On 22 June 2026, the Five Eyes intelligence agencies, including Australia’s Australian Signals Directorate (ASD/ACSC) and New Zealand’s National Cyber Security Centre (NCSC), issued a joint advisory on AI-accelerated cyber threats. It’s one of the more direct warnings we’ve seen from a government body in a while.
The short version: AI is giving attackers a significant speed advantage. The time between a vulnerability being discovered and it being actively exploited is shrinking. Rapidly.
If you run a public-facing website, this matters to you.
What the advisory actually says
The advisory flags a clear pattern. Organisations running outdated software and those without multi-factor authentication (MFA) are being targeted at a higher rate. AI tools are being used to automate reconnaissance, generate phishing content, and exploit known vulnerabilities at scale.
For WordPress sites specifically, the risk surfaces are well understood:
- Outdated plugins and themes
- Old PHP versions
- Unpatched WordPress core
- Admin accounts with no multi-factor authentication (MFA)
These aren’t new risks. What’s changed is the speed at which they’re being exploited.
The Australasian context
- Australia recorded 532 notifiable data breaches in the first half of 2025, with 59% caused by malicious or criminal attacks (OAIC). That was before the advisory. Research published in 2023 found that enabling MFA reduces the risk of account compromise by 99.2% (Meyer et al., arXiv:2305.00945).
- New Zealanders reported NZ$7.8 million in direct cyber-related financial losses in Q1 2025, up 14.7% from the previous quarter. Source: National Cyber Security Centre NZ, https://www.ncsc.govt.nz/news/rise-in-financial-losses-reported-to-the-ncsc/
The gap between organisations that have basic controls in place and those that don’t is becoming the primary factor in whether an attack succeeds.
What you should do right now
These are the five controls the advisory specifically calls out. They apply regardless of who manages your website.
1. Keep everything updated
WordPress core, plugins, themes, and your PHP version. This is the single most effective control available. Unpatched software is the most common entry point attackers use.
2. Enable MFA on every admin account
Your WordPress login, your hosting account, your domain registrar. A strong password is no longer sufficient on its own – it’s functionally obsolete in the new age of password-spraying. MFA is non-negotiable at this point, but even one-time verification codes can be compromised now. We recommend hardware-based passkeys with biometric verification (think facial recognition).
3. Audit who has admin access
Remove accounts that belong to former staff, old contractors, or anyone who no longer needs access. Fewer accounts means fewer entry points.
4. Check your hosting environment
Legacy or unsupported infrastructure is a known target. If your site is sitting on old hosting that hasn’t been reviewed in years, now is the time.
5. Know what you’d do if something went wrong
An incident response plan doesn’t need to be complex. It just needs to exist. Who do you call? What do you take offline first? Who needs to be notified?
If you’re a Mogul maintenance client
Your WordPress core, plugins, and themes are being kept up to date as part of your regular maintenance schedule. That covers the most important control on the list.
What we can’t do on your behalf is enable MFA on your accounts or audit who has admin access. Those require action on your end. If you’re not sure where to start, get in touch and we’ll walk you through it.
If you’re a Mogul client but don’t have a maintenance plan
If your site isn’t being actively maintained, the advisory’s warning applies directly. Unpatched plugins and themes are not a minor risk, they’re the primary attack vector in the majority of WordPress compromises.
A managed maintenance plan means updates are handled on a scheduled basis, issues are caught early, and you’re not the last to know when something goes wrong. If you’d like to discuss getting your site onto a plan, we’re happy to have that conversation.
If you’re not a Mogul client
The advisory is a useful moment to assess whether your current setup is actually working for you. Managed WordPress hosting, combined with a proactive maintenance plan, gives you a significantly better security posture than an unmanaged environment.
What that looks like in practice: regular updates, security monitoring, backups you can actually restore from, and someone who knows your site when something needs urgent attention.
If you’d like to understand the best next steps for your specific situation, book a no-obligation review here: https://calendar.app.google/fapNAKrTKxBtf9MK7
