&gt;A major security issue with probably the most popular automated image processing toolkit in existence came to light just the other day.<p>Because of all the weird formats it supports.  That&#x27;s why I said jpg&#x2F;png, not &#x27;images&#x27;.  Any software that supports 200 formats probably has severe bugs on the rare ones.  Doesn&#x27;t matter for making a secure image server where you can dictate the format.<p>&gt;In any case, the relative rarity isn&#x27;t really the point. Either it&#x27;s ethically and&#x2F;or legally correct to assign blame for malicious advertising to the final host site that the user actually visits, or it isn&#x27;t. That&#x27;s the principle we&#x27;re really debating, and the rest is just a degree of risk.<p>Whether they are being negligent is relevant.  Allowing known-risky formats that keep failing over and over is negligent.