Security advisory: critical PHP and Node.js vulnerabilities are being exploited in the wild. What you need to do →
All months

Radar · 2025-04

April 2025

A Craft CMS remote code execution is mass-exploited within a week of patching, the xrpl.js npm package is backdoored to steal private keys, Node.js 18 reaches end of life on 30 April, the CA/Browser Forum votes to shorten TLS certificate lifetimes to 47 days and WordPress 6.8 ships with bcrypt password hashing.

What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.

AI platform and models

Sections
  • notable AI security

    Anthropic threat report finds Claude used in influence and credential attacks — anthropic.com

    On 23 April 2025 Anthropic published a Claude threat-intelligence report documenting four banned misuse clusters. One was a commercial influence-as-a-service operation orchestrating more than a hundred social bot accounts, with Claude deciding when each account commented, liked or reshared. Another enriched leaked credentials for internet-exposed security cameras and tested them against targets; a third used Claude for real-time language sanitisation in recruitment fraud.

    This is first-party evidence that AI is industrialising credential stuffing and content-farm traffic against public web properties — worth a fresh look at rate limits, bot management and MFA on CMS admin paths, and at any device or admin panel still exposed with reused credentials.

  • notable MCP

    AWS releases open-source MCP servers for AWS development — aws.amazon.com

    On 1 April 2025 AWS introduced five open-source first-party MCP servers: a Core coordinator, AWS CDK with cdk-nag security checks, Bedrock Knowledge Bases for natural-language retrieval, Nova Canvas for image generation, and a Cost analysis server. AWS describes MCP as a standardised open protocol for connecting models to data sources and tools.

    Anything that lets an AI assistant reach into an AWS account needs the same discipline as a human operator — decide now on least-privilege IAM for agent credentials and audit trails for what agents actually do, rather than after the first useful demo.

  • fyi Bedrock

    Amazon Nova Premier generally available on Bedrock — aws.amazon.com

    Amazon Nova Premier, AWS's most capable Nova foundation model, reached general availability on Amazon Bedrock on 30 April with a one million token context window suited to long documents and large codebases. It also acts as a teacher model for Bedrock Model Distillation, which can cut inference costs for narrower workloads.

    No adoption decision on the announcement itself. The part worth filing is Model Distillation: a teacher model is how a narrow, high-volume workload gets cheaper without changing its behaviour much, so this is the reference to reach for when inference cost rather than capability is the blocker on a client's use case.

Security and edge

Sections
  • notable TLS

    CA/Browser Forum votes to shorten TLS certificate lifetimes to 47 days — cabforum.org

    Ballot SC-081v3 passed on 11 April with no votes against, setting a phased reduction of maximum public TLS certificate validity from 398 days to 200 days in March 2026, 100 days in March 2027 and 47 days in March 2029. Domain validation reuse periods shrink to 10 days over the same schedule.

    Manual certificate renewal will not survive this timeline. Inventory certificates now and move everything to automated issuance and renewal, for example via ACME.

  • notable OpenSSL

    OpenSSL 3.5 LTS lands with post-quantum cryptography — openssl-library.org

    OpenSSL 3.5.0, released 8 April, is a long-term support release (supported until 8 April 2030) and ships NIST's post-quantum algorithms — ML-KEM, ML-DSA and SLH-DSA — built in. Default TLS behaviour changes too: the default key shares now offer X25519MLKEM768 and X25519, hybrid PQC groups are preferred, and server-side QUIC support arrives.

    Plan the upgrade for web-serving stacks, and test TLS interoperability first — the new default key shares can trip older clients and middleboxes that mishandle larger handshake messages.

  • fyi Chrome

    Google abandons third-party cookie deprecation in Chrome — privacysandbox.google.com

    On 22 April Google confirmed it will keep its current approach to third-party cookies in Chrome and will not roll out the long-promised standalone user prompt, ending the six-year deprecation saga. Incognito mode continues to block third-party cookies by default, with IP Protection planned for a Q3 2025 launch.

    Do not unwind first-party data work on the back of this — Safari and Firefox still block third-party cookies, and privacy regulation keeps moving in the same direction regardless of Chrome's default.

