Business Efficiency

Orkes CTO Viren Baraiya says the safe way to run agents borrows from workflow ideas that already exist.

Eli Cohen of Snyk argues that testing by calendar cannot match code shipped nonstop and attackers who never pause.

Matt Lawler says a bought bot solved about 10%; AssemblyAI's own agent reached 80% in week one, by its account.

Apache Ossie aims to let companies define 'revenue' once and reuse it across analytics and AI tools.

Civil Service Deputy CISO: a 2025 audit found "no proper implementation plan" three years into the 2022 strategy.

A five-hour outage shows what happens when Copilot and Graph share infrastructure with SharePoint and Teams.

The AI industry's default playbook — pretrain at scale, rent through an API — doesn't fit the businesses running it. Domain specificity is the product.

Microsoft's shutoff notice for Windows 11 24H2 Home and Pro runs on the same support-lifecycle mechanic WebPulse tracks across detected web frameworks.

KB5099539 puts an exact, escalating price on staying patched past end-of-life — a reference point for every budget that funds aging infrastructure

Two flaws were already under active attack when July's update batch — the largest in recent memory — shipped.

A testing pipeline built to check what a VPN is bought for found traffic leaks and tracking across the free tier of Google Play.

Deny-by-default agent identity is arriving inside cloud platforms — WebPulse's census shows the public web has almost nothing comparable

Savi raised $7M to fight AI-cloned ransom calls. The broader legacy web infrastructure that scam operations often rely on shows no comparable investment in defense.

WebPulse extracted WordPress version numbers from 244 sites in the Tranco top 10K. Only 44% run WordPress 7.0. The majority are still on 6.x. Some are on 4.x.

WordPress vulnerability scanners test against known CVEs in core, themes, and plugins. But the attack surface extends far beyond what any scanner checks. Configuration drift, abandoned plugins removed from vulnerability databases, server-level misconfigurations, and supply chain risks from premium themes create exposure that no automated scan can surface. A clean report is not a clean site.

Development velocity without architectural reform produces the illusion of progress. Joomla's data makes the case.

Drupal has more KEV entries than any CMS. The latest PostgreSQL RCE was added May 2026.

The CMS that powers 43% of detected sites does not trust its own rendering stack for its own admin interface. WordPress Core team confirms React 19 migration for version 7.1.

Kentucky, Rhode Island, and Indiana joined the privacy enforcement wave in January 2026. Web applications must now handle data subject requests, consent management, and data deletion across 20 distinct legal frameworks.

South Korea's largest e-commerce platform exposed 33 million customer records. Custom-built stacks without framework-level data protection create regulatory and financial liability at national scale.

CVE-2026-10795 in UpdraftPlus — the most popular WordPress backup plugin — allows unauthenticated attackers to upload and activate malicious plugins via a cryptographic collapse to an all-zero key. Wordfence blocked 4,987 exploitation attempts in 24 hours. The tool installed to protect WordPress sites became the door attackers walked through.

60-80% of enterprise IT budgets go to 'keeping the lights on.' The U.S. technical debt burden stands at $2.41 trillion. One organization spent $67M/year on legacy maintenance — a $23M rebuild cut ongoing costs by 52%. The numbers are no longer theoretical.

Essential entities across the EU must complete formal NIS2 compliance audits by month's end. Penalties: up to 10 million euros or 2% of global revenue. Legacy web infrastructure running unpatched CMS plugins is the gap auditors will find first.

W3Techs: 43.2% in December 2025 to 41.9% by May 2026. A 1.3 percentage point drop in six months — double the decline of all 2025. The fastest-growing segment is sites with no detectable CMS at all.

TYPO3-CORE-SA-2026-019. Broken access control in the Form Framework allows maliciously crafted form definitions to execute arbitrary SQL and create admin accounts. The legacy CMS vulnerability pattern is not WordPress-specific — it is architectural.

Securing WordPress backups in 2026: Admin access and vulnerabilities

Across 10.1 million sites scanned, self-managed platforms show significantly higher vulnerability counts.

CVE-2026-9082. Highly critical. Anonymous SQL injection in Drupal core — not a contributed module, not a plugin, the core framework itself. CISA added it to the Known Exploited Vulnerabilities catalog. Exploit attempts detected in the wild since May 22.

CVE-2026-4798. CVSS 7.5. The best-selling WordPress theme of all time — 700,000+ sales — lets unauthenticated attackers extract hashed passwords from the database. You paid $69 for this.

CVE-2026-0740. A critical file upload vulnerability in the Ninja Forms File Uploads plugin. Unauthenticated attackers upload arbitrary files. Full site compromise. No login required.

CVE-2026-8206. CVSS 9.8. The Kirki page builder plugin's password reset mechanism lets attackers take over administrator accounts. 150,000 sites running the vulnerable version right now.

At 7.8% of detections, a hosted e-commerce platform outnumbers every modern framework combined in WebPulse scans.

The framework most developers consider dead has more live detections than Astro, SvelteKit, and Hugo combined.

Legacy framework costs don't stay flat. Plugin compatibility breaks compound. Security patches accelerate. Hosting requirements grow. By year 5, you're paying 4x what you started with.

