A security hole in Apache enables attackers to inject instructions into a log file that could be executed as soon as an administrator opens the file.