An industry panel of more than 30 US and international cyber security organisations has published a list of the top 25 programming security errors, and warned that the next generation of developers is still not being trained to deal with the problems.
The warning came from experts at the Sans Institute, the US Department of Homeland Security's National Cybersecurity Division and the National Security Agency's Information Assurance division, as well as from private companies like Symantec and Microsoft.
"There appears to be broad agreement on the programming errors. Now it is time to fix them," said Sans Institute director Mason Brown.
"First we need to make sure that every programmer knows how to write code that is free of the top 25 errors, and then we need to make sure that every programming team has processes in place to find, fix or avoid these problems, and has the tools needed to verify that their code is as free of these errors as automated tools can verify."
Common errors include making software barriers much less porous, poor resource allocation and insecure interaction between software tools. Just two of the errors were responsible for an estimated 1.5 million web site security breaches last year.
"With the top 25 we can spend less time working with police after the house has been robbed and instead focus on getting locks on the doors before it happens," said Paul Kurtz, a principal author of the US National Strategy to Secure Cyberspace (PDF) and executive director of the Software Assurance Forum for Excellence in Code.
Cotton seedling freezes to death as Chang'e-4 shuts down for the Moon's 14-day lunar night
Fortnite easily out-earns PUBG, Assassin's Creed Odyssey and Red Dead Redemption 2 in 2018
Meteor showers as a service will be visible for about 100 kilometres in all directions
Saturn's rings only formed in the past 100 million years, suggests analysis of Cassini space probe data
New findings contradict conventional belief that Saturn's rings were formed along with the planet about 4.5 billion years ago