Radar · 2025-01
January 2025
Drupal 7 reaches end of life, six rsync vulnerabilities include a heap overflow reachable by anonymous read access, artifact actions v3 stop working on 30 January, a critical CSRF advisory hits the Drupal AI module and Let's Encrypt announces six-day certificates and the end of expiry emails.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- notable OWASP
OWASP publishes a GenAI Red Teaming Guide — genai.owasp.org
The OWASP GenAI Security Project released its GenAI Red Teaming Guide on 22 January 2025, setting out a four-pillar approach — model evaluation, implementation testing, infrastructure assessment and runtime behaviour — with practical scoping, team composition and reporting advice. It is OWASP's framework for testing AI features the way you would penetration-test an application.
If you are shipping anything with an LLM behind it, use the guide to scope a first red-team exercise rather than relying on functional testing alone; it also gives procurement teams a vocabulary for asking vendors what testing they have actually done.
- notable DeepSeek
DeepSeek left a ClickHouse database open to the internet — thehackernews.com
Security researchers disclosed on 30 January 2025 that a publicly accessible ClickHouse database belonging to DeepSeek was exposing over a million lines of log data including chat history, API secrets and backend operational detail — reachable with no authentication and allowing arbitrary SQL. DeepSeek closed it promptly after being told, but the exposure landed during the same week the models were being adopted everywhere.
Treat newly popular AI providers as unvetted until you have looked at their security posture, and if staff used DeepSeek's hosted service in January assume anything they typed may have been exposed.
- fyi Bedrock
DeepSeek-R1 models become deployable on AWS — aws.amazon.com
From 30 January 2025 the DeepSeek-R1 model can be deployed through Amazon Bedrock Marketplace and SageMaker JumpStart, and the distilled variants can be brought in through Bedrock Custom Model Import. Organisations experimenting with the much-discussed model can do so inside their own AWS account boundary rather than sending data to third-party APIs.
If teams are trialling DeepSeek models, ensure use goes through governed infrastructure and that model outputs are treated per your AI usage policy.
Update, March 2025: AWS made DeepSeek-R1 available in Amazon Bedrock as a fully managed serverless model on 10 March 2025, removing the need to host it yourself.
Security and edge
Sections- notable TLS
Let's Encrypt adds six-day and IP certificates, and sets a June end for expiry emails — letsencrypt.org
Two January announcements point the same way. Let's Encrypt plans to offer opt-in six-day certificates and IP address certificates alongside its 90-day certificates, aiming for general availability by the end of 2025, and will end its expiration notification email service on 4 June — citing automation maturity, privacy and cost. The certificate ecosystem is moving firmly towards lifetimes too short for humans to manage, and the reminder-email safety net is being retired to match.
Confirm every certificate in your estate renews automatically, and move expiry alerting into your own monitoring before June — anything renewed by hand will lose its reminder emails then.
Update, January 2026: On 15 January 2026 Let's Encrypt announced that six-day and IP address certificates are generally available.
- notable Web security
DoubleClickjacking technique sidesteps standard clickjacking defences — thehackernews.com
Research published in early January 2025 describes DoubleClickjacking, which abuses the timing gap in a double-click sequence to land a user's second click on a sensitive control in another window. Because the victim clicks a genuine page rather than a framed one, it bypasses X-Frame-Options, frame-ancestors CSP directives and SameSite cookie protections, and was demonstrated taking over accounts via OAuth consent screens.
For applications with one-click sensitive actions such as OAuth approvals or MFA prompts, keep critical buttons disabled until deliberate user interaction is detected, and review authorisation flows for single-click approval paths.
- notable rsync
Six rsync vulnerabilities include a heap overflow reachable by anonymous read access — kb.cert.org
CERT/CC published VU#952657 on 14 January 2025 covering six rsync flaws, the most serious being CVE-2024-12084, a heap buffer overflow in the daemon's handling of attacker-controlled checksum lengths that a client with only anonymous read access can combine with an information leak (CVE-2024-12085) to achieve arbitrary code execution. Versions up to and including 3.3.0 are affected; 3.4.0 fixes them.
rsync sits quietly inside a lot of deploy pipelines, backup jobs and mirror scripts — find every host running rsyncd, upgrade to 3.4.0, and shut down any daemon exposed beyond your own network.
Standards and compliance
Sections- critical DTA
DTA's Digital Inclusion and Performance Standards take effect, Digital Access Standard partly live — digital.gov.au
The DTA's Digital Experience Policy is mandated from 1 January 2025 for investments subject to the Investment Oversight Framework. It includes the Digital Service Standard, which has applied to new public-facing and staff-facing services since 1 July 2024. From 1 January 2025 the Digital Inclusion Standard applies to new public-facing and staff-facing services, the Digital Performance Standard to new public-facing services, and the Digital Access Standard only to new public-facing services suitable for myGov. Existing public-facing services pick up the Service Standard on 1 July 2025 and the Inclusion Standard on 1 January 2026, when the Access Standard also extends to individuals not suitable for myGov and to business and providers.
Agencies and their vendors should map each service to the phase that actually applies — new versus existing, myGov-suitable versus not — rather than treating 1 January 2025 as a whole-of-estate switch, and schedule WCAG and performance assessments against those dates.
- notable ASD
ASD joins international "Secure by Demand" guidance for OT buyers — cyber.gov.au
On 14 January 2025 ASD's ACSC co-sealed Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products, led by CISA. It inverts the usual framing — instead of telling vendors to build securely, it gives buyers twelve procurement criteria to demand, covering configuration management, logging, upgrade paths, secure defaults and vulnerability handling.
