"Attacks against web applications constitute more than 60% of the total attack attempts observed on the Internet," the report states. "Despite the enormous number of attacks and despite widespread publicity about these vulnerabilities, most web site owners fail to scan effectively for the common flaws and become unwitting tools used by criminals to infect the visitors that trusted those sites to provide a safe web experience."

It's not all doom and gloom though.

SANS did find that one type of attack that I used to see every so often has now declined.  SANS reported that there has been a large decline in the number of "PHP File Include" attacks. The decline comes from improved processes used by developers and security pros, according to SANS.

All this doesn't take the operating system vendors off the hook, in my view.

What has happened is attackers are looking for the best route to compromise the most machines, regardless of OS. If a web app is vulnerable, all the attacker needs to do is infect the one server in order to propagate their attack to thousands (or millions of users).

"There are few attacks against the operating system itself, and patching has become pretty robust when it comes to the operating system and its core components," SANS researchers Johannes B. Ullrich blogged.