Radar
Radar 2025
Every month we round up the releases, advisories and standards worth your attention across the stack we run and the platforms we integrate with. Seven buckets: AI, security and edge, Australian compliance, CMS platforms, supply chain and CI/CD, languages and frameworks, and static site tooling.
2025
222 items · 37 critical
The year npm supply chain attacks learned to replicate. March's tj-actions compromise spilled secrets into public build logs; by September the Shai-Hulud worm was spreading through the registry unaided, and it returned larger in November. The registry answered by revoking every classic token in December. It was also a heavy year for authentication bypasses — Next.js middleware, Drupal's two-factor module twice and a WordPress security plugin that let anyone log in as anyone. Australia's statutory privacy tort commenced and the DTA published a whole-of-government AI standard.
December 2025
A critical remote code execution in React Server Components hits the Next.js App Router, Chrome patches an actively exploited graphics-library zero-day, npm permanently revokes classic tokens, PHP 8.1 security support ends on 31 December and Drupal 11.3 and WordPress 6.9 both ship.
November 2025
Shai-Hulud returns in a second and larger npm worm wave, four Drupal core security advisories land on a single day, ASD warns of ongoing BADCANDY implants on Cisco IOS XE devices, PHP 8.5 ships and the OWASP Top 10:2025 puts supply chain failures at number three.
October 2025
ASD's ACSC alerts on an F5 incident and October BIG-IP patches, the AWS us-east-1 outage exposes hidden regional dependencies, npm tightens authentication and retires classic tokens, Node.js 24 is promoted to LTS, Python 3.9 reaches end of life and ASD releases the Annual Cyber Threat Report.
September 2025
A self-replicating worm spreads through npm days after the chalk and debug compromise puts billions of weekly downloads at risk, actively exploited Cisco ASA vulnerabilities are targeted in Australia, WordPress 6.8.3 fixes two authenticated vulnerabilities and the September ISM reworks its AI and supply chain controls.
August 2025
The Nx s1ngularity attack leaks thousands of developer secrets, a Drupal two-factor module flaw allows login as any user, the MadeYouReset HTTP/2 flaw bypasses Rapid Reset defences, GitHub Actions adds SHA pinning enforcement and GovCMS sets out its Drupal 11 upgrade timeline.
July 2025
Mass exploitation of on-premises SharePoint runs through the month, a phishing attack compromises eslint-config-prettier and related packages with tens of millions of weekly downloads, the Toptal GitHub organisation is breached, the DTA releases a whole-of-government AI technical standard and PSPF Release 2025 lands with two new security standards.
June 2025
An exploited Chrome engine flaw is patched out of band, malware is published to the gluestack and react-native-aria npm packages, Australia's statutory privacy tort comes into force, the June ISM rewrites its governance principles and Drupal 11.2 lands with major performance gains.
May 2025
A Chrome query-string leak is added to CISA's KEV catalogue then withdrawn, an unpatched file-upload flaw hits a WordPress plugin with 100,000 installs, Drupal's two-factor module is patched for CSRF and a reset-path bypass, Node.js ships security releases for all active lines and Australia's statutory privacy tort commences 10 June.
April 2025
A Craft CMS remote code execution is mass-exploited within a week of patching, the xrpl.js npm package is backdoored to steal private keys, Node.js 18 reaches end of life on 30 April, the CA/Browser Forum votes to shorten TLS certificate lifetimes to 47 days and WordPress 6.8 ships with bcrypt password hashing.
March 2025
The tj-actions/changed-files compromise spills secrets into public build logs, a Next.js middleware flaw allows authorisation bypass, IngressNightmare exposes unauthenticated RCE in ingress-nginx, a Chrome sandbox escape is exploited in the wild and ASD releases the March update to the Information security manual.
February 2025
A Craft CMS code injection flaw comes under active exploitation, Drupal patches a critical XSS alongside two other core advisories, GitHub retires its legacy Actions cache service and the Bybit incident shows how tampered front-end JavaScript defeats even hardware signing.
January 2025
Drupal 7 reaches end of life, six rsync vulnerabilities include a heap overflow reachable by anonymous read access, artifact actions v3 stop working on 30 January, a critical CSRF advisory hits the Drupal AI module and Let's Encrypt announces six-day certificates and the end of expiry emails.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more