In case you missed it, it's been a spectacularly bad week for programming language runtimes.
In the space of a few days, we've had:
PHP: Two critical remote code execution vulnerabilities, both rated 9.2 under CVSS v4.0, prompted emergency security releases on October 21. Another advisory followed on October 23 concerning session handling.
Ruby: Four GitLab-related CVEs involving memory corruption in Ruby's regular expression engine, including double-free and integer-overflow vulnerabilities. Under the right circumstances, malicious regex patterns could lead to remote code execution. Emergency.
Ruby updates followed on October 23.
Node.js: Multiple security vulnerabilities, including an out-of-bounds memory write in Brotli decompression, TLS certificate validation issues, and permission-model bypasses. Security updates landed October 21.
Go: Security updates addressing multiple vulnerabilities, including issues tracked under CVE-2026-111943, CVE-2026-78667, CVE-2026-78669, and CVE-2026-97031. Updated Go packages were released October 21.
Java: Oracle's October 20 Critical Patch Update included 55 new security patches for Java SE, with Oracle reporting that 49 addressed vulnerabilities potentially exploitable remotely without authentication.
And them’s just the highlights.
Honestly, these aren't all equally exploitable, and not all of them are vulnerabilities in the language implementations themselves.
But there's something interesting happening here.
Many of these problems aren't about dynamic typing, or even the languages themselves. But rather, memory management, native dependencies, complicated runtime internals, and decades of accumulated implementation tradeoffs.
The good news is that we’re getting better at finding them.
I suspect AI-assisted vulnerability discovery is going to make the next few years uncomfortable for the maintainers of mature software ecosystems because the economics of finding bugs are changing much faster than the economics of fixing them.
It's going to be an interesting few years.
In the meantime, keep pressing those update buttons.