The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime.
This issue affects Apache HTTP Server: from 2.4.60 through 2.4.68.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade apache2 | Oct 5, 2026 | Oct 1, 2026 |
| Amazon Linux Ami 2 | — | Upgrade mod_mdUpgrade mod_sslUpgrade httpd-develUpgrade httpd-debuginfoUpgrade httpdUpgrade httpd-filesystemUpgrade mod_sessionUpgrade mod_ldapUpgrade mod_http2Upgrade httpd-manualUpgrade httpd-toolsUpgrade mod_proxy_html | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade httpd-develUpgrade mod_sslUpgrade httpd-toolsUpgrade mod_lua-debuginfoUpgrade httpd-tools-debuginfoUpgrade mod_http2-debuginfoUpgrade httpdUpgrade mod_luaUpgrade httpd-debuginfoUpgrade httpd-coreUpgrade httpd-debugsourceUpgrade mod_ldap-debuginfoUpgrade mod_sessionUpgrade mod_proxy_html-debuginfoUpgrade httpd-manualUpgrade httpd-filesystemUpgrade mod_proxy_htmlUpgrade httpd-core-debuginfoUpgrade mod_ssl-debuginfoUpgrade mod_session-debuginfoUpgrade mod_ldapUpgrade mod_http2 | Oct 13, 2026 | Oct 1, 2026 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Oct 2, 2026 | Oct 1, 2026 |
| Debian | — | Upgrade apache2 | Oct 20, 2026 | Oct 1, 2026 |
| Freebsd | — | Upgrade apache24 | Oct 5, 2026 | Oct 1, 2026 |
| Redhat_linux | — | No solution exists | Oct 5, 2026 | Oct 1, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2026 | Oct 1, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub