React 19 RCE vulnerability - can we stop pretending modern frameworks are automatically more secure?

The React 19 RCE bug from December (CVE-2025-66478) is a good reminder that no framework is magically secure.

I keep seeing people say WordPress is insecure and moving to Next/React solves security problems. But like... React Server Components just had a critical remote code execution vulnerability. WordPress core is actually pretty solid, most security issues are from old plugins or bad hosting.

Security comes from keeping stuff updated, decent infrastructure, not installing random plugins/packages, and actually knowing what you're deploying. That's it.

The "WordPress bad, modern frameworks secure" thing is getting old when they all have vulnerabilities.

Curious if anyone else has clients who think switching stacks = better security? That conversation is always fun.