The Apache developers are well aware of security concerns and, by default, will install the webserver to run as a specially created user; on my system, most of the apache2 instances are running under the user www-data which I believe is the default (it is a long time since I installed it).