Easy to point and laugh at PHP last week.
But the real lesson isn't about PHP. The same week:
- A bug in the Brotli compression library meant urgent patches for Node.js, Python, Bun and Envoy
- Ruby shipped fixes for regex bugs that GitLab found could be turned into remote code execution
- A poisoned LiteLLM release turned up on PyPI
- Browsers blocked eight eMudhra certificate authorities after their private keys were compromised
Whatever your stack, at some point a serious vulnerability will turn up in something you depend on. It's all but inevitable. Amazon spotted attackers trying the PHP bug four days before the fix was public.
Security moves fast now. Taking precautions still matters, but it's just as critical that you can roll out a fix the moment one drops. That means keeping an eye on dependency updates, staying on the latest versions of your libraries, CI that actually works, tests you trust, and deploys that stay boring even when your site is under load.
I'd argue you should always have had these in place. Now they're a must-have.