Radar · 2025-06
June 2025
An exploited Chrome engine flaw is patched out of band, malware is published to the gluestack and react-native-aria npm packages, Australia's statutory privacy tort comes into force, the June ISM rewrites its governance principles and Drupal 11.2 lands with major performance gains.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- notable MCP
MCP specification revision tightens security and structure — modelcontextprotocol.io
The Model Context Protocol released its 2025-06-18 specification revision on 18 June. It classifies MCP servers as OAuth resource servers, adds structured tool output and elicitation for requesting user input, removes JSON-RPC batching, and requires an MCP-Protocol-Version header on HTTP requests.
If you build or run MCP servers, review the changelog and plan the upgrade, paying particular attention to the new authorisation model before exposing servers beyond local use.
- fyi Drupal
Drupal launches its AI Initiative with funding and a dedicated team — drupal.org
On 12 June Dries Buytaert announced the Drupal AI Initiative: a published AI strategy, a leadership team, a funded delivery team, and active work tracks covering AI Core, AI Products, AI Marketing and AI UX. Founding companies committed US$100,000 in operational funding, rising to US$120,000 once Amazee.io added a further US$20,000. The significance is structural — AI in Drupal moves from a loose ecosystem of community modules to an organised, funded program aligned with the Drupal CMS strategy.
If you build on Drupal, read the published strategy before investing in custom AI integrations — the initiative signals where core-adjacent AI tooling is heading, and what may be superseded.
- fyi WordPress
WordPress AI team sets out its initial plans — make.wordpress.org
The newly formed WordPress AI team published its next-step plans on 5 June 2025 and held team chats on 12 and 26 June. The team is prioritising developer building blocks, including a provider-agnostic PHP AI client SDK, rather than a near-term core merge of generative features. It says a public roadmap with short- and medium-term goals will follow.
Nothing yet. The signal in the plans is that the team is building a provider-agnostic PHP client rather than generative features, which means the integration point for a WordPress estate will be an SDK you can aim at your own model endpoint — worth tracking as the thing that turns model choice into a configuration decision rather than a plugin choice.
Security and edge
Sections- critical Chrome
Exploited Chrome engine flaw patched out of band — thehackernews.com
CVE-2025-5419, an out-of-bounds read and write in Chrome's V8 engine rated 8.8, was reported by Google's Threat Analysis Group on 27 May 2025, mitigated by a configuration change the next day, and fixed in a Stable update shipped 2 June with NVD publication on 3 June. Google confirmed an exploit existed in the wild; other Chromium-based browsers needed their own rebuilds.
Content editors and administrators live in browsers, so an exploited engine flaw is a realistic path to a stolen CMS admin session — check that browser updates are enforced, and remember headless Chrome images in build and screenshot pipelines need rebuilding too.
- notable TLS
Let's Encrypt certificate expiry emails have ended — letsencrypt.org
Let's Encrypt stopped sending certificate expiration notification emails on 4 June 2025, confirming the shutdown in a follow-up post on 26 June. The change was made for privacy and cost reasons, on the basis that most subscribers now automate renewal.
If any of your certificates relied on those reminder emails, put independent expiry monitoring in place now and verify that renewal automation is actually working.
- notable TLS
Certificate authorities must honour DNSSEC from March 2026 — cabforum.org
CA/Browser Forum ballot SC-085v2 passed on 18 June 2025, amending the TLS baseline requirements so that certificate authorities must validate DNSSEC signatures when present, both for CAA record retrieval and for domain-control validation lookups. The change takes effect 15 March 2026.
Any DNSSEC-signed zone that is mis-signed, carries stale delegation records or serves broken responses will start failing certificate issuance and renewal outright from March 2026 instead of degrading silently — audit apex zones and CDN CNAME chains well before then.
Standards and compliance
Sections- critical Privacy Act
Statutory tort for serious invasions of privacy now in force — oaic.gov.au
The new statutory tort for serious invasions of privacy commenced on 10 June 2025 under the Privacy and Other Legislation Amendment Act. Individuals can now sue over intrusion upon seclusion or misuse of their information where the invasion was serious, intentional or reckless, and they had a reasonable expectation of privacy. It applies more broadly than the Privacy Act's APP entity coverage.
Review how your organisation collects, uses and secures personal information, including tracking and analytics behaviour on your websites, as exposure now extends beyond regulator action to direct court claims.
- notable ISM
ISM June 2025 update rewrites governance principles — cyber.gov.au
ASD published the June 2025 update to the Information security manual. The Govern principles were rewritten around Secure by Design and Secure by Default, making boards and executive committees explicitly accountable for cyber security, and new controls cover issue tracking in software development and scanning all software artefacts for malicious code before import.
Teams maintaining IRAP-assessed or ISM-aligned systems should review the change log and map the new governance and software development controls into their control frameworks.
- notable eSafety
First age-restricted online safety codes registered, hosting services included — esafety.gov.au
On 27 June 2025 the eSafety Commissioner registered the first three of nine Phase 2 (age-restricted) online safety codes, covering hosting services, internet carriage services and search engine services, with most obligations commencing 27 December 2025. Phase 1 codes and standards covering the most harmful material were already in effect.
The hosting services code lands squarely on this industry — anyone hosting or serving age-restricted material, and any platform doing so on a customer's behalf, needs to know which code applies and how notice and takedown flows work. Search engine providers also need to know what appropriate age assurance means for logged-in account holders.
Update, September 2025: eSafety registered the remaining six Phase 2 codes on 9 September 2025, with most obligations commencing 9 March 2026.
