HOWTO: Securing Windows filesystem for Apache

tangent — Tue, 21 Jul 2026 13:39:27 GMT

Windows security is a constant cause for concern, with new issues and vulnerabilities being unearthed on a regular basis. However, one potential problem area that has been around for a long time is platform filesystem security (NTFS), and of interest to Apache Lounge users, how that relates to Apache installations.

This brief HowTo document discusses options for restricting access to the Apache installation, to circumvent unwanted access to the configuration and content.

By default, Apache Lounge builds are created and configured with a target directory of C:\Apache24, and it's left to the individual to create that directory and extract the binary distribution from an appropriate download archive.

One issue here is that by default, Windows grants modify access to Authenticated Users, to directories created under the C:\ root, so depending on your server platform, its configuration, and who can log on to your server, you may want to restrict access rights to Apache files, and limit them to local Administrators.

When you create a new C:\Apache24 directory, you can check the Discretionary Access Control Lists (DACLs) assigned to that object (in a command window) using the icacls command:

Code:

C:\>icacls C:\Apache24
C:\Apache24 BUILTIN\Administrators:(I)(OI)(CI)(F)
....

Continue this post on Apache Lounge

Topic Replies: 0

RE: A Fast, Reliable and Proven Setup :: Apache PHP MySQL

James Blond — Tue, 21 Jul 2026 12:58:33 GMT

With the new OpenSSL version, you can have post-quantum algorithms. I've added X25519MLKEM768 to the tutorial. And added SSLOpenSSLConfCmd SignatureAlgorithms

Topic Replies: 12

RE: Wampserver addons & applications

Otomatic — Sat, 18 Jul 2026 08:12:38 GMT

Hi,

- Adminer 5.5.0
https://wampserver.aviatechno.net/files/apps/wampserver3_x64_adminer5.5.0.exe

Topic Replies: 138

RE: PHP 8.5.8, 8.4.23, 8.3.32, 8.2.32, 8.0-8.1, 7.4-7.0, 5.6-5.3

Jan-E — Fri, 17 Jul 2026 13:09:55 GMT

I added an extra extension: fastchart. See
https://github.com/iliaal/fastchart
In the x64 version it includes PDF output, without external dependent DLL's.

Topic Replies: 405

RE: PHP 8.6.0 Alpha 2, 8.5.9 RC1, 8.4.24 RC1 available

Jan-E — Mon, 13 Jul 2026 12:30:43 GMT

PHP 8.6.0 (Alpha 1) has hit the shelves. There were a lot of internal backward incompatibilities, but I managed to fix a lot of them. So the list of extensions is already wuit long.

Topic Replies: 193

RE: Wampserver addons & applications

Otomatic — Sun, 12 Jul 2026 14:22:32 GMT

Hi,

- Adminer 5.4.4
https://wampserver.aviatechno.net/files/apps/wampserver3_x64_adminer5.4.4.exe

Topic Replies: 138

RE: Memcached Cygwin builds

nono303 — Fri, 10 Jul 2026 07:33:46 GMT

new released version 1.6.45

Topic Replies: 58

RE: Wampserver addons & applications

Otomatic — Thu, 09 Jul 2026 13:48:44 GMT

Hi,

- Adminer 5.4.3
https://wampserver.aviatechno.net/files/apps/wampserver3_x64_adminer5.4.3.exe

Topic Replies: 138

RE: Memcached Cygwin builds

nono303 — Tue, 07 Jul 2026 06:42:48 GMT

new released version 1.6.44

Topic Replies: 58

RE: PHP 8.5.8, 8.4.23, 8.3.32, 8.2.32, 8.0-8.1, 7.4-7.0, 5.6-5.3

Jan-E — Mon, 06 Jul 2026 19:34:28 GMT

I updated PHP 5.6 - PHP 8.1 with the security fixes from
https://github.com/remicollet/php-src-security/branches/active

Topic Replies: 405

RE: Mod_Security Version Update 2.9.14

Steffen — Mon, 06 Jul 2026 11:39:52 GMT

Update to 2.9.14.

Runs only with 2.4.67+, for older versions like 2.4.66 copy the lua55.dll from 2.4.67+ to your /bin

Changes :
https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.14

Topic Replies: 7

RE: VS17 binaries 2.4.66 & later, because of imcompatibilty

Jan-E — Mon, 06 Jul 2026 06:53:14 GMT

tangent wrote:

So knowing the PHP download page (https://www.php.net/downloads.php) specifically says their packages are built using VS17, providing an appropriate MS redistributable package is installed, I would hope a mixture of VS17 and VS18 binaries should work together.

