Nothing wrong with static sites!

https://motherfuckingwebsite.com/

Has pure HTML (no css, no javascript) ever had a serious security issue? On the server side obviously not (outside of the apache/nginx/etc. having application bugs), but even on the client side has there ever been an exploit?

That's why my site will always be html monke.

yes

JavaScript should never have been used that way to begin with.

“If you don’t test for them, the numbers will go down” - President Trump on COVID-19.

I'll bet this is another "AI found a known vulnerability so people are making a big deal about it" like the PHP one.

Who cares if it's vibecoded? The exploit is the exploit.

If it’s really a PoC, it would actually execute and therefore exploit something (otherwise it wouldn’t be a proof). In which case it doesn’t matter if it’s vibecoded or not. If you succeed in breaching a system with it, there’s an issue that needs to be fixed.

It’s not resolved until everyone installs the patch. And there in lies the problem.

This always struck me as a rather silly idea, to be honest.

Now we've come full circle. I have a vendor who is insisting that I use node.js and pull their code from their NPM repository from the same... For frontend code. Just, have the entire contents of your (their) node_modules folder exposed to the public internet at all times. Isn't this just Javascript with extra steps?

While it's a bit opportunistic to blame JS in the backend in this case, I despise JS in the backend enough to happily join you.

Serves you well JS enthusiasts, your programming language is the only one that I despise more the more I learn about it. :P

Well, I mean, the AI advances have moved the mean time to exploit between a zero day being announced, and it actively being exploited en masse, from about 3 weeks in 2018, to about -1 day in 2026. So, things have changed a bit.

rihht? opencloud posted a really tacky "nextcloud is dealing with this. checkout open cloud. written in go."

dude... do we need to drop a link to the golang cves? they had a critical bug this year.

ruby? critical regex rce this week.

nodejs? same.

php made the news because of the embargo break making it go viral and everyone loving to hate on php. But people in glass houses should be careful throwing stones.

What does it do? Serve pictures of cats?

When you've been at battle stations for 12 years it just feels like another week.

Open a ticket and add it to the list.