Node.js sounds the alarm: code used by Netflix has a critical flaw
cybernews.com
10 vulnerabilities make Node.js security updates urgent for services using Brotli, TLS, DNS, and files. See which risks admins face

Node.js has just released fixes for 10 security vulnerabilities that could put node-powered applications at risk and is urging everyone to update their systems.

  • darthsundhaft@piefed.socialEnglish
    18·
    1 day ago

    Yeah, so here’s the thing. People keep trying to bash on PHP as if anything software isn’t manmade and comes baked with flaws that can be exploited. It’s the single reason why cybersecurity products are never going to stop being used because no matter what, it’s based on something somebody made.

    It’s going to be flawed or be exploitable by some means. Yesterday it was Log4J, now it’s PHP, tomorrow it will be something else. It will never end. Companies deliberately also use this to force you to upgrade because they’ve abandoned “legacy” products that still work but which they no longer choose to maintain because they want more money and need to stifle you for it somehow.

    • neclimdul@lemmy.worldEnglish
      7·
      1 day ago

      rihht? opencloud posted a really tacky “nextcloud is dealing with this. checkout open cloud. written in go.”

      dude… do we need to drop a link to the golang cves? they had a critical bug this year.

      ruby? critical regex rce this week.

      nodejs? same.

      php made the news because of the embargo break making it go viral and everyone loving to hate on php. But people in glass houses should be careful throwing stones.

      • treverflume@lemmy.mlEnglish
        1·
        1 day ago

        How’s Rust holding these days I wonder? Always wished I had learned it when it first came out ha.

        • neclimdul@lemmy.worldEnglish
          2·
          19 hours ago

          Rust itself doesnt get mant CVEs and its been quiet so thats nice.

          its worth noting its a bit different than languages I listed and lower-level. Those languages are also runtimes that provide a large set of features that run with your code.

          That means while you could write websites in Rust, reall it is what you might consider writing PHP in if you started in 2026 not an alternative. Its more closely like MUSL(did get a recent big security release 🙄) or glibc.