Business Efficiency

Deny-by-default agent identity is arriving inside cloud platforms — WebPulse's census shows the public web has almost nothing comparable

Savi raised $7M to fight AI-cloned ransom calls. The broader legacy web infrastructure that scam operations often rely on shows no comparable investment in defense.

WebPulse extracted WordPress version numbers from 244 sites in the Tranco top 10K. Only 44% run WordPress 7.0. The majority are still on 6.x. Some are on 4.x.

WordPress vulnerability scanners test against known CVEs in core, themes, and plugins. But the attack surface extends far beyond what any scanner checks. Configuration drift, abandoned plugins removed from vulnerability databases, server-level misconfigurations, and supply chain risks from premium themes create exposure that no automated scan can surface. A clean report is not a clean site.

UNC6240 ran a 14-day campaign against campus ERP systems, converting student records into financial leverage

A 2001 game console needs decompilation to understand. Some web stacks are reaching the same threshold.

One-time pricing catches attention. The underlying security delta catches executive budgets.

Laravel-based alternatives are pitching subscription freedom as web platform economics shift beneath enterprise buyers

175,103 detected sites. 152,690 running WordPress. The world's 4th-largest economy has a developing-nation framework profile.

Gatsby takes 273.6 days to close an issue. Astro takes 19.0 days. Your framework's response time is your response time.

Development velocity without architectural reform produces the illusion of progress. Joomla's data makes the case.

33,088 passports, 12,303 plaintext passwords, hardcoded AWS keys. Education legacy infrastructure at scale.

Next.js assigns 427 contributors to 92 CVEs. Drupal assigns 50 to 1,376. The maintenance-to-vulnerability ratio defines operational risk.

WordPress core has roughly 150 CVEs. The other 18,000+ come from plugins. Every 'free' plugin carries a maintenance debt.

Active exploitation confirmed — Django, FastAPI, and Hugo carry zero KEV entries by comparison

International law enforcement dismantled 106 SocGholish servers and remediated 14,971 infected websites. Restaurants, car garages, small businesses — their visitors were being served ransomware. The site owners didn't know, couldn't fix it, or both. Taxpayers funded the cleanup.

Adobe Commerce carries 288 CVEs. Its highest exploitation probability is 97%. Federal agencies must patch.

Carriers are pricing web framework risk. WordPress's 18,321 CVEs are becoming an actuarial input, not just a security metric.

A framework nobody recommends still runs 352,000 sites. The switching cost exceeds the security cost — until a breach reverses the equation.

Vulnerability discovery outpaces feature development. More researchers file bugs than developers ship code.

CVE-2026-35273 scores CVSS 9.8. Unauthenticated RCE via HTTP. Oracle's advisory came 14 days after exploitation began.

Drupal has more KEV entries than any CMS. The latest PostgreSQL RCE was added May 2026.

WebPulse's scan of 10 million websites reveals that Africa's largest economy has the highest WordPress concentration of any country in the dataset. Nigeria, Kenya, and Morocco have built their digital presence almost entirely on a single framework with 18,247 known vulnerabilities. The dependency is structural, not accidental.

Kaspersky's Q1 2026 vulnerability landscape report confirms what WebPulse's data has been showing: public-facing web applications are the primary attack vector for 43.7% of incidents. Not email. Not phishing. The web application itself.

WebPulse scanned 175,103 Japanese domains. 152,724 run WordPress — 87.2%. Only 8.4% use modern frameworks. Japan's WordPress concentration is higher than Iran (90.6%), Turkey (92.3%), or Nigeria (92.6%) in absolute numbers. The digital infrastructure of a $4.2 trillion economy depends on one PHP application.

CVE-2026-8644 lets attackers impersonate any user without credentials. CVE-2026-9311 enables remote code execution. CVE-2026-9319 completes the trilogy with deserialization RCE. All affect WebSphere 8.5 and 9.0. Full patches arrive Q3 2026.

WebPulse's Common Crawl analysis detected frameworks across 10,002,735 sites. WordPress powers 7.4 million of them. The entire 'modern web' — Next.js, Astro, SvelteKit, Remix, Hugo combined — accounts for 3.2%. The web you read about is not the web that exists.

The CMS that powers 43% of detected sites does not trust its own rendering stack for its own admin interface. WordPress Core team confirms React 19 migration for version 7.1.

CVE disclosures hit an all-time record, up 20.6% from 2024. Patchstack reports that third-party WordPress plugins account for the majority of the increase.