FYI: PHP 8.6.0 alpha1 was built using VS18.
https://www.php.net/pre-release-builds.php#windows

Edit They removed the link to PHP 8.6.0 Alpha 1. Look here now: https://downloads.php.net/~windows/qa/

Topic Replies: 2

RE: Memcached Cygwin builds

nono303 — Mon, 06 Jul 2026 06:43:38 GMT

new released version 1.6.43
openssl: 3.5.6 > 3.5.7

Topic Replies: 58

RE: HOWTO: Building extra Apache modules using CMake

tangent — Sun, 05 Jul 2026 16:06:52 GMT

Release 2.0 includes the following build dependency update:

MOD_SECURITY2 (2.9.14)

There are no other changes to the batch file build logic.

Note, ModSecurity 2.9.14 supports LUA 5.5 series, but doesn't yet come with build support for CMake. An updated CMakeLists.txt file for building ModSecurity 2.9.14, can be downloaded from https://pastebin.com/U6d6uwFy.

Topic Replies: 8

RE: VS17 binaries 2.4.66 & later, because of imcompatibilty

tangent — Sun, 05 Jul 2026 13:46:09 GMT

Reading through your post, and the various PHP compatibility issues you've found, you state:

Emphramla wrote:

Now that I have VS17 binary of Apache 2.4.68, there is no more compatibility error in Laragon.

I'm curious to know where you got this Apache 2.4.68 VS17 binary, since the Apache Lounge VS17 download page you reference stopped with a build of Apache 2.4.66 in Dec 2025.

Back in May, Steffen made the statement that he would no longer support VS17 developments, as discussed in post https://www.apachelounge.com/viewtopic.php?p=44331. That's why the VS17 link has been removed from the Downloads section.

That conversation covers potential issues with different versions of the MS redistributable package, admittedly in relation to Windows 7, but that might be relevant to your platform/package combination too.

Indeed, Microsoft provides an explicit statement covering binary compatibility (https://learn.microsoft.com/en-us/cpp/porting/binary-compat-2015-2017), although it's framed in terms of the MSVC toolset (v140 => v145, etc.) rather than the Visual Studio IDE version, e.g. VS16, VS17 ....

Continue this post on Apache Lounge

Topic Replies: 2

VS17 binaries 2.4.66 & later, because of imcompatibilty

Emphramla — Fri, 03 Jul 2026 23:03:03 GMT

I've been going around in circles and stopped after the 2nd trip, and here I am hoping there's a simple answer. My Apache setup is via Laragon in Windows 10 for WordPress development along with discussion forum either MyBB or UBB.Threads

I have been using Apache 2.4.62 VS17 and PHP 8.3 VS16, both 64-bit, and there have been no compatibility problem by PHP's VS16 with Apache's VS17.

I upgraded to Apache 2.4.68 VS18 when I saw the version number progress since .62. I also figured upgrading to PHP 8.4 would be good because of the length of time, but not 8.5 yet because it's so recent and there's the issue of WordPress plugins compatibility.

However, Laragon tells me that Apache 2.4.68 VS18 doesn't like PHP 8.4.22 VS17 because VS17 isn't compatible with VS18. The Apache Lounge site says the higher VS numbers are backwards compatible with the lower, and this cuckoo incompatibility didn't happen prior with Apache 2.4.62 VS17 and PHP 8.3 VS16, and also doesn't happen with Apache 2.4.68 VS18 and PHP 8.3 VS16.

The Apache Haus has VS17 binaries but those downloads are disabled/unavailable, so Apache Lounge is the only source but has only VS18. Is there something that can be put in a "conf" file or "ini" file for the compatibility to work???
----------------------------------------------

Update a while later after I'd decided to do one last effort as a last resort or last-ditch-effort because of an SMTP error for replying to the verification e-mail to create my ....

Continue this post on Apache Lounge

Topic Replies: 2

RE: PHP 8.5.7 and curl 8.20.0 require loading of brotli and zstd

Jan-E — Thu, 02 Jul 2026 11:36:01 GMT

Steffen wrote:

First try copy zstd.dll to libzstd.dll to see if that works.

I want first the reason why PHP builds libzstd.dll ?