The criteria translate cleanly beyond operational technology: lift them into your standard vendor security questionnaire, and expect government clients to start asking the same questions of you.
CMS and platforms
Sections- critical Drupal
Drupal 7 is now end of life — drupal.org
Drupal 7 reached end of life on 5 January 2025. PSA-2025-01-06, published the next day, states that Drupal.org no longer issues Drupal 7 core or contrib releases, community support, or Security Advisories, and that vulnerabilities may be made public without warning.
Any remaining Drupal 7 sites should be migrated, decommissioned or moved onto a commercial extended support arrangement without delay; static archiving is a sound option for sites that no longer change.
- notable Drupal
Critical CSRF advisory in the Drupal AI module — drupal.org
SA-CONTRIB-2025-003, published 15 January 2025, reports a critical cross-site request forgery flaw in the AI Chatbot sub-module of the AI (Artificial Intelligence) contributed module, fixed in 1.0.2. Affected versions are greater than 1.0.0 and below 1.0.2. The advisory landed the same day Drupal CMS 1.0 was released.
Update the AI module to 1.0.2 or later. If you cannot update, uninstall the AI Chatbot sub-module.
- fyi Drupal
Drupal CMS 1.0 launches on Drupal's 24th birthday — drupal.org
Drupal CMS 1.0 was released on 15 January 2025, packaging Drupal 11 core with recipes for media management, SEO, consent management, search and AI-assisted site building aimed at marketing teams and site builders. It gives organisations a faster starting point than assembling core and contributed modules by hand.
Worth evaluating for new builds and as a reference architecture for upgrading older Drupal sites.
Supply chain, CI/CD and IaC
Sections- critical GitHub Actions
Artifact actions v3 stopped working on 30 January — github.blog
GitHub's long-announced shutdown of v3 of actions/upload-artifact and actions/download-artifact took effect on 30 January 2025. Workflows that still reference v3 now fail outright rather than emitting deprecation warnings.
Search your repositories for upload-artifact@v3 and download-artifact@v3 and bump them to v4, noting the behavioural differences in artifact naming and cross-job access.
- notable OpenTofu
OpenTofu 1.9.0 released with provider for_each — opentofu.org
OpenTofu marked a year of releases with 1.9.0 in January 2025, adding provider iteration via for_each for multi-region deployments, a new -exclude flag and performance improvements. With this release OpenTofu 1.6 is no longer supported and will not receive security updates.
If you standardised on OpenTofu, plan the move off 1.6 to a supported release line.
Languages, runtimes and frameworks
Sections- notable Node.js
Node.js security updates for all active release lines — nodejs.org
On 21 January 2025 Node.js shipped security releases for the 18.x, 20.x, 22.x and 23.x lines, including updates to the bundled undici HTTP client and a fix for a worker thread issue exposed via diagnostics_channel. Node 18 is approaching end of life, so this is also a prompt to check your runtime roadmap.
Update build and runtime images to the patched Node versions during your next maintenance window.
- notable Go
Go restores sensitive headers after a later same-domain redirect — pkg.go.dev
Released 16 January 2025, go1.23.5 and go1.22.11 fix CVE-2024-45336 (GO-2025-3420) in net/http: the HTTP client drops sensitive headers such as Authorization after a cross-domain redirect, but incorrectly restores them if a later redirect stays on that same domain. The same releases fix CVE-2024-45341 (GO-2025-3373) in crypto/x509, where a certificate could incorrectly satisfy a URI name constraint.
Rebuild Go services that make outbound HTTP requests, particularly anything acting as a proxy or fetcher. Treat a restored Authorization header on a later same-domain hop as credential disclosure.
- notable Symfony
Symfony 7.1 leaves support — symfony.com
Symfony 7.1 reached end of support in January 2025, eight months after its May 2024 release. For this standard release, bug-fix and security support both ended in January 2025. The LTS line, 6.4 at that point, keeps the longer tail.
If a project is on a standard Symfony release and is not actively maintained, move it to the LTS line rather than tracking eight-month minor releases. The short window is a deliberate policy, so it will keep happening on schedule.
Static site and web tooling
Sections- notable Astro
Astro 5.2 adds Tailwind 4 support and changes trailing slash handling — astro.build
Astro 5.2, released 30 January 2025, adds native support for the new Tailwind CSS 4 Vite plugin, external redirect support, TOML frontmatter and improved trailing slash handling. The trailing slash and redirect changes can alter generated URLs, so they matter for sites with strict caching or SEO configurations.
When upgrading, re-run a full build and diff the output URLs and redirects before deploying, especially if your CDN cache keys on exact paths.
- notable Jekyll
Jekyll 4.4.0 is the first minor release in over two years — jekyllrb.com
Jekyll 4.4.0 landed on 27 January 2025, with a 4.4.1 patch following two days later. It drops support for Ruby versions older than 2.7 and bundles the base64, csv and json gems as runtime dependencies, which keeps builds working on newer Rubies that no longer ship them by default. Line highlighting in code blocks and configurable livereload behaviour round out the release.
Check the Ruby version in your build environment before upgrading, and note that sites staying on older Jekyll releases will need to add the extracted gems to their Gemfile as Ruby moves forward.
- notable Vite
Any website could read files from a running Vite dev server — github.com
GHSA-vg6x-rcgg-rjx6, published 20 January 2025 and rated Moderate, allowed any website the developer visited to send requests to a running Vite dev server and read the responses. The advisory applies even when the server is only on the local machine. Nuxt published separate advisories of the same class.
Upgrade Vite to a patched release. Binding to localhost is not a sufficient fix. Treat source or environment files readable by the dev server as exposed for the period a vulnerable version was in use.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more