Admins and defenders gird themselves against maximum-severity server vulnerability

Open source React executes malicious code with malformed HTML—no authentication needed.

See full article...

 

[enlightened.doggo]

You don't need SSR for SEO. Every search engine worth its salt renders client-side Javascript before crawling the page.

Load times are factored into rankings. Not rendering HTML on initial load for a marketing website is busch league.

 

[McTurkey]

True, but superficial explanation. The real common denominator is that it's impossible to program large, complex programs without any mistakes whatsoever. Add that on top of the problems I stated in my own comment and you get the situation with web security the industry finds itself in. The more complex the program, the more likely exploitable problems will be found. The less experienced the programmer or the less well supported they are in general, the likelihood of making mistakes goes way up.

Er, yes, but your dismissal of my explanation of superficial is ironically completely missing the point.

A hypothetical security vulnerability that is never noticed or exploited is as much of a vulnerability as the pipe wrench that threatens the integrity of a programmer's skull. Popular software is a big juicy target for analysis and innovative attacks. How complex something is doesn't inherently make the probability of finding exploits any higher--it only makes their hypothetical existence more likely. To be found, an exploit requires someone to take the time to look, which is a direct function of popularity and/or the value of the target.

 

[BilTheGalacticHero]

It's incredibly common to call security vulnerabilities "vulns" in programming and technical areas.

I've been in the industry for more than four decades and I've never heard that slang before. Also, in the forum the full word is spelled out in the article title indicating the use of "vuln" is an error. Do with that what you want,

 

[daveIT]

I'm so glad that I am now a retired IT Manager

Yeah, now you only need to worry about your bank, hospital, extramarital dating sites, etc actually patching THEIR shit.