# Report: PHP, C++, Java, and .NET Applications are the Most Frequently Flawed 

**URL:** <https://onehack.st/t/report-php-c-java-and-net-applications-are-the-most-frequently-flawed/166930>\
**Category:** News & Articles\
**Tags:** tools\
**Created:** [December 20, 2020, 1:55pm UTC](https://onehack.st/t/report-php-c-java-and-net-applications-are-the-most-frequently-flawed/166930 "2020-12-20T13:55:31Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [December 20, 2020, 1:55pm UTC](https://onehack.st/t/report-php-c-java-and-net-applications-are-the-most-frequently-flawed/166930/1 "2020-12-20T13:55:32Z")

</div>

![incident-response-cover-copy](https://onehack.st/uploads/default/original/3X/2/f/2f8f3995984a0043c59c0ac7a2abd9673bb28d9b.jpeg)

Application-security company Veracode “has released the 11th volume of its annual [State of Software Security report](https://www.veracode.com/state-of-software-security-report?utm_source=veracode&utm_medium=pr&utm_campaign=jr-4751120&utm_term=press-release&utm_content=soss-hub), and its findings reveal that flawed applications are the norm, open-source libraries are increasingly untrustworthy, and it’s taking a long time to patch problems,” [reports TechRepublic](https://www.techrepublic.com/article/the-worst-bugs-in-the-top-programming-languages/).

The top three security flaws — like last year — are still information leakage, cryptographic issues, and CRLF injection:_The report found a full 76% of apps contained flaws, and 24% of apps have flaws considered highly severe. Some 70% of apps are inheriting security flaws from their open-source libraries, but it’s important to note that only 30% of apps have more security bugs in their open-source libraries than in code written in-house, suggesting that it isn’t solely open-source projects that are to blame… In terms of how bugs are being resolved, Veracode found that 73% of the bugs it found as part of the report were patched, which is a big improvement over previous years, when that number was in the mid-50% range. Despite that good sign, it’s still taking an average of six months to close half of discovered flaws…_

 

Veracode also released a heatmap of [the worst bugs in the most popular languages](https://www.veracode.com/sites/default/files/pdf/resources/ipapers/security-flaw-heatmap/index.html). Interestingly enough, the language with the least use of open-source libraries is also the one with the most bugs: PHP.

_Looking at the heatmap, it’s easy to spot which of the five popular languages included has the worst security. Following PHP is C++, then Java, .Net, JavaScript, and Python. The latter two are, doing considerably better than the competition, with the worst flaws in each only being found in roughly 30% of apps. Compared to PHP with 74.6% of its apps vulnerable to cross-site scripting, JavaScript and Python are security powerhouses._