Radar · 2024-12
December 2024
Drupal 7 support ends on 5 January, the Ultralytics package is compromised in a PyPI supply chain attack, an exploited WordPress plugin is used to install further vulnerable plugins, the first tranche of Privacy Act reform becomes law and Astro 5.0 ships with the Content Layer and Server Islands.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- notable Bedrock
Bedrock Marketplace opens over 100 models, Sydney included — aws.amazon.com
Amazon Bedrock Marketplace launched on 4 December 2024, making more than a hundred publicly available and proprietary foundation models discoverable, testable and deployable through the Bedrock console and APIs. Fourteen regions were covered at launch, and Sydney was among them.
Teams with data-residency constraints can evaluate specialist and open-weight models without leaving the Sydney boundary — but decide now who can deploy from the marketplace, since models hosted on managed endpoints bill and behave differently from serverless Bedrock models.
- fyi Bedrock
Amazon Nova foundation models launch in Amazon Bedrock — aws.amazon.com
AWS announced the Amazon Nova family at re:Invent on 3 December 2024, with the Micro, Lite and Pro understanding models available immediately in Amazon Bedrock alongside the Canvas image and Reel video generation models. The models target lower cost and latency tiers and support Bedrock features such as fine-tuning and knowledge bases.
Nothing to adopt on an announcement — for an Australian client the question that decides whether Nova is usable is regional availability rather than capability, so the Sydney and Melbourne catalogue listing is the event to wait for. Keep the cost and latency positioning to hand, because it is the comparison you will be asked for the next time a client weighs a cheaper model against the one you already run.
- fyi OWASP
OWASP opens an initiative for securing agentic applications — genai.owasp.org
On 15 December 2024 the OWASP GenAI Security Project announced its Agentic Security Initiative, targeting applications that plan, call tools, hold persistent memory and execute code. Three workstreams were named: an agentic reference architecture for threat modelling, a securing-agentic-systems guide, and a mapping across the OWASP AI Exchange, NIST and MITRE ATLAS.
Worth tracking rather than acting on — this is a vendor-neutral framework to watch before wiring agents into CMS content and internal APIs. The announcement targeted review of the first deliverables in January 2025 and publication in February 2025.
Update, February 2025: OWASP's Agentic Security Initiative published its first guide, Agentic AI – Threats and Mitigations, on 17 February 2025.
Security and edge
Sections- critical WordPress
WordPress plugin exploited to install other vulnerable plugins — bleepingcomputer.com
Reported on 11 December 2024, attackers chained CVE-2024-11972 in the Hunk Companion plugin — an unauthenticated request that could install and activate arbitrary plugins — with a known flaw in WP Query Console (CVE-2024-50498), an obscure plugin last updated more than seven years ago, to execute PHP and drop persistent backdoors. The fix shipped in Hunk Companion 1.9.0 on 10 December, but of more than ten thousand installs at least eight thousand were still unpatched at the time of reporting.
The attack path defeats controls that only watch the plugins you chose: block unauthenticated plugin-install routes at the WAF, alert on unexpected plugin activation, and audit for WP Query Console specifically.
- notable TLS
Let's Encrypt sets dates for ending OCSP support — letsencrypt.org
Let's Encrypt confirmed on 5 December 2024 that it will retire its OCSP infrastructure in favour of certificate revocation lists, citing the privacy risk of browsers disclosing browsing activity to the CA. The schedule is firm, with OCSP Must-Staple requests failing for most accounts from 30 January 2025, OCSP URLs dropped from certificates on 7 May 2025, and the responders switched off entirely on 6 August 2025.
Audit web servers for OCSP stapling, check ACME clients for the Must-Staple extension, and confirm any non-browser software validating your certificates copes without OCSP URLs before the May cut-over.
- notable Incident
US Treasury breached through third-party remote support tooling — thehackernews.com
On 30 December 2024 the US Treasury disclosed that a state-sponsored actor accessed workstations and unclassified documents by abusing a stolen API key for BeyondTrust's remote support SaaS. The incident is a reminder that vendor tooling with privileged access is part of your attack surface, even when your own systems are patched.
Inventory third-party tools with remote access to your environment, and confirm their API keys are scoped, rotated and monitored.
Standards and compliance
Sections- critical Privacy Act
First tranche of Privacy Act reforms becomes law — legislation.gov.au
The Privacy and Other Legislation Amendment Act 2024 received royal assent on 10 December 2024. Most Schedule 1 privacy measures commenced the next day, 11 December 2024. The reforms add a tiered civil penalty regime, infringement notice powers, a statutory tort for serious invasions of privacy that commences on proclamation or, if not proclaimed sooner, on 10 June 2025, and a duty for the Commissioner to develop a Children's Online Privacy Code within 24 months of assent.
Review how your organisation collects and secures personal information against the APPs, as lower-level breaches can now attract infringement notices without a full investigation.
- critical Digital ID
The Digital ID Act commences, switching on a regulated identity system — finance.gov.au
The Digital ID Act 2024 commenced on 30 November 2024, according to the Act's commencement table. Finance's 28 November preview gave 1 December. Finance names the ACCC as the Digital ID Regulator, alongside an expanded privacy role for the OAIC.
Any agency service integrating Digital ID now sits inside an accreditation and data-standards regime that reaches the login, redirect, cookie and logging surface a delivery platform actually owns — check those behaviours at the edge won't break accredited flows, and that incident-reporting duties flow through to platform runbooks.
