Code Tutorials Spread Application Flaws Far and Wide

Researchers from TU Berlin, Saarland University and TU Braunschweig, working with Trend Micro, analyzed 64,415 PHP GitHub projects and identified 117 vulnerabilities that closely match insecure code snippets in popular tutorials and sample code. The study shows that wholesale reuse of tutorial code spreads exploitable issues—such as SQL injection and cross-site scripting—into production software, enabling attackers to efficiently find vulnerable implementations; the authors recommend auditing widely consumed tutorials and applying tools to detect borrowed insecure snippets.