Apache is one of the most widely used web servers in the world. Your website probably runs on it too, even if you have never given it a thought. On 12 November, Tweakers reported that Apache had patched a serious vulnerability in its HTTP/2 module. Because of this flaw, attackers could run code on a server remotely. The researchers estimated that 64 per cent of all cloud environments could be vulnerable.
This sounds like a problem for large companies, but it also affects small business owners. Here is what is going on and what you should do about it.
What is going on?
HTTP/2 is the way your browser and a web server talk to each other more quickly. Almost every modern website uses it, often without the owner knowing. If there is a flaw in that component, someone from outside the server can give it instructions without logging in. In the worst case, an attacker takes over: they can read files, change a site or use the server for spam and attacks on others.
The good news is that the flaw has been fixed. The bad news is that a fix only helps once it has actually been installed.
Who needs to do something?
That depends on where your website is hosted:
- Standard web hosting: the host manages the server. Ask in writing whether the Apache update has been applied. A good host can confirm that quickly.
- Own VPS or server: then you (or your IT partner) are responsible. Check which Apache version is running and install the security update.
- Website on a modern platform without its own server, such as many Next.js sites: Apache usually plays no role here, but check with whoever manages it.
- Webshop with customer data: an extra reason to ask now, because that is where the data criminals want is stored.
Why this often goes wrong for small businesses
At a large company, a team keeps an eye on updates. At a small business, it is often nobody's job. The website was built a while ago, the server is running, and nobody looks at it again until something goes wrong. Precisely these forgotten servers are the first to be found when a well-known vulnerability appears, because attackers automatically scan the whole internet.
You do not need to become a technical expert. You do need to know who handles the updates and how quickly that happens. Three questions help: who manages the server, how often it is updated, and what happens when a serious vulnerability is reported?
What does sio-IT do about it?
For IT support and security, we look at exactly these things in Waalwijk and the surrounding area, from Tilburg to all of Brabant: which server runs your website, is it up to date, and are backups in place in case things go wrong? For new websites and webshops, we make sure that management and updates are clearly assigned from the start, so you do not have to guess.
Want to know whether your site is affected by this vulnerability? Get in touch and we will look into it for you and tell you honestly what does and does not need to be done.