Standards and compliance

Sections
  • critical SOCI

    Critical infrastructure telecom and CIRMP rules commence on 4 April — cisc.gov.au

    Two instruments commenced on 4 April 2025: the Security of Critical Infrastructure Amendment (2025 Measures No. 1) Rules, which clarify existing critical infrastructure risk management program (CIRMP) obligations, including that a program must address risks to data storage systems holding business-critical data, and the Telecommunications Security and Risk Management Program Rules. They commenced alongside Schedule 5 of the Enhanced Response and Prevention Act. The Act's Schedule 1 treatment of data storage systems holding business-critical data had already commenced on 20 December 2024.

    This is the month a hosting or delivery layer holding a regulated entity's data can be pulled into that entity's risk-management program scope — customers in critical infrastructure sectors will start asking their platform vendors for aligned evidence on incident response, access control and supply-chain assurance.

  • notable ASD

    ASD joins six-agency advisory declaring fast flux DNS a national security threat — cyber.gov.au

    On 3 April 2025 the NSA, CISA, FBI, ASD's ACSC and Canadian and New Zealand partners released a joint advisory on fast flux — rapidly rotating the IP addresses and nameservers behind a domain to make phishing and command-and-control infrastructure resilient to takedown. ASD's ACSC published its copy on 4 April. The advisory says the technique poses a significant threat to national security and warns that some protective DNS providers may not detect and block it.

    Ask your DNS and protective-DNS providers whether they detect and block fast flux, and make sure DNS query logging and anomaly monitoring are part of your network visibility.

  • notable CVE

    The CVE program came hours from shutdown — bleepingcomputer.com

    MITRE told the CVE Board that the contract funding CVE and CWE would expire on 16 April 2025. CISA executed an eleven-month option the night before to prevent any lapse in service, and on 16 April CVE Board members launched an independent CVE Foundation to remove what they called the program's single point of failure.

    Every WAF virtual patch, dependency scanner, vendor advisory and ISM patching SLA is keyed to CVE identifiers — worth confirming your vulnerability management does not depend on a single upstream feed, and noting that the extension expires in 2026.

CMS and platforms

Sections
  • critical Craft CMS

    Craft CMS zero-day remote code execution exploited since February, patched in April — thehackernews.com

    Craft patched CVE-2025-32432 on 10 April 2025, three days after receiving the report — an unauthenticated remote code execution flaw scored 10.0 by NVD, reachable by posting a crafted class parameter to an asset transform endpoint, originating in the underlying Yii framework. Orange Cyberdefense had already observed the flaw being exploited as a zero-day from mid-February 2025, chained with the Yii flaw CVE-2024-58136, while investigating a compromised server; Craft confirmed in-the-wild exploitation on 17 April. Scans put roughly 13,000 vulnerable instances as at 18 April, with around 300 servers compromised. All Craft 3, 4 and 5 releases before the patches are affected.

    Patching is not sufficient on its own. Any site that ran an unpatched Craft install between mid-February and its own update needs compromise assessment, not just currency, because the exploitation predates the fix by two months. Blocking requests carrying the payload signature at the edge is a useful stopgap, but Craft is explicit that updating comes first.

  • notable WordPress

    WordPress 6.8 "Cecil" ships with bcrypt password hashing — wordpress.org

    WordPress 6.8, released 15 April, switches user password hashing from phpass to bcrypt and adds speculative loading for faster navigation, Style Book support in classic themes and more than 100 accessibility improvements. A follow-up maintenance release, 6.8.1, landed on 30 April with 15 bug fixes.

    Test plugins that interact with authentication or password hashes before upgrading, then move to 6.8.1.

Supply chain, CI/CD and IaC

Sections
  • critical npm

    xrpl.js npm package backdoored to steal private keys — xrpl.org

    On 21 April malicious versions of xrpl.js (4.2.1 to 4.2.4 and 2.14.2), the official XRP Ledger JavaScript SDK, were published to npm after a maintainer was phished for npm credentials (CVE-2025-32965). The backdoor exfiltrated wallet seeds and private keys to an attacker-controlled domain. Clean versions 4.2.5 and 2.14.3 replace them.

    Even if you do not use this package, treat it as a prompt to pin dependencies with lockfiles, restrict npm publish tokens and require two-factor authentication for maintainer accounts.

