CVE-2026-119618: Apache HTTP Server RCE — Detection, Hunting, and Remediation Guide

---
title: Apache HTTP Server Suspicious Child Process Execution
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects suspicious child processes spawned by Apache HTTP Server, which may indicate successful exploitation of CVE-2026-119618
references:
  - https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/httpd'
      - '/apache2'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/perl'
      - '/nc'
      - '/netcat'
      - '/wget'
      - '/curl'
  filter:
    Image|endswith:
      - '/rotatelogs'
      - '/apachectl'
  condition: selection and not filter
falsepositives:
  - Legitimate administrative scripts invoked by Apache
  - CGI scripts (should be reviewed and whitelisted)
level: high
---
title: Web Shell File Creation in Apache Document Root
id: 9e4b3c2d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects creation of executable script files in Apache web directories, a common indicator of post-exploitation activity
references:
  - https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/var/www/html/'
      - '/var/www/'
      - '/usr/local/apache2/htdocs/'
      - '/srv/www/'
    TargetFilename|endswith:
      - '.php'
      - '.jsp'
      - '.jspx'
      - '.asp'
      - '.aspx'
      - '.sh'
      - '.py'
  condition: selection
falsepositives:
  - Legitimate web application deployments
  - Content management system updates
level: medium
---
title: Suspicious HTTP Request Patterns in Apache Logs
id: 7a2b3c4d-6e7f-8a9b-0c1d-2e3f4a5b6c7d
status: experimental
description: Detects suspicious HTTP request patterns that may indicate exploitation attempts against Apache HTTP Server
references:
  - https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-method|contains:
      - 'PUT'
      - 'DELETE'
      - 'TRACE'
      - 'CONNECT'
  selection2:
    cs-uri-query|contains:
      - 'cmd='
      - 'exec='
      - 'system('
      - 'shell_exec'
      - 'passthru'
      - '../../'
      - '%2e%2e'
  condition: selection or selection2
falsepositives:
  - Legitimate API calls using PUT/DELETE
  - Security scanning tools (should be identified and whitelisted)
level: medium

// Hunt for Apache exploitation attempts and post-exploitation activity
// Assumes Apache logs are ingested via Syslog or CEF connector

union isfuzzy=true
(Syslog
| where ProcessName contains "apache" or ProcessName contains "httpd"
| where SyslogMessage has_any ("cmd=", "exec=", "system(", "shell_exec", "../../", "%2e%2e")
| project TimeGenerated, Computer, SourceIP=HostIP, SyslogMessage, ProcessName),
(DeviceProcessEvents
| where InitiatingProcessFileName has_any ("httpd", "apache2")
| where FileName has_any ("sh", "bash", "python", "perl", "nc", "wget", "curl")
| where not(FileName has_any ("rotatelogs", "apachectl"))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName),
(CommonSecurityLog
| where DeviceVendor == "Apache"
| where RequestURL has_any ("cmd=", "exec=", "system(", "../../", "%2e%2e")
| project TimeGenerated, SourceIP, RequestURL, RequestMethod, DeviceAction)
| order by TimeGenerated desc

-- Hunt for suspicious Apache child processes and web shell artifacts
SELECT 
    Pid,
    Ppid,
    Name,
    Exe,
    CommandLine,
    Username,
    CreateTime
FROM pslist()
WHERE 
    (Name =~ 'httpd|apache2' OR Exe =~ 'httpd|apache2')
    AND (
        CommandLine =~ 'sh|bash|python|perl|nc|wget|curl'
        OR Exe =~ '/bin/sh|/bin/bash|/usr/bin/python|/usr/bin/perl'
    )

-- Also hunt for recently created executable files in web directories
SELECT 
    FullPath,
    Size,
    Mtime,
    Ctime
FROM glob(globs='/var/www/**/*.php,/var/www/**/*.jsp,/var/www/**/*.sh')
WHERE Mtime > now() - 86400  -- Files modified in last 24 hours
ORDER BY Mtime DESC

