On: WordPress: Unauthenticated path traversal leading to conditional RCE

[dwattttt]

You could've included a little more nuance. An interpretation of your response is "being the most popular remotely accessible software" != "the most attacked", which would need defending.

[hdgvhicv → dwattttt]

25 years ago alache hosted about 10 times as many sites as IIS, yet IIS was always the one being backed.

[graemep → dwattttt]

I imagine anyone with any knowledge of the field could see the flaws in the claim that most popular = most attacked.

Lots of counter examples and definitely no clear relationship. IMO its up to the person making the claim to provide evidence.

[dwattttt → graemep]

Just to expand on that nuance then, "attacked" is not restricted to "successful attacks".

The most popular widely deployed software will be the most valuable to attack. That most fail is a function of other properties of the software.