Patch PHP today: the NSA says take sites offline
The NSA told every organization running PHP to patch two critical bugs or take the system offline until they can. The software runs most of the web, including WordPress.
Read the whole week in one goRank trackers were wrong all week. Check Search Console.
Why your traffic moved
A big rank tracker is now deleting its own bad data
Ahrefs has put out a statement on Google serving fake results to tracking tools, saying it filters the bad results and is cleaning up past ones too, posted by Glenn Gabe. Gabe has asked whether old charts will be corrected, so drops and surges that never happened may still be sitting in your history.
We're also cleaning up any past results that may have been affected.
Who this affects: Anyone who watches keyword rankings in a paid tracking tool.
- Our take: treat recent tracker drops as unproven until charts update.
- Compare any drop against Search Console average position first.
Getting into AI answers
AI tools send under 1% of the traffic Google does
Twelve months of analytics across 100 sites and more than 145 million sessions found ChatGPT sent 0.62% of the traffic Google organic did, and all AI tools together 0.73%, says Marie Haynes. ChatGPT visitors converted better, 13.8% against 3.02%, but Google still drove 27 times more conversions than all AI tools combined.
Overall visits from ChatGPT have actually been declining since GPT-5 came out in August 2025.
Who this affects: Anyone being sold AI visibility services or worrying about AI search traffic.
- Our take: keep your time on normal Google search basics.
- Read Marie's post before paying for AI visibility tracking.
Do not do this
Check your site's PHP version today, or take it offline
NSA Cyber has told every organization using PHP (the software most websites, including WordPress, run on) to prepare for an update fixing two critical bugs, and to take systems offline if they cannot patch quickly. One SEO, Julian Goldie, calls the pair PHP2Shell, rates them 9.2 out of 10 and lists 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as safe.
If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated.
Who this affects: Anyone with a WordPress site or any site running PHP.
- Log into your host and check your PHP version now.
- On 8.1 or older, ask your host to update today.