CMS and platforms
Sections- notable Drupal
Drupal 11.2.0 released with major performance improvements — drupal.org
Drupal 11.2.0 shipped on 19 June 2025 alongside Drupal 10.5. The release makes extension and site installation three to four times faster, completes object-oriented hook support (removing the need for .module files), adds JSON Schema generation for content entities, AVIF image support with WebP fallback, and native variant support for single-directory components.
Plan minor upgrades in your next maintenance window. Drupal 11.1.x receives security coverage until December 2025 and 11.2.x until June 2026, so schedule the move before the older branch drops off.
- notable WordPress
WordPress stops patching versions 4.1 through 4.6 — wordpress.org
On 19 June 2025 the WordPress security team announced that from July it would stop issuing security patches for WordPress 4.1 through 4.6 — branches roughly nine years old. The post restates the underlying policy plainly: the only actively supported version is the most recent one, and backports to older branches were always a courtesy rather than a commitment.
Any site still on those branches is now permanently unpatched. The realistic options are upgrade, freeze it behind a WAF as a static export, or decommission it — and the courtesy-not-commitment wording is the argument against relying on any pre-6.x branch.
- notable Drupal
Drupal core will replace Claro with the Gin admin theme — drupal.org
On 20 June 2025 the Drupal core team announced Gin will become the default administration theme, replacing Claro — no longer an experimental fork but, in the announcement's framing, a mature theme while Claro has fallen behind. A core-ready Gin branch is being developed outside core, targeted for Drupal 11.3 in December 2025, with Claro retained in Drupal 11 for backwards compatibility and expected to be removed in the next major version.
Anyone with custom admin theming, admin CSS overrides, editorial training material or accessibility testing scoped to Claro now has a migration horizon — and contrib modules that inject admin markup should be tested against Gin before 11.3.
Supply chain, CI/CD and IaC
Sections- critical npm
Malware published to gluestack and react-native-aria npm packages — bleepingcomputer.com
On 6 and 7 June 2025, attackers used a Gluestack npm access token, since revoked, to publish trojanised versions of 17 gluestack-ui and react-native-aria packages totalling around one million weekly downloads. The injected remote access trojan was hidden with whitespace obfuscation and gave attackers control of infected machines.
Audit lockfiles for the affected versions if you build with these packages, and enforce two-factor authentication and granular tokens for any npm publishing your organisation does.
Update, September 2025: Gluestack's incident report, published 4 September 2025, traces the compromise to a leaked maintainer npm access token that lacked two-factor authentication.
- fyi OpenTofu
OpenTofu 1.10 distributes providers and modules through container registries — opentofu.org
OpenTofu 1.10.0 was announced 23 June 2025 (GitHub tagged 24 June). It added OCI registry support for providers and modules, native S3 state locking,
-target-fileand-exclude-file, and OpenTelemetry tracing.For air-gapped or sovereignty-constrained environments — which covers a lot of Australian government work — OpenTofu pitches OCI registry distribution of providers and modules as a fit for air-gapped use. Worth evaluating even if you have no intention of leaving Terraform, because it changes what is possible in an offline build.
Languages, runtimes and frameworks
Sections- notable Python
Python ships coordinated security fixes across five branches — blog.python.org
On 3 June 2025 the Python Insider announced 3.13.4, 3.12.11, 3.11.13, 3.10.18 and 3.9.23 with security content, including tarfile extraction-filter bypasses via crafted symlinks and hard links (CVE-2024-12718, CVE-2025-4138, CVE-2025-4330 and CVE-2025-4517). Python 3.13.5 followed on 11 June as an expedited release fixing significant issues in 3.13.4.
Update build images and CI runners to the latest patch release of your branch, particularly if your tooling extracts untrusted archives with tarfile.
- notable Go
Go security release covers certificate handling and the HTTP stack — openwall.com
Released 5 June 2025, go1.24.4 carries security fixes in
crypto/x509,net/httpandos, with go1.23.10 coveringnet/httpandos.Rebuild Go services on the current or previous minor. Nothing here needs an out-of-band response, but certificate-handling fixes are the ones worth taking promptly on anything terminating or validating TLS.
Static site and web tooling
Sections- notable Vite
Vite 7.0 drops Node 18 and targets Baseline browsers — vite.dev
Vite 7.0, released 24 June 2025, requires Node.js 20.19 or 22.12 and newer, ships as ESM-only, and changes the default browser build target from "modules" to Baseline Widely Available — features supported across the major browsers for at least 30 months.
Move any build environments still on Node 18 now, and review your browser support matrix before your framework picks up Vite 7 — the new default target slightly raises the minimum supported browser versions of compiled output.
- notable Vite
Vite 7 drops Node 18 and changes the default build target — vite.dev
Released 24 June 2025, Vite 7 requires Node.js 20.19 or later, or 22.12 or later, and ships as ESM only. The default build target moved from
'modules'to'baseline-widely-available', raising the floor to Chrome 107, Edge 107, Firefox 104 and Safari 16 — so emitted bundles are transpiled differently even where nothing else changed. The legacy Sass API andsplitVendorChunkPluginwere removed.Check the Node version in your build image before upgrading, since this is the change most likely to fail a pipeline with no code change behind it. Then diff the built output: a changed transpilation target alters bundle contents and therefore cache keys.
- fyi Astro
Astro 5.9 and 5.10 ship CSP support and stable responsive images — astro.build
Astro released 5.9 on 5 June and 5.10 on 19 June 2025. Highlights include experimental Content Security Policy support, Markdown rendering in content loaders, responsive images graduating to stable, and experimental live content collections that fetch content at runtime rather than build time.
If you use the experimental responsive images flag, review the stable API when upgrading, and consider trialling the CSP support on sites with strict security requirements.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more