  • critical GitHub Actions

    GitHub Actions breaking changes take effect, legacy cache service retired — github.blog

    GitHub's 20 March notice said the legacy Actions cache service would shut down completely on 15 April 2025, after brownout windows on 1 and 8 April during which any workflow still hitting the old service might fail. Self-hosted runners older than v2.320.1 and third-party caching tools such as mozilla/sccache stop working once the cutover completes. A 15 April changelog covered further changes: Copilot-authored events now require workflow approval like fork runs, and the windows-2019 hosted image retires by 30 June 2025 after June brownouts. The March notice also removed the ability to approve deployments with only deployment: read from 1 April.

    Confirm self-hosted runners are on v2.320.1 or later, update any third-party caching tools such as sccache to their latest version, and re-run key pipelines after 15 April to confirm caches still restore correctly.

Languages, runtimes and frameworks

Sections
  • notable Node.js

    Node.js 18 reached end of life on 30 April — nodejs.org

    Node.js 18 left support on 30 April 2025 and no longer receives security updates. The Node.js project recommends updating to Node.js 20 or 22.

    Upgrade local environments, CI images and hosting runtimes to Node.js 22 (or at minimum 20), and check each project's engines field and framework support matrix.

  • notable Go

    Go patches HTTP request smuggling via a bare newline terminator — pkg.go.dev

    Released 1 April 2025, go1.24.2 and go1.23.8 fix CVE-2025-22871, a request smuggling flaw where a bare line feed was accepted as a chunked-encoding terminator in net/http. Where a Go service sits behind or in front of another HTTP implementation that parses the terminator differently, the two disagree about where one request ends and the next begins.

    Rebuild any Go service in a request path, especially one behind a proxy or CDN. Request smuggling is a class where patching the origin is not sufficient on its own — the exposure comes from a parsing disagreement between two hops, so both need checking.

  • notable Python

    Python fixes urlparse hostname flaw on three security branches — blog.python.org

    Released 8 April 2025, Python 3.11.12, 3.10.17 and 3.9.22 fix CVE-2025-0938, where urlparse failed to flag hostnames containing square brackets. The 3.13 and 3.12 lines already had the fix from 3.13.2 and 3.12.9. A parser that accepts a malformed hostname without complaint is the starting point for filter bypasses in any code making an allow-or-deny decision on a parsed URL.

    Patch, and separately audit anywhere you make a security decision from urlparse output — the fix restores correct flagging, but code that ignored the flag is still wrong.

Static site and web tooling

Sections
  • notable Hugo

    Hugo 0.146.0 rewrites the template system — gohugo.io

    Hugo 0.146.0, released 10 April, ships a full re-implementation of template handling — new lookup rules that work the same across template types and structural changes to the layouts folder. The project maps old conventions to new ones to keep most sites building, but the release notes ask you to test before going live, and sites with custom layouts should expect some breakage.

    Pin your Hugo version in CI until your theme confirms compatibility, then test builds against the new template system before upgrading production pipelines.

  • notable Vite

    Three more Vite file-deny bypasses in four weeks — github.com

    Vite disclosed three further server.fs.deny bypasses in April 2025: GHSA-xcj6-pq6g-qj4x on 3 April, using a .svg extension or a relative path; GHSA-356w-63v5-8wf4 on 10 April, using an invalid request-target; and GHSA-859w-5945-r5v3 on 30 April, using /. for files under the project root. They follow CVE-2025-30208 and GHSA-4r4m-qw57-chr8 in the last week of March, making five in six weeks.

    Upgrade, but draw the structural conclusion too: five bypasses of one control in six weeks means the control is not a boundary. Do not run a dev server anywhere its port is reachable by an untrusted network.

  • fyi Astro

    Astro 5.7 stabilises sessions and SVG components — astro.build

    Astro 5.7, released 15 April, promotes sessions and SVG components to stable and introduces an experimental Fonts API for optimised, self-hosted web fonts. The Fonts API is worth watching for sites that currently hand-roll font loading and preloading.

    Nothing forced. Sessions and SVG components reaching stable is the practical change, because it means both can go into client work without an experimental flag. Keep the Fonts API on the watch list rather than adopting it — it is aimed squarely at sites hand-rolling font preloading, and it is worth revisiting when it stabilises.

Build on what the radar tracks

Integrations

How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.

Learn more

AI applications

Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.

Learn more

For developers

REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.

Learn more