Three forces converging in 2026: AI pressure from above, talent retirement from below, and compliance requirements from outside. The maintenance trap has a price tag.

200 healthcare data breaches in Q1 2026 — matching the record set in 2025. Federal News Network reports that legacy government web forms collecting SSNs lack basic encryption. Attackers don't break in. They log in.

Kentucky, Rhode Island, and Indiana joined the privacy enforcement wave in January 2026. Web applications must now handle data subject requests, consent management, and data deletion across 20 distinct legal frameworks.

WooCommerce routes transactions through 27+ plugin dependencies. Magento 1 still processes payments 6 years after end-of-life. At $3.4T in global revenue, framework security is an economic stability question.

South Korea's largest e-commerce platform exposed 33 million customer records. Custom-built stacks without framework-level data protection create regulatory and financial liability at national scale.

ShinyHunters exfiltrated 3.65 TB from Instructure's Canvas, exposing 8,809 institutions and 41% of US higher education. Centralized SaaS creates centralized catastrophe.

CVE-2026-10795 in UpdraftPlus — the most popular WordPress backup plugin — allows unauthenticated attackers to upload and activate malicious plugins via a cryptographic collapse to an all-zero key. Wordfence blocked 4,987 exploitation attempts in 24 hours. The tool installed to protect WordPress sites became the door attackers walked through.

The REST API endpoint that manages enterprise IT tickets, employee records, and security reports was configured with no authentication. A bug bounty researcher reported it April 22. ServiceNow patched it June 5. 44 days of unauthenticated access to the platform that runs enterprise IT operations worldwide.

60-80% of enterprise IT budgets go to 'keeping the lights on.' The U.S. technical debt burden stands at $2.41 trillion. One organization spent $67M/year on legacy maintenance — a $23M rebuild cut ongoing costs by 52%. The numbers are no longer theoretical.

W3Techs: 43.2% in December 2025 to 41.9% by May 2026. A 1.3 percentage point drop in six months — double the decline of all 2025. The fastest-growing segment is sites with no detectable CMS at all.

Essential entities across the EU must complete formal NIS2 compliance audits by month's end. Penalties: up to 10 million euros or 2% of global revenue. Legacy web infrastructure running unpatched CMS plugins is the gap auditors will find first.

Securing WordPress backups in 2026: Admin access and vulnerabilities

TYPO3-CORE-SA-2026-019. Broken access control in the Form Framework allows maliciously crafted form definitions to execute arbitrary SQL and create admin accounts. The legacy CMS vulnerability pattern is not WordPress-specific — it is architectural.

Across 10.1 million sites scanned, self-managed platforms show significantly higher vulnerability counts.

CVE-2026-0740. A critical file upload vulnerability in the Ninja Forms File Uploads plugin. Unauthenticated attackers upload arbitrary files. Full site compromise. No login required.

CVE-2026-8206. CVSS 9.8. The Kirki page builder plugin's password reset mechanism lets attackers take over administrator accounts. 150,000 sites running the vulnerable version right now.

CVE-2026-9082. Highly critical. Anonymous SQL injection in Drupal core — not a contributed module, not a plugin, the core framework itself. CISA added it to the Known Exploited Vulnerabilities catalog. Exploit attempts detected in the wild since May 22.

CVE-2026-4798. CVSS 7.5. The best-selling WordPress theme of all time — 700,000+ sales — lets unauthenticated attackers extract hashed passwords from the database. You paid $69 for this.

At 7.8% of detections, a hosted e-commerce platform outnumbers every modern framework combined in WebPulse scans.

The framework most developers consider dead has more live detections than Astro, SvelteKit, and Hugo combined.

Legacy framework costs don't stay flat. Plugin compatibility breaks compound. Security patches accelerate. Hosting requirements grow. By year 5, you're paying 4x what you started with.

8.25 million legacy sites × $4,200-$38,000/year in total cost of ownership. The aggregate infrastructure bill for legacy web frameworks exceeds many countries' GDP.

WordPress concentration varies from 35% to 93% by country. Each percentage point is a maintenance cost multiplier. Some countries are paying 3x the infrastructure tax of others.

7.4 million WordPress sites. Average 20-30 plugins each. Every plugin requires updates, compatibility testing, and security monitoring. The aggregate cost is staggering — and invisible.

WordPress: PHP + MySQL on every request. Astro: static CDN delivery. At 7.4M WordPress sites serving billions of pages daily, the carbon difference between legacy and modern is measurable. The sustainability case nobody is making.

