Radar · 2025-08
August 2025
The Nx s1ngularity attack leaks thousands of developer secrets, a Drupal two-factor module flaw allows login as any user, the MadeYouReset HTTP/2 flaw bypasses Rapid Reset defences, GitHub Actions adds SHA pinning enforcement and GovCMS sets out its Drupal 11 upgrade timeline.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- fyi Anthropic
Claude Opus 4.1 available, including on Amazon Bedrock — aws.amazon.com
Anthropic released Claude Opus 4.1 on 5 August 2025 as an upgrade focused on coding, agentic tasks and reasoning. It is on the Anthropic API, Amazon Bedrock and Google Vertex AI. Bedrock availability at launch was limited to US West (Oregon), US East (N. Virginia) and US East (Ohio), so check regional availability before planning workloads with data residency requirements.
The regional check is the only real task: a model available on Bedrock is not the same as a model available in Sydney, so confirm the region before planning a workload with data residency requirements. Beyond that the upgrade needs no response, and Anthropic kept pricing the same as Opus 4.
- fyi Bedrock
OpenAI's open-weight models arrive on Amazon Bedrock — aws.amazon.com
On 6 August 2025 AWS said OpenAI's gpt-oss-120b and gpt-oss-20b open-weight models were available on Amazon Bedrock, with a 128K context window and adjustable reasoning levels. At that announcement they ran only in US West (Oregon) on Bedrock.
Bedrock customers gain a non-Anthropic model family under the same API, but the launch is Oregon-only, so treat Sydney or other AU-residency use as unavailable for now.
Update, February 2026: On 12 February 2026 AWS added Amazon Bedrock support in Asia Pacific (Sydney) for the latest open-weight models from providers including OpenAI.
- fyi AI security
Anthropic and OpenAI cross-evaluate each other's models — alignment.anthropic.com
On 27 August 2025 Anthropic and OpenAI published findings from a pilot joint exercise: each lab ran its internal misalignment evaluations against the other's public models, covering sycophancy, misuse cooperation, self-preservation scenarios and sabotage. No model was found egregiously misaligned, though GPT-4o and 4.1 showed concerning misuse compliance under permissive system prompts.
Useful evidence for AI assurance and procurement cases on government projects — a cross-vendor evaluation baseline exists now, and it is citable.
Security and edge
Sections- notable TLS
Let's Encrypt OCSP service has reached end of life — letsencrypt.org
Let's Encrypt switched off its OCSP infrastructure on 6 August 2025, completing a shutdown announced in December 2024 and driven by the privacy risk of real-time certificate status queries. Revocation information is now published exclusively through certificate revocation lists.
Check web server configurations for leftover OCSP stapling directives pointing at Let's Encrypt and remove them, and confirm that any monitoring which queried OCSP responders has been retired.
- notable Chrome
Chrome 139 trims the Accept-Language header and clears window.name — developer.chrome.com
Chrome 139, stable from 5 August 2025, reduces fingerprinting surface in two ways that can affect delivered sites. The Accept-Language request header and navigator.languages now expose only the user's most preferred language rather than the full list, and window.name is cleared when a navigation switches browsing context groups.
If your sites vary content or redirects on Accept-Language, test language negotiation against Chrome 139, and check for cross-site flows that rely on window.name persisting.
- notable HTTP/2
MadeYouReset HTTP/2 flaw bypasses Rapid Reset defences — kb.cert.org
CERT/CC published VU#767506 on 13 August 2025: MadeYouReset (CVE-2025-8671) triggers server-initiated stream resets via malformed frames, bypassing the concurrent-stream limits added after 2023's Rapid Reset and enabling resource-exhaustion denial of service. Confirmed affected implementations include Apache Tomcat, Netty, Varnish and gRPC; Go's net/http, HAProxy, Envoy and Node.js were unaffected.
Anyone running their own HTTP/2 origins — especially Tomcat, Varnish or Netty stacks — should patch or rate-limit resets; edge-fronted architectures inherit the mitigation from their CDN layer.
Standards and compliance
Sections- critical ASD
ASD co-seals international advisory on Salt Typhoon edge-device compromises — cyber.gov.au
On 28 August 2025 ASD's ACSC joined agencies from thirteen countries in a joint advisory on Chinese state-sponsored actors, tracked as Salt Typhoon, who exploit known CVEs in backbone and edge devices from vendors including Cisco, Ivanti and Palo Alto to persist inside telecommunications, government and transport networks worldwide. It includes indicators of compromise, threat-hunting guidance and hardening actions.
Network teams should check the advisory's CVE list against their edge devices, run the hunting guidance, and confirm centralised logging captures device configuration changes.
- notable AUSTRAC
The AML/CTF Rules 2025 are made, setting the tranche-2 compliance text — austrac.gov.au
AUSTRAC's Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 were made on 29 August 2025 after two-stage consultation. The Rules are the operational text behind the tranche-2 reforms — commencing 31 March 2026 for existing reporting entities and 1 July 2026 for newly regulated entities, including professions such as lawyers, accountants and real estate agents.
Anyone building onboarding or verification workflows for tranche-2 sectors now has the final compliance text to design against, well ahead of the 2026 commencement dates.
- notable eSafety
eSafety begins standing transparency reporting on child safety — esafety.gov.au
In August 2025 the eSafety Commissioner published the first report under its periodic Basic Online Safety Expectations notices, assessing safety measures at Apple, Discord, Google, Meta, Microsoft, Snap, Skype and WhatsApp against child sexual exploitation and sexual extortion risks — part of a series rather than a one-off notice.
