of top-level comments in Hacker News ranked order. Deleted comments are omitted. Nested replies are not fetched; this is not the complete thread.","comments":[{"id":50463689,"author":"jamesy0ung","created_at":"2026-11-12T06:18:31.000Z","text":"Patch looks like https://github.com/apache/httpd/commit/5ed39287660daacd1233c...","parent_id":50462177,"replies_count":1,"hn_url":"https://news.ycombinator.com/item?id=50463689"},{"id":50465500,"author":"rurcliped","created_at":"2026-11-12T10:54:17.000Z","text":"For anyone temporarily shutting off an Apache httpd, there's one step that's sometimes missed: a cron job or systemd timer for certbot. This can restart httpd and leave it running. In other words, in some common uses of Let's Encrypt, standard instructions such as \"systemctl disable --now apache2\" aren't sufficient to keep httpd off.","parent_id":50462177,"replies_count":4,"hn_url":"https://news.ycombinator.com/item?id=50465500"},{"id":50463264,"author":"throooooo","created_at":"2026-11-12T05:04:58.000Z","text":"I have a lot of Linux sysadmin experience but haven't touched Apache in more than a decade. I thought it's mostly nginx or other solutions at this point.","parent_id":50462177,"replies_count":12,"hn_url":"https://news.ycombinator.com/item?id=50463264"},{"id":50471421,"author":"ian-g","created_at":"2026-11-12T18:01:02.000Z","text":"I'd like to point out, really quickly, that the patched version of open source mod_http2 is listed as 2.0.24 and newer while the affected versions are 2.0.8 through 2.0.42.\nI think they meant to say the first patched version is 2.0.43","parent_id":50462177,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50471421"},{"id":50465567,"author":"acidburnNSA","created_at":"2026-11-12T11:05:03.000Z","text":"Appears to be the first issue ranked 'critical' since 2021. https://httpd.apache.org/security/vulnerabilities_24.html","parent_id":50462177,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50465567"},{"id":50465333,"author":"account42","created_at":"2026-11-12T10:25:19.000Z","text":"> in Apache HTTP Server’s HTTP/2 module (mod_http2)\nI feel like in hindsight, HTTP/2 was a mistake. The theoretical benefits just don't justify the added complexity. It definitely shouldn't have been fasttracked like it was.","parent_id":50462177,"replies_count":5,"hn_url":"https://news.ycombinator.com/item?id=50465333"},{"id":50462602,"author":"thehamkercat","created_at":"2026-11-12T03:16:34.000Z","text":"> What is CVE-2026-111497?\n> CVE-2026-119618 is a critical, high-severity vulnerability involving....\ntwo CVEs? (111497 != 11968)","parent_id":50462177,"replies_count":1,"hn_url":"https://news.ycombinator.com/item?id=50462602"},{"id":50471688,"author":"jgalt212","created_at":"2026-11-12T18:18:38.000Z","text":"It seems HTTP/2 is not enabled by default in apache.","parent_id":50462177,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50471688"},{"id":50464198,"author":"spuz","created_at":"2026-11-12T07:44:12.000Z","text":"I don't understand what they mean by \"51% of cloud environments\" have a publicly exposed instance. What is a \"cloud environment\"? Do they mean a cloud hosting provider like AWS or Google? Are they saying that between those two only one of them has an instance of a vulnerable Apache server running?","parent_id":50462177,"replies_count":2,"hn_url":"https://news.ycombinator.com/item?id=50464198"},{"id":50463894,"author":"z3ratul163071","created_at":"2026-11-12T06:52:13.000Z","text":"what is amazing, there are no apache updated containers / packages available yet.","parent_id":50462177,"replies_count":4,"hn_url":"https://news.ycombinator.com/item?id=50463894"},{"id":50468833,"author":"cozzyd","created_at":"2026-11-12T15:20:30.000Z","text":"Fortunately for me EL8/9 don't enable http/2 and I never bothered enabling it anywhere. (EL8 is not vulnerable anyway since its httpd is too old).","parent_id":50462177,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50468833"},{"id":50464770,"author":"neurostimulant","created_at":"2026-11-12T09:06:02.000Z","text":"Chances are most Apache/PHP installations run mpm_prefork and aren’t affected by this.","parent_id":50462177,"replies_count":1,"hn_url":"https://news.ycombinator.com/item?id=50464770"},{"id":50464339,"author":"klaas-","created_at":"2026-11-12T08:05:39.000Z","text":"duplicate of https://news.ycombinator.com/item?id=50453368","parent_id":50462177,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50464339"},{"id":50463365,"author":"jerrythegerbil","created_at":"2026-11-12T05:23:12.000Z","text":"This took 7 minutes and $0.02 in deepseek spend through a subscription to reproduce. The prompt was simply directed at a vulnerable version and told to find a h2 race, which is generically the most common culprit these days. Once it found one, I had it attempt the same against a patched version (which failed).\nDisabling h2 is the mitigation and is effective. The patch itself seems a little odd as a fix to me personally, but eh.","parent_id":50462177,"replies_count":2,"hn_url":"https://news.ycombinator.com/item?id=50463365"},{"id":50465014,"author":"eptcyka","created_at":"2026-11-12T09:35:14.000Z","text":"What is the benefit of using Apache over enjinx?","parent_id":50462177,"replies_count":2,"hn_url":"https://news.ycombinator.com/item?id=50465014"},{"id":50465532,"author":"ankit9673","created_at":"2026-11-12T11:01:00.000Z","text":"everybody new Vulnerability makes me think how we are not so good a writing secure code?.","parent_id":50462177,"replies_count":3,"hn_url":"https://news.ycombinator.com/item?id=50465532"},{"id":50463890,"author":"yunuserturk","created_at":"2026-11-12T06:51:44.000Z","text":"LiteSpeed and OpenLiteSpeed affected by this?","parent_id":50462177,"replies_count":1,"hn_url":"https://news.ycombinator.com/item?id=50463890"},{"id":50464119,"author":"jaekwon","created_at":"2026-11-12T07:30:41.000Z","text":"gno.security/repairer","parent_id":50462177,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50464119"},{"id":50463776,"author":"cubefox","created_at":"2026-11-12T06:34:43.000Z","text":"No CVSS severity level?","parent_id":50462177,"replies_count":2,"hn_url":"https://news.ycombinator.com/item?id=50463776"},{"id":50462559,"author":"kgeist","created_at":"2026-11-12T03:08:52.000Z","text":">Due to improper synchronization when executing concurrent threads sharing resources, an attacker can trigger heap corruption.\n>As of the time of this blog’s publication, no exploit is available and there are no reports of exploitation in the wild.\nSince when does \"memory corruption\" = \"RCE\"? Last week I found and reproduced a memory corruption (a use-after-free) in PHP's runtime after running an on-premise agent for just 30 minutes. There's nothing about it on the internet. Should I write a blog post about a scary new vulnerability? :)","parent_id":50462177,"replies_count":4,"hn_url":"https://news.ycombinator.com/item?id=50462559"}]}