Project
Apache HTTP Server is a widely used open-source web server software, often configured via .htaccess files to serve and route web traffic.
Sophos says the code patches Apache and hooks the PHP module loader so the shell never lands on disk, which leaves file-integrity checking on an appliance that was never running EDR unable to prove much.
Perspective Coverage
6 publishersReality
Two actor classes are using CVE-2026-20079 against the console that manages every Cisco Secure Firewall behind it. The same week brought a Linux rootkit planted on F5 BIG-IP APM appliances, with the installation route unreported.
Reality
Only permalinked URLs returned 500s, because the homepage resolves close to a direct hit on index.php and never reaches the forwarding rule WordPress wrote against the old subdirectory path. The usual four-element reading of the default block leaves out the line that held that path.
Reality
A cloaker left a plain robots.txt in the web root of utilorax.com. Apache's !-f rule let it win over the generated one, and every instrument built after the first hack had its own reason to call the result healthy.
Reality
A full attack chain against a self-hosted lab shows a clean split: reconnaissance that never authenticates logs nothing, while every login attempt and HTTP request produces correlated alerts.
Reality
Check Point says a Chinese-speaking crew has been running custom Apache modules on compromised Brazilian federal, state and municipal web servers since mid-2025, so the address bar and the TLD tell a visitor nothing useful.
Perspective Coverage
3 publishersReality
The keys work because they are keys. A standard sk_live carries refunds and sometimes payouts. The fix that matters today is rotation. The fix that lasts is a document root that refuses to serve dotfiles.
Reality
Two disclosed DoS techniques turn HTTP/3-to-HTTP/1.1 conversion at six major CDNs into up to 350x load on the origin, with no configuration change by the customer.
Reality