WordPress ecosystem CVE count (core + plugins + themes): 18,005 (Source: NVD/NIST data via WebPulse Framework Score Pipeline (collected July 2026))
Coding and Cybersecurity, Same Model, Same Session
Anthropic's Claude Opus 5 is now live on Amazon Bedrock and Claude Platform on AWS, available to AWS customers in supported regions subject to Anthropic's usage policies. Anthropic frames the release around two capabilities living in the same model: coding and cybersecurity work. Per Anthropic, Opus 5 improves on Opus 4.8's cyber performance while extending coding capability. For WebPulse, the relevant detail isn't the benchmark delta. It's that a single, widely accessible AI system now writes production code and evaluates security posture in the same session. That convergence changes what framework choice means for the organization footing the bill, because the model that builds a site and the model that probes it are increasingly the same one.
The Terrain an AI Model Encounters
A coding-and-cybersecurity model doesn't invent vulnerabilities from nothing — it works against whatever surface already exists in a given codebase. That surface varies by framework, and a framework's disclosed vulnerability history is one proxy for the surface an AI-assisted attacker could probe. CVE counts measure disclosed vulnerabilities in actively maintained, open codebases — not a ranking of which framework is inherently risk-free, since closed platforms patch privately and accumulate fewer public entries by design.
An important caveat: Hugo's zero count reflects a fundamentally different architecture — no server-side runtime, no database, no admin login, no plugin-execution surface. The entire class of vulnerability WordPress accumulates (SQLi, auth bypass, RCE via plugins) structurally cannot exist for static-site output. Zero CVEs here signals architecture, not superior engineering. But the architectural difference is precisely the point: framework choice determines what kind of surface exists for any tool — human or AI — to work against.
Where the Federal Catalog Currently Points
The federal government's own exploited-vulnerability tracking shows where that terrain currently matters most. As of the July 24, 2026 CISA Known Exploited Vulnerabilities catalog snapshot, WordPress carries 6 entries, including CVE-2026-60137, a SQL injection vulnerability added July 21, 2026 with a remediation due date of August 4, 2026. That deadline applies to federal agencies under Binding Operational Directive 22-01 — it is not a universal SLA for every WordPress install. The broader catalog held 1,653 entries as of the same snapshot, so WordPress's 6 entries are one line among many rather than an outlier finding on their own.
What Budget Signers Should Track
None of this means AI models are targeting any single framework. What it does mean for budget signers: the codebase an organization runs is the terrain an increasingly capable AI model will encounter the moment it's asked to do security work against a given site. Framework choice has stopped being purely a developer preference — it now shapes the disclosed vulnerability surface that any assessment tool, human or automated, has to navigate.
