Gentoo GLSA-202611-10: Apache HTTPD Unauthenticated RCE — Detection and Remediation Guide

---
title: Apache HTTPD Process Spawning Suspicious Shell
description: Detects the Apache web server process (apache2, httpd) spawning command shells or script interpreters, indicative of web shell activity or post-exploitation.
status: experimental
author: Security Arsenal
date: 2026/04/06
references:
  - https://linuxsecurity.com/advisories/gentoo/gentoo-glsa-202611-10-apache-httpd
  - https://attack.mitre.org/techniques/T1059/
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/apache'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/php'
      - '/nc'
      - '/netcat'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate CGI scripts or administrative maintenance scripts
  - Monitoring agents performing health checks
level: high
---
title: Apache HTTPD Writing Executable Files to Web Root
description: Detects the Apache process creating executable files (PHP, CGI, scripts) in web-accessible directories, a common indicator of web shell deployment.
status: experimental
author: Security Arsenal
date: 2026/04/06
references:
  - https://attack.mitre.org/techniques/T1505.003/
logsource:
  category: file_event
  product: linux
detection:
  selection:
    Image|endswith:
      - '/apache2'
      - '/httpd'
    TargetFilename|endswith:
      - '.php'
      - '.jsp'
      - '.jspx'
      - '.asp'
      - '.aspx'
      - '.sh'
      - '.cgi'
    TargetFilename|contains:
      - '/var/www/'
      - '/srv/www/'
      - '/htdocs/'
      - '/public_html/'
  condition: selection
falsepositives:
  - Legitimate file uploads by authorized users
  - Content management system updates
level: medium
---
title: Apache HTTPD Anomalous Outbound Network Connection
description: Detects Apache establishing outbound connections to uncommon ports or external IP addresses, potentially indicating reverse shell or C2 activity.
status: experimental
author: Security Arsenal
date: 2026/04/06
references:
  - https://attack.mitre.org/techniques/T1071.001/
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/apache2'
      - '/httpd'
    DestinationPort:
      - 4444
      - 5555
      - 6666
      - 7777
      - 8888
      - 9999
      - 1337
      - 31337
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection
falsepositives:
  - Internal health checks
  - Load balancer traffic
level: high

// Hunt for Apache processes spawning unexpected child processes (potential web shells)
let suspicious_children = dynamic(["sh", "bash", "dash", "python", "python3", "perl", "nc", "netcat", "php", "curl", "wget"]);
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ("apache2", "httpd", "apache")
| where FileName in~ (suspicious_children)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc

// Alternative: Check Syslog for Apache-related anomalies (if ingesting Linux syslogs)
Syslog
| where TimeGenerated > ago(24h)
| where ProcessName contains "apache" or ProcessName contains "httpd"
| where SyslogMessage contains "error" or SyslogMessage contains "crit" or SyslogMessage contains "segfault"
| summarize count() by Computer, ProcessName, SyslogMessage
| order by count_ desc

-- Hunt for suspicious child processes of Apache and recent file modifications in web directories
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, 
       Ppid, Parent.Name as ParentName, Parent.CommandLine as ParentCommandLine
FROM pslist()
WHERE Parent.Name =~ 'apache|httpd'
   AND (Name =~ 'sh|bash|python|perl|php|nc|curl|wget' 
        OR CommandLine =~ 'curl|wget|nc -|bash -i|/dev/tcp')

-- Hunt for recently modified executable files in web roots (potential web shells)
SELECT FullPath, Size, Mtime, Ctime, Mode
FROM glob(globs=['/var/www/**/*.php', '/var/www/**/*.sh', '/srv/www/**/*.php', '/var/www/**/*.cgi'])
WHERE Mtime > now() - 86400  -- Last 24 hours
ORDER BY Mtime DESC

#!/bin/bash
# Gentoo Apache HTTPD Security Update - GLSA-202611-10 Remediation Script
# Run as root or via sudo

echo "=== Gentoo Apache HTTPD Security Remediation ==="
echo "Advisory: GLSA-202611-10 (Unauthenticated RCE)"
date

# Check if Apache is installed
if ! command -v apache2 &> /dev/null && ! command -v httpd &> /dev/null; then
    echo "[!] Apache HTTPD not found. Skipping."
    exit 0
fi

# Sync Portage tree to get latest security fixes
echo "[*] Syncing Gentoo repository..."
emerge --sync

# Check for GLSA (Gentoo Linux Security Advisory)
echo "[*] Checking for applicable GLSA updates..."
glsa-check -l affected | grep -i apache

# Update Apache and dependencies
echo "[*] Updating Apache HTTPD..."
emerge --update --deep --newuse --verbose www-servers/apache

# Alternative: Update entire system (recommended for security)
# emerge --update --deep --newuse @world

# Verify installation
echo "[*] Verifying Apache version..."
apache2 -v 2>/dev/null || httpd -v 2>/dev/null

# Check if service is running and restart if necessary
echo "[*] Restarting Apache service..."
if systemctl is-active --quiet apache2; then
    systemctl restart apache2
    echo "[+] Apache2 service restarted"
elif systemctl is-active --quiet httpd; then
    systemctl restart httpd
    echo "[+] HTTPD service restarted"
else
    echo "[!] Apache service not currently running"
fi

# Verify no suspicious child processes
echo "[*] Checking for suspicious Apache child processes..."
ps aux | grep -E "(apache|httpd)" | grep -E "(sh|bash|python|perl|nc|curl|wget)" | grep -v grep

# Check for recent file modifications in web roots (last 24 hours)
echo "[*] Checking for recently modified files in web directories..."
find /var/www /srv/www /home/*/public_html -type f \( -name "*.php" -o -name "*.sh" -o -name "*.cgi" \) -mtime -1 2>/dev/null | head -20

echo "=== Remediation Complete ==="
echo "[!] ACTION REQUIRED: Verify the version output above includes the security fix."
echo "[!] Review any files listed above for signs of web shells."