Quoting from https://github.com/php/php-src/issues/22359#issuecomment-4744521769

shivammathur
wrote:

We do not have a fork for zstd, it is directly pulled from facebook/zstd. it is because of this patch in winlib-builder that we have a different filename. I'm not sure why @cmb69 added it initially. Maybe he was following a convention we have to use the lib prefix.

Topic Replies: 15

RE: Wampserver addons & applications

Otomatic — Wed, 01 Jul 2026 15:11:19 GMT

Hi,

- PHP 8.2.32
https://wampserver.aviatechno.net/files/php/wampserver3_x64_addon_php8.2.32.exe
- PHP 8.3.32
https://wampserver.aviatechno.net/files/php/wampserver3_x64_addon_php8.3.32.exe
- PHP 8.4.23
https://wampserver.aviatechno.net/files/php/wampserver3_x64_addon_php8.4.23.exe
- PHP 8.5.8
https://wampserver.aviatechno.net/files/php/wampserver3_x64_addon_php8.5.8.exe

Topic Replies: 138

RE: HOWTO: Building Apache and dependencies using CMake

tangent — Fri, 19 Jun 2026 13:01:09 GMT

Release 5.0 includes the following build dependency updates:

OPENSSL (3.6.3)

Other changes are to build the mod_proxy_uwsgi module, which is omitted from the ASF CMake build for some reason.

A section to build ZSTD (1.5.7) libraries has been added, to aid future support for this compression standard.

A bunch of historical release comments have also been removed for clarity; previous details for this topic if needed can be found at https://web.archive.org.

Topic Replies: 111

RE: PHP 8.5.7 and curl 8.20.0 require loading of brotli and zstd

tangent — Fri, 19 Jun 2026 09:21:04 GMT

Thanks to you and @Jan-E for following this through with the PHP developers so quickly, and yes, it looks like their solution going forward will be to link with ZSTD statically. So there will be no need to change the ZSTD names in the Apache Lounge build.

What's interesting in looking through the PHP post is reference to winlib-builder patch https://github.com/winlibs/winlib-builder/blob/master/patches/libzstd.patch, where a decision was made to change the ZSTD library names from zstd to libzstd. This is what has caused this issue, in a similar way to the problems ZLIB caused by changing the names of their libraries in their most recent update.

The downside of linking things statically is program sizes and memory requirements go up; like most things in life it's a compromise.

Regarding the 'ecosystem' needing to adapt, we are looking at the Open Source movement. There are some really clever guys out there, who as developers choose to give their own time and expertise in co-operative ventures to the best of their abilities. I take my hat off to them.

Topic Replies: 15

RE: PHP 8.5.7 and curl 8.20.0 require loading of brotli and zstd

danielruf — Fri, 19 Jun 2026 06:07:47 GMT

Frankly I can not answer, why PHP builds libzstd.dll. As far as I understood, they statically build and include the library via cmake or something like that.

Good news is, that it should not happen with the next PHP release, see https://github.com/php/php-src/issues/22359#issuecomment-4745323072

* copied the file as mentioned in apache/bin (zstd.dll => libzstd.dll).
* removed LoadFile "${basePath}/php/libzstd.dll" from my httpd.conf.
* restarted the Apache service
* reloaded page with phpinfo output
* curl is successfully loaded now

So it seems it is connected to the lib* => * renaming. Something similar happenend with zlib. Why that is so? I don't know.

To me as someone from the outside it looks like this:
* curl changed their requirements (breaking change imho, made in a minor update)
* the whole ecosystem has to adapt (PHP, Apache and likely other distros, packages, ...)

Not sure if and how well this was communicated in the ecosystem.

Topic Replies: 15

RE: PHP 8.5.7 and curl 8.20.0 require loading of brotli and zstd

Steffen — Fri, 19 Jun 2026 05:13:30 GMT

First try copy zstd.dll to libzstd.dll to see if that works.

I want first the reason why PHP builds libzstd.dll ?

Topic Replies: 15

RE: PHP 8.5.7 and curl 8.20.0 require loading of brotli and zstd

tangent — Thu, 18 Jun 2026 21:02:09 GMT

danielruf wrote:

I've now added only the following, instead of brotlidec + libzstd:

LoadFile "${basePath}/php/libzstd.dll"

I've been looking into this issue and trying to reason it through.

Since you say your setup works without specifying the PHP based brotlidec.dll file, that rather suggests it's happy with the Apache bundled version (which I'd expect).

So out of interest, I wonder what happens if you copy the Apache zstd.dll to a file named libzstd.dll, whether Apache will then start without the extra PHP LoadFile directive?

