AI literally turned Python from this silly esolang that PhDs seem to love into the Lingua Franca of Computing.

All LLM tools are built Python-first and all LLMs are trained Python-first.

If there is anything you can believe in beyond gravity and taxes is that an LLM's first tokens on a new shell will be py thon 3.

For JS, your machine running untrusted JS code is the intended use case. In this scenario the JS is sandboxed in whatever JS engine (V8 etc) and does not have access to "dangerous" methods, and the main use case for a JIT vuln is to escape this sandbox to execute code on the host. This applies to regular internet browsing (and visiting potentially malicious sites) and also, e.g., using the built-in browser in a locked down device (such as game consoles) to gain arbitrary code execution.

For Python, this security boundary doesn't exist. I can't really think of a scenario where you would be running potentially malicious Python code in CPython that would need a JIT vuln to escape whatever sandbox it is in instead of, say, calling the functions in Python directly (or using the C FFI to do whatever). I'm sure that in some niche use cases, this scenario might exist, but to me, it seems like the potential attack surface is fairly minimal.

EDIT: Also, I'm pretty sure that Python's copy-and-patch JIT writes code to a writable mapping and then mprotects it to W^X? I don't think it leaves RWX pages lying around at all.

JS has a completely different threat model. And PHP has just been a basketcase from inception.

Can you name some of these JS engine vulnerabilities? And the PHP one had nothing to do with JIT.

I'll get what I want eventually but I might be retired by then.