Web 2.0 is causing a splash as it stretches the boundaries of what Web sites can do. But in the rush to add features, security has become an afterthought, experts say. The buzz around the new technology echoes the '90s Internet boom--complete with pricey conferences, plenty of start-ups, and innovative companies like MySpace.com and Writely being snapped up for big bucks. And the sense of deja vu goes even further for some experts. Just as in the early days of desktop software, they say, the development momentum is all about features--and protections are being neglected.

"We're continuing to make the same mistakes by putting security last," said Billy Hoffman, lead engineer at Web security specialist SPI Dynamics. "People are buying into this hype and throwing together ideas for Web applications, but they are not thinking about security, and they are not realizing how badly they are exposing their users." Yamanner, Samy and Spaceflash are among the higher-profile attacks that have surfaced online. The Yamanner worm targeted Yahoo Mail, harvesting e-mail addresses and forwarding itself to all contacts in a user's Yahoo address book. The Samy and Spaceflash worms both spread on MySpace, changing profiles on the hugely popular social-networking Web site.