- notable ISM
ASD releases December 2024 update to the Information security manual — cyber.gov.au
The December 2024 ISM update introduces the new NC applicability marking for non-classified systems, replacing the previous 'All' marking with 'NC, OS, P, S, TS', and adds ISM-1966, recommending the CISO maintain a regularly verified register of systems. Several assessment-related controls were also restructured, with separate controls now covering TOP SECRET systems.
If you maintain an ISM control mapping or SSP, work the December changes into your next review cycle, particularly the new system register control.
CMS and platforms
Sections- notable Drupal
Drupal 7 end of life arrives on 5 January — drupal.org
The Drupal project confirmed in a 5 December reminder that Drupal 7 reaches end of life on 5 January 2025, fourteen years after its release. After that date Drupal 7 no longer receives official security support. Commercial extended security support is the documented alternative.
If you still run Drupal 7 sites, confirm your migration plan or arrange commercial extended support now, and treat any unpatched D7 site as an increasing security risk from 5 January.
- notable Drupal
Drupal 11.1.0 removes the extension upload UI and moves hooks into classes — drupal.org
Drupal 11.1.0 landed on 16 December 2024. Most procedural hooks are now implemented in classes, assets are ordered by dependency rather than attachment order, the UI for uploading modules and themes is gone in favour of Composer, new installs default account registration to administrators only, a Workspaces UI module arrives, and Package Manager ships hidden and experimental as groundwork for automatic updates. Security support for 11.1.x runs to December 2025.
Three of these bite in practice: hooks-in-classes and the asset-ordering change surface as regressions in older contrib, and Composer-only extension installs change how non-Composer sites are maintained. Plan the upgrade against the December 2025 support horizon.
- fyi Drupal
Drupal CMS release candidate available ahead of 15 January launch — drupal.org
The Drupal CMS release candidate was announced at DrupalCon Singapore in December, giving a first look at the marketer-focused distribution with recipes, smart defaults and automatic updates. The 1.0 release is scheduled for 15 January 2025.
Teams evaluating Drupal for new builds can trial the release candidate locally with DDEV and feed issues back before 1.0 lands.
Supply chain, CI/CD and IaC
Sections- critical PyPI
Ultralytics package compromised in PyPI supply chain attack — pypi.org
Malicious versions 8.3.41, 8.3.42, 8.3.45 and 8.3.46 of the Ultralytics AI library were published to PyPI between 4 and 7 December 2024, delivering a cryptominer to machines that installed them. The attackers first compromised the project's GitHub Actions workflows through a malicious pull request, so the first wave went out through the existing Trusted Publishing workflow and looked legitimate. The second wave used an unrevoked PyPI API token and had no matching source activity or publish attestations.
Audit environments and lock files for the affected versions, pin dependencies, and review your own release workflows for the injection and cache-poisoning patterns described in PyPI's analysis.
- notable GitHub Actions
GitHub sets dates for Actions breaking changes in early 2025 — github.blog
GitHub published a consolidated notice on 5 December 2024 covering upcoming breaking changes in GitHub Actions: v3 of the artifact actions shuts down on 30 January 2025, and a new cache service architecture begins rolling out from 1 February 2025, with actions/cache v1 and v2 fully retired by 1 March 2025. Workflows still using the old versions will start failing once each cut-over completes.
Upgrade actions/upload-artifact and actions/download-artifact to v4 before 30 January, and actions/cache to v4 before 1 March.
Languages, runtimes and frameworks
Sections- notable PHP
PHP 8.2 moves to security-only support — php.net
PHP 8.2.27, released 19 December 2024 alongside 8.4.2 and 8.3.15, is the final bug-fix release for the 8.2 series. From here PHP 8.2 receives security fixes only, until support ends on 31 December 2026.
Stacks pinned to PHP 8.2 — including Drupal, WordPress and Laravel sites — should schedule the move to 8.3 or 8.4 during 2025 rather than riding the security-only window to its end.
- notable Python
Python ships security releases across five branches — python.org
Released 3 December 2024 and announced on 4 December, Python 3.13.1, 3.12.8, 3.11.11, 3.10.16 and 3.9.21 carry CVE-2024-50602, a denial of service in libexpat fixed by moving to 2.6.4. The three older branches are security-only releases; 3.13.1 and 3.12.8 also carry several hundred bug fixes between them.
Take the libexpat fix wherever you parse XML from an untrusted source, which for most web work means anything handling SAML, RSS or SOAP. The bundled expat version is the thing to check, not the Python version alone.
Static site and web tooling
Sections- notable Astro
Astro 5.0 released with the Content Layer and Server Islands — astro.build
Astro 5.0 shipped on 3 December 2024 with the new Content Layer API for loading content from any source, Server Islands, simplified prerendering, type-safe environment variables and an upgrade to Vite 6. It is a major version with breaking changes that affect build output and content collection configuration.
Review the upgrade guide before moving 4.x projects across, paying particular attention to content collections and prerendering defaults.
- notable React
React 19 reaches stable — react.dev
React 19 shipped as stable on 5 December 2024, with Actions, the use API, ref as a regular prop, native document metadata and stable Server Components.
Do not bump React in isolation. Follow the official upgrade guide and wait for your framework and key component libraries to declare React 19 support before migrating.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more