For some reason it would seem the PHP (8.5.7) build process (winlib-builder) chooses a different name for the ZSTD libraries compared to those which come with the standard CMake build on Windows.

Code:

ZSTD PHP
----- -----
zstd.dll libzstd.dll
zstd.lib libzstd.lib

....

Continue this post on Apache Lounge

Topic Replies: 15

RE: PHP 8.5.7 and curl 8.20.0 require loading of brotli and zstd

danielruf — Thu, 18 Jun 2026 11:10:25 GMT

Understood, thank you.

I've now added only the following, instead of brotlidec + libzstd:

LoadFile "${basePath}/php/libzstd.dll"

This seems to work (we generally load the versions shipped with the PHP builds for Windows).

I'll try to report the requirement for this LoadFile in the PHP project. Maybe ther eis something that can be fixed / improved. At least to me it makes not much sense to manually add this, when the libraries are there in Apache and PHP is running as Apache module.

Edit: opened an issue at https://github.com/php/php-src/issues/22359 - maybe some mismatch leads to this

Topic Replies: 15

RE: PHP 8.5.7 and curl 8.20.0 require loading of brotli and zstd

admin — Thu, 18 Jun 2026 11:02:58 GMT

Just try only to include zstd, to see if the issue is brotli or zstd

I think it is a PHP issue. The way it is build causes add some LoadFile.

Topic Replies: 15

RE: PHP 8.5.7 and curl 8.20.0 require loading of brotli and zstd

danielruf — Thu, 18 Jun 2026 10:21:13 GMT

Quote:

Just try only the zstd.dll and libzstd.dll.
...
And have no libzstd.dll

I'm not sure I understand.

My question basically boils down to: why do we even have to manually add some LoadFile entries for the curl extension?

Is this expected and if so, should this be documented somewhere? Why was zstd then included but I still need the LoadFile entry?

I'm currently on your latest build with 2.4.68 (httpd-2.4.68-260617-Win64-VS18).

Topic Replies: 15

RE: PHP 8.5.7 and curl 8.20.0 require loading of brotli and zstd

admin — Thu, 18 Jun 2026 09:13:58 GMT

Just try only the zstd.dll and libzstd.dll.

brotli we have it already for years.

We build from zstd-1.5.7.tar.gz from the bottom of page https://github.com/facebook/zstd/releases.

And have no libzstd.dll

Topic Replies: 15

RE: Wampserver addons & applications

Otomatic — Thu, 18 Jun 2026 06:58:10 GMT

Hi,

- InnoSetup installer created from the Apache Lounge binary

- Apache 2.4.68.1
https://wampserver.aviatechno.net/files/apache/wampserver3_x64_addon_apache2.4.68.1.exe

Topic Replies: 138

RE: PHP 8.5.7 and curl 8.20.0 require loading of brotli and zstd

danielruf — Thu, 18 Jun 2026 06:49:58 GMT

following tried:

LoadFile "bin/brotlidec.dll"
LoadFile "bin/zstd.dll"

Results in:

[18-Jun-2026 06:41:40 UTC] PHP Warning: PHP Startup: Unable to load dynamic library 'curl' (tried: C:\...\php\ext\curl (Das angegebene Modul wurde nicht gefunden), C:\...\php\ext\php_curl.dll (Das angegebene Modul wurde nicht gefunden)) in Unknown on line 0

Tried:

LoadFile "/bin/brotlidec.dll"
LoadFile "/bin/zstd.dll"

Leads to the Apache Service not starting on Windows (Fails with an error:

Der Dienst "apache2.4" wurde mit dem folgenden dienstspezifischen Fehler beendet:
Unzul�ssige Funktion.

Tried:

LoadFile "${basePath}/apache/bin/brotlidec.dll"
LoadFile "${basePath}/apache/bin/zstd.dll"

Results in:

[18-Jun-2026 06:45:28 UTC] PHP Warning: PHP Startup: Unable to load dynamic library 'curl' (tried: C:\...\php\ext\curl (Das angegebene Modul wurde nicht gefunden), C:\...\php\ext\php_curl.dll (Das angegebene Modul wurde nicht gefunden)) in Unknown on line 0

Only the following works for me and adds the curl section in the Output of phpinfo():

LoadFile "${basePath}/php/brotlidec.dll"
LoadFile "${basePath}/php/libzstd.dll"

Topic Replies: 15