8.25 million legacy sites × $4,200-$38,000/year in total cost of ownership. The aggregate infrastructure bill for legacy web frameworks exceeds many countries' GDP.

WordPress concentration varies from 35% to 93% by country. Each percentage point is a maintenance cost multiplier. Some countries are paying 3x the infrastructure tax of others.

7.4 million WordPress sites. Average 20-30 plugins each. Every plugin requires updates, compatibility testing, and security monitoring. The aggregate cost is staggering — and invisible.

WordPress: PHP + MySQL on every request. Astro: static CDN delivery. At 7.4M WordPress sites serving billions of pages daily, the carbon difference between legacy and modern is measurable. The sustainability case nobody is making.

Japan (median developer age ~42): 87% WordPress. India (median ~26): fintech 100% modern, broad web 83% WP. The workforce age predicts the framework. The developer pipeline IS the framework pipeline.

.za: 18,545 detected. WordPress 75%, Shopify 12%, Squarespace 4.3%, Drupal 3.4%, Angular 2.1%. Africa's most developed digital economy is 17% platform.

Shopify + Wix + Squarespace combined: 822,717 detections (9.8% of detected). Drupal: 344,003 (4.1%). Ratio: 2.4x. Organizations stopped choosing between CMS options and chose 'don't manage infrastructure at all.'

GDP per capita of $100K+. Precision engineering, banking, pharma. And 63% WordPress across 23,268 detected sites. Wealth doesn't automatically buy modern infrastructure.

10,684 detected .nz sites. 41% Shopify. 52% WordPress. Nearly half the detectable New Zealand web runs on one ecommerce platform — beating Australia, Pakistan, and every other country TLD.

E-residency, digital ID, paperless government. Estonia's digital reputation is legendary. Its broad web infrastructure tells the same story as Sweden.

5.4% Magento on .ae domains — the highest rate of any country. Alongside 6.7% Next.js and 3.4% Angular, UAE has the most enterprise-ecommerce web we've measured.

Australia: Shopify 31% vs Drupal 2%. UK: 17% vs 3%. Canada: 20% vs 3%. The 'platform > framework' thesis confirmed across every market we measured.

Russia (12%), Germany (8%), Greece (11%) — the known Joomla markets. Thailand at 21% is the surprise nobody saw coming.

We said Shopify was an English-language phenomenon. Pakistan — where English is an official but second language — has a higher Shopify rate than the UK.

Spotify and Klarna are modern. The rest of the Nordic web is not. 3,949 .se sites, 9,918 .nl sites — large enough samples to be definitive.

From 500K to 10M, Angular's share stayed at 1.65%. The most stable number in our entire dataset.

WordPress (74.3%) + Shopify (7.8%) + Drupal (4.5%) = 86.6%. Twenty-two other frameworks share the remaining 13.4%.

777,276 Shopify detections (7.8%) vs 444,706 Drupal (4.5%). Commerce ate CMS. The gap is 1.7x at 10M scale.

Australia 30% Shopify, UK 18%, Canada 19%. Germany 6%, Japan 6%, Brazil 2%. The ecommerce platform divide follows language, not GDP.

The startup ecosystem didn't trickle down. Among 7,497 detected .id domains in our scan, 87% run WordPress — despite the country's tech unicorns running modern stacks.

16,224 out of 16,900 detected .tr sites in our Common Crawl scan run WordPress. Among sites where we could detect a framework, a near-monoculture.

Among 6 major nonprofit sites we scanned: 4 Drupal, 2 WordPress. Too small for definitive claims, but the Drupal pattern aligns with what we see in government.

3,449 Shopify detections in Common Crawl. The ecommerce infrastructure decision has already been made — by Shopify.

38 university and education sites scanned — a small sample, but 76% legacy across every region. ASEAN education: 93% legacy. The pattern is consistent.

BMW, Mercedes, VW, Renault — we scanned them all. The gap between industrial ambition and web infrastructure is striking.

The institutions that teach the next generation of developers run their own websites on the framework their graduates would never choose.

We scanned both sectors. Stripe, Plaid, Robinhood — all Next.js. whitehouse.gov, NASA, IRS, EPA — all WordPress or Drupal.

BMW, Mercedes, VW invest billions in digital transformation. Their public web infrastructure tells a different story.

California modernized. Mississippi didn't. The digital divide between US state governments mirrors — and may widen — the economic divide.

More than 80% of the federal IT budget goes to keeping old systems alive. That's not modernization — that's life support paid by taxpayers.

Indian IT services companies build cutting-edge systems for global clients. Their own internal infrastructure tells a different story.

SAP, Oracle, Salesforce — enterprise platforms that cost more every year and get harder to leave every quarter. The subscription trap at scale.

Every organization has one. The critical internal application where the original developer left and the documentation doesn't exist.

WordPress is the visible 43%. Beneath it: millions of custom apps, enterprise systems, and internal tools built for a world that no longer exists.

New developers aren't learning WordPress. Experienced developers are leaving. The talent economics are shifting against legacy frameworks.

It's free to download. It's not free to run. We calculated what nobody talks about.

Not our data. Published research from Google, Akamai, and Deloitte on the measurable revenue impact of load time.

Security patching, plugin maintenance, hosting overhead — the costs nobody talks about.