We are trying to decide which web server to choose for our PHP application.
Which of Apache, nginx or lighttpd is the most secure? Which of these has had the most and most severe security holes?
The OS and web server with which you have the most experience are usually going to be the most secure.
Security depends on all of the layers, not just the web server. If you pick one with very few vulnerabilities, but don't understand how to configure it, you will most likely not understand how to configure it securely.
They are all mature web servers, so the one you understand the best is the one you are going to be able to secure the most.
For me the answer to this question is "it depends".
First off I guess it depends on what you mean by secure. If you're looking for freedom from software defects then you could look at vulnerability stats for the products in question from sites like http://www.secunia.com or http://www.cvedetails.com .
from those you could get a view of how many security issues have been publicly acknowledged and patched, which could lead you to say that a product is more or less secure.
Unfortunately not all products get the same level of scrutiny, so that may not be a good measure.
The other thing to consider is security capabilities. If there are specific security capabilities that you require (eg, WAF integration) then that might drive your choice of webserver.
In terms of your specific question, I'd say that Apache has recently had a fairly good security record (most of the vulns I've seen in more up to date versions tend to be in modules not the core server).
As to the others, you could argue that they're secure if there aren't any published vulnerabilities for them, but then they may still have issues that aren't publicly acknowledged.
Notwithstanding the recent range header craziness, I think you can make a good case for Apache, if you strip it down to only what you need. mod_security is a nice plus for Apache too.
You should also decide not just based on track record but based on how well you think they'll do going forward. A lot of that is a function of process maturity, state of the codebase, etc. I think Apache does pretty well in general, although like I said, strip it down to only what you need.
Apache has a lot of eyeballs on it, meaning it'll have more bugs reported against it, but remember that just because bugs aren't being reported against a product doesn't mean that they're not there, so if you're targeted in an attack, my opinion is that you want the fewest unknowns possible, and Apache probably wins on that count.