Platforms with user interaction should treat the Basic Online Safety Expectations as a standing compliance baseline now that reporting against them is periodic and public.
CMS and platforms
Sections- critical Drupal
Drupal 2FA module flaw allows login as any user — drupal.org
SA-CONTRIB-2025-096, published 13 August 2025, rates the Authenticator Login module highly critical (21/25, CVE-2025-8995): flawed AJAX authentication validation lets an attacker log in as any account knowing only the username, typically within a handful of requests. The fix is version 2.1.5. A two-factor authentication module that weakens login security is the ironic failure mode worth remembering.
Update alogin immediately if installed and review authentication logs for anomalous logins — then audit which contrib modules sit on your login path at all.
- notable GovCMS
GovCMS sets out its Drupal 11 upgrade timeline — govcms.gov.au
GovCMS ran a Drupal 11 information session on 29 August 2025 and has published its upgrade timeline. The distribution will be built on Drupal core 11.2.x, with a first release candidate due in September, and after a security assessment it is planned to launch in January 2026, with automated upgrades scheduled from February to April 2026.
GovCMS site owners should use the lead time to remove legacy technical debt, audit contributed modules against Drupal 11 compatibility, and note that the book module moves from core to a contributed equivalent.
Update, October 2025: GovCMS released a D11-beta of the distribution for local development and testing, with the January 2026 launch and February to April upgrades unchanged.
- notable WordPress
WordPress backports a certificate-bundle refresh to every branch since 4.7 — wordpress.org
On 5 August 2025 WordPress released maintenance updates for twenty-one branches — 4.7 through 6.7 — backporting the root certificate bundle refresh from 6.8.2 so server-side HTTPS requests validate against current trusted authorities. All-branches backports this deep are rare.
Legacy WordPress sites still make outbound API and update calls — apply the branch update or watch those calls start failing TLS validation as old roots age out.
Supply chain, CI/CD and IaC
Sections- critical npm
Nx packages compromised in the s1ngularity supply chain attack — thehackernews.com
On 26 August 2025, malicious versions of the Nx build system and several @nx/* packages were published to npm after attackers exploited an injectable pull_request_target workflow in GitHub Actions to steal a publishing token. A post-install script harvested GitHub and npm tokens, SSH keys and environment variables, uploaded them to public "s1ngularity-repository" GitHub repositories, and abused installed AI CLI tools to assist reconnaissance. Thousands of secrets and private repositories were exposed.
If anyone in your organisation uses Nx, check for the malicious versions, rotate GitHub and npm tokens, SSH keys and any credentials present in developer environment variables, and search your GitHub account for attacker-created repositories. Review your own workflows for pull_request_target misuse.
- notable GitHub Actions
GitHub Actions policy now supports SHA pinning enforcement and blocking — github.blog
On 15 August 2025 GitHub added two controls to Actions policies: organisations can require that all actions are pinned to a full commit SHA (failing workflows that reference tags or branches), and can block specific actions or namespaces by prefix to respond quickly when an upstream action is compromised.
Given the run of recent CI/CD compromises, enable SHA pinning enforcement where practical and document how you would block a compromised action during an incident.
- notable Terraform
go-getter symlink flaw allows arbitrary file reads — github.com
CVE-2025-8959, disclosed 15 August 2025 as HCSEC-2025-23, is a symlink flaw in HashiCorp's go-getter library scored CVSS 7.5: a subdirectory download can escape the intended directory boundary and read arbitrary files. It is fixed in go-getter 1.7.9.
Rebuild any tooling that vendors go-getter, and treat module fetching as a privileged operation rather than a download.
Languages, runtimes and frameworks
Sections- notable Go
Go 1.25 released — go.dev
Go 1.25 shipped on 12 August 2025 with container-aware GOMAXPROCS that respects cgroup CPU limits, an experimental garbage collector, an experimental encoding/json/v2 package and the new testing/synctest package. Per the Go support policy, Go 1.23 no longer receives fixes now that two newer releases exist.
Teams building Go tooling or edge functions should move off Go 1.23 and retest containerised workloads, as the GOMAXPROCS change can alter runtime behaviour under CPU limits.
- notable Go
Go 1.25 ships and Go 1.23 leaves support — go.dev
Go 1.25.0 was released 12 August 2025, dropping Go 1.23 out of support under the two-release policy. A security release covering
database/sqlandos/exechad landed on 6 August as go1.24.6 and go1.23.12.Move build images to 1.25 or 1.24. As with every Go major, the release is simultaneously an end-of-life event for the version two behind and there is no separate notice for it.
Static site and web tooling
Sections- notable Next.js
Next.js 15.5 ships Turbopack production builds and flags what breaks in 16 — nextjs.org
Next.js 15.5, announced 18 August 2025, brings Turbopack production builds in beta, stable Node.js middleware and typed routes. Deprecation warnings now fire for next lint, AMP support and other features that will be removed in Next.js 16.
Run a build on 15.5 and clear the deprecation warnings now, so the Next.js 16 upgrade is routine rather than a rewrite.
- fyi Astro
Astro 5.13 adds Chrome DevTools workspace support — astro.build
Astro 5.13 shipped in August 2025 with experimental improvements to environment variable handling and experimental support for Chrome DevTools workspaces, which lets you edit project files directly from the browser's developer tools during local development.
Nothing to roll out — both changes are experimental and affect local development rather than what ships. Still worth a look: DevTools workspace editing is the kind of convenience that quietly changes how a team debugs.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more