Radar · 2025-02
February 2025
A Craft CMS code injection flaw comes under active exploitation, Drupal patches a critical XSS alongside two other core advisories, GitHub retires its legacy Actions cache service and the Bybit incident shows how tampered front-end JavaScript defeats even hardware signing.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- notable Anthropic
Claude 3.7 Sonnet introduces hybrid reasoning — anthropic.com
Anthropic released Claude 3.7 Sonnet on 24 February 2025, the first model to combine near-instant responses with optional extended step-by-step thinking in a single model, with API control over the thinking budget. It shipped alongside Claude Code, a research preview of a terminal-based agentic coding tool, and is priced the same as its predecessor.
Teams building on Claude should evaluate 3.7 Sonnet against existing prompts, as reasoning behaviour and output length differ from 3.5.
- fyi OWASP
OWASP publishes Agentic AI — Threats and Mitigations — genai.owasp.org
The OWASP GenAI Security Project released its first agentic AI threat guide on 17 February 2025, cataloguing threats specific to systems that plan and act rather than just answer — including memory poisoning, tool misuse, privilege compromise, cascading hallucination, intent breaking and rogue agents — each with mitigations.
Read it before you give an agent write access to anything. The tool-misuse and privilege-compromise sections are the practical ones: they argue for per-tool authorisation and human approval gates rather than a single broad service account.
- fyi Anthropic
Constitutional Classifiers cut jailbreak success in automated tests, but not in the public demo — anthropic.com
Anthropic published research on 3 February 2025 describing Constitutional Classifiers, input and output filters trained on synthetic data generated from an explicit rule set. In an invited two-month bug bounty, 183 participants spending an estimated 3,000 hours found no universal jailbreak against the prototype, and an automated evaluation cut jailbreak success from 86 per cent to 4.4 per cent for a 0.38 percentage point increase in over-refusal. A separate public demo running from 3 to 10 February drew 339 experienced jailbreakers over roughly 3,700 hours: four cleared all eight levels and one found what Anthropic assessed as a universal jailbreak.
The transferable idea for anyone deploying an LLM feature is that a written rule set can be compiled into a testable guardrail — and that publishing the rules and inviting attack is a credible way to measure whether it holds.
Security and edge
Sections- critical nginx
nginx patches an SSL session reuse flaw that can bypass client-certificate checks (CVE-2025-23419) — mailman.nginx.org
nginx 1.27.4 and the 1.26.3 stable release, both dated 5 February 2025, fix CVE-2025-23419: when several virtual servers share the same IP address and port, a TLSv1.3 session resumed against a different name can bypass client-certificate authentication configured on another server. Session resumption via ssl_session_cache or ssl_session_tickets is the exposure.
If you terminate TLS with nginx and use client certificates on any virtual server, patch and then check that each server block has its own ssl_session_ticket_key or session cache rather than inheriting a shared one.
- notable Incident
Bybit incident shows tampered front-end JavaScript defeats signing — bleepingcomputer.com
The 21 February 2025 theft of about US$1.5 billion from Bybit traced back to a compromised Safe{Wallet} developer machine, which let attackers inject malicious JavaScript into the wallet front-end served from cloud object storage. Signers approved what the tampered interface showed them, so the compromise of one static asset defeated hardware wallet signing.
For any high-value web front end, add subresource integrity where practical, restrict and monitor write access to production static assets, and alert on unexpected changes to deployed JavaScript.
- fyi TLS
Let's Encrypt issues its first six-day certificate — letsencrypt.org
Let's Encrypt issued its first short-lived certificate on 19 February 2025, putting its January announcement into practice ahead of wider availability later in the year. Short-lived certificates shrink the window in which a compromised key is useful, at the cost of requiring completely automated renewal.
Nothing to do while this is a demonstration rather than an option, but the readiness question is worth answering early. Six-day certificates only work where renewal is fully automated and monitored, so anything in the estate still renewing by hand or off a calendar reminder is what to fix before short-lived certificates stop being the experiment and become the default.
Standards and compliance
Sections- notable ASD
ASD leads international guidance on securing edge devices — cyber.gov.au
In early February 2025 ASD's ACSC, with international partners, released mitigation strategies for edge devices such as routers, firewalls and VPN concentrators, in executive and practitioner editions. Edge devices remain a favoured target because they face the internet, hold sensitive configuration and often lag on patching.
Review the guidance against your network perimeter, prioritising firmware currency, disabling unused services and centralised logging for edge devices.
- notable ASD
ASD publishes "Foundations for modern defensible architecture" — cyber.gov.au
Released on 10 February 2025 as a consultation draft, this ASD guidance sets out ten foundations for systems that are harder to compromise and easier to defend: centrally managed enterprise identities, high assurance authentication, contextual authorisation, a reliable asset inventory, secure endpoints, reduced attack surface, resilient networks, secure-by-design software, comprehensive assurance and governance, and continuous and actionable monitoring. It is aimed at architects making design decisions, not just at security teams auditing them.
Use it as the framing document when you next write a solution architecture for a government client; it gives you ASD's own language for justifying segmentation, least privilege and logging spend.
- fyi Home Affairs
Home Affairs consults on a whole-of-government Gateway Security Standard — homeaffairs.gov.au
The Department of Home Affairs released a consultation paper in February 2025 on an Australian Government Gateway Security Standard, which sets the minimum security standard entities are expected to apply in their use of gateway capabilities. As a Protective Security Policy Framework standard it would supersede the Gateway Policy previously developed by the Digital Transformation Agency, and it still points to ASD's Gateway Security Guidance Package for technical advice.
