Which languages dominate, which are the standard for each kind of work, and which are rising. Reviewed monthly by hand from four public rankings (no single source is enough: each measures something different).

Sdominant
Python T1 · SO4AI, data, automation, backend
JavaScript T6 · SO1the web, everywhere
TypeScript SO6web apps, Node; #1 on GitHub (2025)
Java T4 · SO7enterprise backend, Android legacy
C# T5 · SO8.NET backend, Unity games
SQL T9 · SO2every database
Acore
C T2 · SO11OS, embedded, security research
C++ T3 · SO10games, browsers, HPC, trading
Bash/Shell SO5Linux, DevOps, glue
Go T11 · SO14cloud infra, CLIs, servers
Rust T10 · SO12safe systems code, rising
PHP T12 · SO13WordPress and the classic web
Bniche
PowerShell SO9Windows administration
Kotlin SO15Android
Swift T14 · SO18Apple platforms
R T8 · SO21statistics, research
Lua SO16game scripting, embedding
Dart SO20Flutter apps
Ruby SO19Rails web apps
Clegacy
Visual Basic T7Office and old business apps
Fortran T13scientific computing
COBOL T16banks and governments
Assembly SO17reverse engineering, exploits
Julia T18scientific computing, rising
MATLAB T20engineering, signal processing

As of 2026-10-25. Source: TIOBE (Oct 2026), Stack Overflow Developer Survey 2026, GitHub Octoverse 2025, RedMonk (Jan 2026). Editorial tiers from four public rankings: S = top 10 in most of them; A = top 15 and the standard for a big field; B = the leader of a niche; C = legacy or specialist, still paid. T = TIOBE rank, SO = Stack Overflow usage rank.

Web

frontend and full-stack

  1. TypeScript default for new apps
  2. JavaScript runs in every browser
  3. HTML/CSS markup, SO3

Backend

servers and APIs

  1. Python
  2. Java
  3. C#
  4. Go
  5. TypeScript Node

AI and data

models, pipelines, analysis

  1. Python the AI default
  2. SQL
  3. R statistics
  4. C++ inference engines

Systems and infrastructure

OS, cloud, tooling

  1. Rust
  2. C
  3. C++
  4. Go

Mobile

phone apps

  1. Kotlin Android
  2. Swift iOS
  3. Dart Flutter, both

Games

engines and scripting

  1. C++ Unreal
  2. C# Unity
  3. GDScript Godot, SO23
  4. Lua

Security

research, tooling, exploits

  1. Python tools and automation
  2. C where memory bugs live
  3. Bash and PowerShell living off the land
  4. Assembly reversing
  5. Go modern offensive tools

Rising

momentum in the data

  1. TypeScript passed Python on GitHub (Octoverse 2025)
  2. Rust up to SO12
  3. Julia TIOBE 30 to 18 in a year
  4. Dart TIOBE 41 to 27 in a month

How to read it

Source Measures Bias
TIOBE (T) search-engine hits for “X programming” favours old, widely taught languages (C, Visual Basic); added Mandarin search terms in October 2026, which lifted Python
Stack Overflow survey (SO) what about 14,000 developers used in the past year counts web and scripting tools; skews to Stack Overflow’s audience
GitHub Octoverse contributors to repositories on GitHub open source and new projects; the 2025 edition is the latest
RedMonk GitHub code plus Stack Overflow discussion very stable; January 2026 edition: JavaScript, Python, Java, then PHP and C#

The meta in one line: Python and TypeScript/JavaScript cover most new work; SQL and a shell go with everything; C, C++, Go and Rust run the systems underneath. AI coding assistants push this further: they work best in popular, typed languages, one reason GitHub gives for TypeScript’s rise.

What this means for a security researcher

Python first (tools, automation, AI). Then C, because the bugs security researchers find live in C and C++ code (see the October 2026 incidents). Add Bash and PowerShell for systems, enough JavaScript and PHP to read web code, then Go or Rust. Assembly comes with reverse engineering.

Sources