Japan (median developer age ~42): 87% WordPress. India (median ~26): fintech 100% modern, broad web 83% WP. The workforce age predicts the framework. The developer pipeline IS the framework pipeline.

.za: 18,545 detected. WordPress 75%, Shopify 12%, Squarespace 4.3%, Drupal 3.4%, Angular 2.1%. Africa's most developed digital economy is 17% platform.

Shopify + Wix + Squarespace combined: 822,717 detections (9.8% of detected). Drupal: 344,003 (4.1%). Ratio: 2.4x. Organizations stopped choosing between CMS options and chose 'don't manage infrastructure at all.'

GDP per capita of $100K+. Precision engineering, banking, pharma. And 63% WordPress across 23,268 detected sites. Wealth doesn't automatically buy modern infrastructure.

10,684 detected .nz sites. 41% Shopify. 52% WordPress. Nearly half the detectable New Zealand web runs on one ecommerce platform — beating Australia, Pakistan, and every other country TLD.

E-residency, digital ID, paperless government. Estonia's digital reputation is legendary. Its broad web infrastructure tells the same story as Sweden.

5.4% Magento on .ae domains — the highest rate of any country. Alongside 6.7% Next.js and 3.4% Angular, UAE has the most enterprise-ecommerce web we've measured.

Australia: Shopify 31% vs Drupal 2%. UK: 17% vs 3%. Canada: 20% vs 3%. The 'platform > framework' thesis confirmed across every market we measured.

Russia (12%), Germany (8%), Greece (11%) — the known Joomla markets. Thailand at 21% is the surprise nobody saw coming.

We said Shopify was an English-language phenomenon. Pakistan — where English is an official but second language — has a higher Shopify rate than the UK.

Spotify and Klarna are modern. The rest of the Nordic web is not. 3,949 .se sites, 9,918 .nl sites — large enough samples to be definitive.

From 500K to 10M, Angular's share stayed at 1.65%. The most stable number in our entire dataset.

WordPress (74.3%) + Shopify (7.8%) + Drupal (4.5%) = 86.6%. Twenty-two other frameworks share the remaining 13.4%.

777,276 Shopify detections (7.8%) vs 444,706 Drupal (4.5%). Commerce ate CMS. The gap is 1.7x at 10M scale.

Australia 30% Shopify, UK 18%, Canada 19%. Germany 6%, Japan 6%, Brazil 2%. The ecommerce platform divide follows language, not GDP.

The startup ecosystem didn't trickle down. Among 7,497 detected .id domains in our scan, 87% run WordPress — despite the country's tech unicorns running modern stacks.

16,224 out of 16,900 detected .tr sites in our Common Crawl scan run WordPress. Among sites where we could detect a framework, a near-monoculture.

Among 6 major nonprofit sites we scanned: 4 Drupal, 2 WordPress. Too small for definitive claims, but the Drupal pattern aligns with what we see in government.

3,449 Shopify detections in Common Crawl. The ecommerce infrastructure decision has already been made — by Shopify.

38 university and education sites scanned — a small sample, but 76% legacy across every region. ASEAN education: 93% legacy. The pattern is consistent.

BMW, Mercedes, VW, Renault — we scanned them all. The gap between industrial ambition and web infrastructure is striking.

The institutions that teach the next generation of developers run their own websites on the framework their graduates would never choose.

We scanned both sectors. Stripe, Plaid, Robinhood — all Next.js. whitehouse.gov, NASA, IRS, EPA — all WordPress or Drupal.

BMW, Mercedes, VW invest billions in digital transformation. Their public web infrastructure tells a different story.

California modernized. Mississippi didn't. The digital divide between US state governments mirrors — and may widen — the economic divide.

More than 80% of the federal IT budget goes to keeping old systems alive. That's not modernization — that's life support paid by taxpayers.

Indian IT services companies build cutting-edge systems for global clients. Their own internal infrastructure tells a different story.

SAP, Oracle, Salesforce — enterprise platforms that cost more every year and get harder to leave every quarter. The subscription trap at scale.

Every organization has one. The critical internal application where the original developer left and the documentation doesn't exist.

WordPress is the visible 43%. Beneath it: millions of custom apps, enterprise systems, and internal tools built for a world that no longer exists.

New developers aren't learning WordPress. Experienced developers are leaving. The talent economics are shifting against legacy frameworks.

It's free to download. It's not free to run. We calculated what nobody talks about.

Not our data. Published research from Google, Akamai, and Deloitte on the measurable revenue impact of load time.

Security patching, plugin maintenance, hosting overhead — the costs nobody talks about.