#!/bin/bash
# Apache HTTP Server CVE-2026-119618 Remediation and Verification Script
# Run with root privileges

set -e

echo "=== Apache CVE-2026-119618 Remediation Script ==="
echo ""

# Detect Apache installation and version
echo "[1] Detecting Apache installation..."
if command -v httpd &> /dev/null; then
    APACHE_BIN=$(which httpd)
    APACHE_VERSION=$($APACHE_BIN -v | grep -i version)
    echo "    Found: $APACHE_VERSION"
elif command -v apache2 &> /dev/null; then
    APACHE_BIN=$(which apache2)
    APACHE_VERSION=$($APACHE_BIN -v | grep -i version)
    echo "    Found: $APACHE_VERSION"
else
    echo "    ERROR: Apache not found on this system"
    exit 1
fi

# Backup current configuration
echo ""
echo "[2] Backing up Apache configuration..."
BACKUP_DIR="/root/apache_backup_$(date +%Y%m%d_%H%M%S)"
mkdir -p $BACKUP_DIR
if [ -d /etc/httpd ]; then
    cp -r /etc/httpd $BACKUP_DIR/
    echo "    Backed up to: $BACKUP_DIR/httpd"
elif [ -d /etc/apache2 ]; then
    cp -r /etc/apache2 $BACKUP_DIR/
    echo "    Backed up to: $BACKUP_DIR/apache2"
fi

# Update Apache (Debian/Ubuntu)
echo ""
echo "[3] Updating Apache..."
if command -v apt-get &> /dev/null; then
    echo "    Detected Debian/Ubuntu system"
    apt-get update
    apt-get install --only-upgrade apache2 -y
    systemctl restart apache2
    echo "    Apache updated and restarted"
# Update Apache (RHEL/CentOS)
elif command -v yum &> /dev/null; then
    echo "    Detected RHEL/CentOS system"
    yum update httpd -y
    systemctl restart httpd
    echo "    Apache updated and restarted"
# Update Apache (Fedora)
elif command -v dnf &> /dev/null; then
    echo "    Detected Fedora system"
    dnf update httpd -y
    systemctl restart httpd
    echo "    Apache updated and restarted"
else
    echo "    WARNING: Package manager not detected. Manual update required."
fi

# Verify new version
echo ""
echo "[4] Verifying patched version..."
NEW_VERSION=$($APACHE_BIN -v | grep -i version)
echo "    Current version: $NEW_VERSION"
echo "    Please verify this version includes the CVE-2026-119618 patch"

# Check for suspicious processes
echo ""
echo "[5] Checking for suspicious Apache child processes..."
SUSPICIOUS=$(ps aux | grep -E "(httpd|apache2)" | grep -E "(sh|bash|python|perl|nc)" | grep -v grep || true)
if [ -n "$SUSPICIOUS" ]; then
    echo "    WARNING: Suspicious processes detected:"
    echo "$SUSPICIOUS"
else
    echo "    No suspicious processes found"
fi

# Check for recently modified files in web directories
echo ""
echo "[6] Checking for recently modified files in web directories..."
if [ -d /var/www ]; then
    RECENT_FILES=$(find /var/www -type f \( -name "*.php" -o -name "*.jsp" -o -name "*.sh" \) -mtime -1 2>/dev/null || true)
    if [ -n "$RECENT_FILES" ]; then
        echo "    Files modified in last 24 hours:"
        echo "$RECENT_FILES"
    else
        echo "    No recently modified executable files found"
    fi
fi

echo ""
echo "=== Remediation Complete ==="
echo ""
echo "Next steps:"
echo "1. Verify the Apache version matches the patched version from vendor advisory"
echo "2. Review any suspicious processes or files identified above"
echo "3. Monitor Apache logs for exploitation attempts"
echo "4. Implement network segmentation to limit web server access"
echo ""