In my logs I keep getting lots of:
"CONNECT XXX.XXX.XXX.XXX:443 HTTP/1.0" 404 218 "-" "-" "CONNECT XXX.XXX.XXX.XXX:443 HTTP/1.0" 404 218 "-" "-" ... "CONNECT XXX.XXX.XXX.XXX:443 HTTP/1.0" 404 218 "-" "-"
Is this some specific vulnerability?
HTTP CONNECT is used for tunnelling. Apache supports this through the use of mod_proxy_connect.
A badly configured proxy with support for CONNECT may be a security vulnerability, so if you don't need it you should disable it.
I'm not sure how Apache responds to a CONNECT request if these aren't enabled, but a 404 seems unlikely; I would rather expect a 405 or 501. As such, you should probably check your configuration.
It's likely an attempt to use your server as a proxy, possibly from a bot-net virus or script-kiddie. Specifically, though, it's (possibly) someone telnetting into your box, like so:
Are you running a mail server on that box? Do you, by any chance, have firewall logs indicating repeated connections or connection attempts to port 25?
These two articles detail two troubleshooting cases of this same problem:
Combined, they offer several fixes (which I'll summarize for posterity, but you should read the whole threads for context):
Be on the lookout for lines that don't return