Suppliers to Commonwealth entities should read the draft for changes to expected gateway logging and traffic inspection, and check whether existing hosting arrangements would still comply.
CMS and platforms
Sections- critical Craft CMS
Craft CMS code injection flaw under active exploitation — thehackernews.com
CVE-2025-23209, a code injection vulnerability in Craft CMS 4 and 5, was added to CISA's Known Exploited Vulnerabilities catalogue on 20 February 2025 after evidence of in-the-wild attacks. The flaw is exploitable on installs whose security key has been compromised and was patched in versions 4.13.8 and 5.5.8 on 2 January 2025.
Update Craft CMS immediately and rotate the security key if there is any chance it has leaked, for example via exposed .env files or repository history.
- notable Drupal
Drupal core security window patches critical XSS and gadget chains — drupal.org
On 19 February 2025 the Drupal security team published three core advisories, led by SA-CORE-2025-001, a critical reflected cross-site scripting flaw in error-message filtering affecting Drupal 8 through 11.1. The same window covers a moderately critical access bypass in bulk actions (SA-CORE-2025-002) and a PHP object-injection gadget chain (SA-CORE-2025-003).
Update to Drupal 10.3.13, 10.4.3, 11.0.12 or 11.1.3 (or later) and apply the February contributed module advisories while you are there.
Supply chain, CI/CD and IaC
Sections- critical PyPI
Infostealers on PyPI impersonated DeepSeek client libraries — bleepingcomputer.com
Malicious packages named deepseeek and deepseekai were uploaded to PyPI on 29 January 2025 and publicly reported in early February. Posing as Python clients for the DeepSeek AI platform, they stole environment variables including API keys, database credentials and infrastructure tokens before PyPI removed them.
Treat hype-cycle package names with suspicion, verify publishers before installing, and rotate credentials if these packages appeared in your environments.
- notable GitHub Actions
Legacy GitHub Actions cache service retired — github.blog
GitHub's Actions cache storage began moving to a new architecture on 1 February 2025, closing down v1 and v2 of actions/cache, with the legacy service due to be fully retired on 1 March. Workflows still using the old action version or @actions/cache packages below 4.0.0 will fail once the legacy service is retired.
Upgrade actions/cache to v4 before 1 March, and bump any tooling that embeds the @actions/cache package to the same version.
- notable Terraform
IBM completes the HashiCorp acquisition as Terraform 1.11 keeps secrets out of state — hashicorp.com
IBM completed its acquisition of HashiCorp on 27 February 2025, and HashiCorp continues as a division of IBM Software. Terraform 1.11.0 was released the same day with write-only arguments, whose values are never persisted in plan or state files, plus generally available S3-native state locking with the DynamoDB locking arguments deprecated.
Move any credential currently passed through a normal resource argument to a write-only argument, and plan the DynamoDB-to-S3 locking migration rather than waiting for the deprecation to bite. On the corporate change, expect licence and SKU paperwork to shift over the following year.
Languages, runtimes and frameworks
Sections- notable Laravel
Laravel 12 released as Laravel 10 leaves security support — laravel.com
Laravel 12 shipped on 24 February 2025 as a deliberately low-friction major, focused on dependency upgrades with minimal breaking changes, and receives security fixes until February 2027. The same month closed the book on Laravel 10, whose security support ended on 4 February 2025.
Applications still on Laravel 10 are now unsupported and should be upgraded; the mild breaking-change surface makes moving 11.x projects to 12 a low-risk exercise worth scheduling early.
- notable Go
Go 1.24 ships and Go 1.22 leaves support — go.dev
Go 1.24.0 was released on 11 February 2025. Go supports each major release until there are two newer ones, so Go 1.22 is now out of support. A week earlier, on 4 February, go1.23.6 and go1.22.12 shipped security fixes to the crypto/elliptic package, recorded as GO-2025-3447 (CVE-2025-22866), a P-256 timing side channel on ppc64le.
Move build images to 1.24 or 1.23. Go supports exactly two releases, so a major landing is also an end-of-life event for the version two behind, with no separate announcement to catch.
Static site and web tooling
Sections- fyi Astro
Astro 5.3 and Starlight 0.32 ship incremental improvements — astro.build
February brought Astro 5.3 with faster page rendering and easier setup for experimental sessions, and Starlight 0.32 with new route data middleware and i18n APIs for plugins. Both are routine minor releases but worth folding into your regular dependency updates.
Fold both into the normal dependency cycle; neither needs a window of its own.
- fyi Interop
Interop 2025 sets this year's cross-browser compatibility targets — hacks.mozilla.org
The browser vendors launched Interop 2025 on 13 February, committing the major engines to 19 shared focus areas including anchor positioning, view transitions, the Storage Access API and WebRTC, plus the project's first coordinated feature removal in mutation events. Features that make the Interop list tend to become safe to build on across browsers within the year, so it is a useful forward guide for front-end decisions.
Nothing to change now; the use for this is later and in argument rather than in code. A feature on the Interop list is one you can defend building on without a fallback, and the first coordinated removal — mutation events — is the thing to grep for in older bespoke JavaScript before a browser drops it out from under you.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more