http://www.apacheweek.com/issues/03-03-06
The current Apacheweek has an interesting comparison of how several Linux vendors patch and distribute Apache. Here is an excerpt: "There are hundreds of distributions and hundreds of vendors so in order to make this manageable we started out by looking at just Linux vendors that have publicised security updates for Apache in the last few months to the bugtraq mailing list. Where a vendor has multiple versions of products we tried to look at the most recent version of Apache 1.3 (since most vendors do not yet ship Apache 2). Our survey consisted of Connectiva, Debian, EnGarde, Gentoo, Mandrake, OpenPKG, Red Hat, SCO, SuSE, and Trustix." -Vince