Radar · 2025-10
October 2025
ASD's ACSC alerts on an F5 incident and October BIG-IP patches, the AWS us-east-1 outage exposes hidden regional dependencies, npm tightens authentication and retires classic tokens, Node.js 24 is promoted to LTS, Python 3.9 reaches end of life and ASD releases the Annual Cyber Threat Report.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- notable WordPress
WordPress merges the Abilities API into core — make.wordpress.org
The Abilities API — a machine-readable registry of what a WordPress site can do — landed in core ahead of WordPress 6.9's feature freeze, confirmed in the AI team's check-in of 25 October 2025, with the client-side JavaScript API deferred. The same October cycle shipped PHP AI Client 0.2 and a major refactor of the MCP Adapter that builds on it.
This is the foundation WordPress agent and MCP integrations will assume from 6.9 onward — plugin teams should register abilities rather than inventing bespoke AI-integration surfaces.
- fyi Anthropic
Claude Haiku 4.5 brings small-model pricing to the 4.5 family — anthropic.com
Anthropic released Claude Haiku 4.5 on 15 October, a small model that matches the previous mid-tier Sonnet on coding and agent tasks at roughly one third of the cost and more than twice the speed. It is available via the Claude API and in the Amazon Bedrock and Google Cloud Vertex AI catalogues.
No action, but keep the ratio. A small model matching the previous mid-tier at about a third of the cost and twice the speed is the arithmetic that decides whether a high-volume feature — classification, summarisation, extraction — is affordable at all, and it is the number to reach for when a client's use case was priced out on the previous generation.
- fyi Anthropic
Data poisoning scales by document count, not by percentage — anthropic.com
Research published 9 October 2025 by Anthropic with the UK AI Security Institute and the Alan Turing Institute found that roughly 250 malicious documents were enough to install a backdoor in models from 600 million to 13 billion parameters. The number that matters is absolute, not a proportion of the training set — bigger models did not need proportionally more poison.
If you fine-tune on scraped or user-contributed content, treat corpus provenance as a security control rather than a data-quality one. Note the researchers' own caveat: this was not tested at frontier scale, so don't extrapolate past 13B.
Security and edge
Sections- critical F5
F5 breach exposes BIG-IP source code, ACSC issues high alert — cyber.gov.au
On 15 October 2025 F5 disclosed a long-running nation-state intrusion that exfiltrated BIG-IP source code and details of undisclosed vulnerabilities, shipping its October quarterly security release across BIG-IP, F5OS and related products at the same time. ASD's ACSC published a high-priority alert on 16 October urging immediate patching and monitoring; CISA issued an emergency directive for US agencies the same week.
Anyone fronting origins with BIG-IP should patch the October release, rotate credentials and certificates on F5-managed endpoints, and check management-plane exposure — stolen vulnerability research raises the odds of exploitation to come.
- notable AWS
AWS us-east-1 outage is a lesson in hidden regional dependencies — aws.amazon.com
On 19–20 October a race condition in DynamoDB's automated DNS management took out DynamoDB resolution in the us-east-1 region, cascading into roughly 15 hours of degraded service across dependent AWS services. AWS has published a detailed post-event summary.
Map which of your services depend on us-east-1 directly or through third-party vendors, and test how your sites degrade when an upstream API is unavailable. Static delivery and cached failover pages remain the cheapest resilience wins.
- notable Chrome
Chrome announces the end of plain HTTP by default — security.googleblog.com
On 28 October 2025 Google set the schedule for "Always Use Secure Connections": Chrome 147, in April 2026, enables it for the billion-plus users opted in to Enhanced Safe Browsing, and Chrome 154 makes it the default for everyone in October 2026 — warning before any first plain-HTTP navigation to a public site, with private addresses exempt.
Audit estates for residual HTTP-only endpoints, legacy redirect chains and hard-coded http:// links now — the timeline is published and the warnings are user-facing.
Standards and compliance
Sections- notable Privacy Act
First Privacy Act civil penalty lands, $5.8 million for Australian Clinical Labs — oaic.gov.au
On 8 October 2025 the Federal Court ordered Australian Clinical Labs to pay $5.8 million over the 2022 Medlab Pathology breach — $4.2 million for failing to protect the personal information of more than 223,000 people, $800,000 for inadequate breach assessment and $800,000 for failing to notify the OAIC promptly. They are the first civil penalties ordered under the Privacy Act 1988 (Cth).
The enforcement benchmark now exists: security investment, breach-assessment speed and notification timeliness are litigated obligations — re-test your incident-response and notification clocks against them.
- notable OAIC
OAIC sets privacy rules for social media age assurance — oaic.gov.au
Ahead of the Social Media Minimum Age scheme commencing 10 December, the OAIC published regulatory guidance on 10 October 2025 for age-restricted platforms and age-assurance providers: methods must be necessary and proportionate, collect minimal personal information, destroy it once the purpose is fulfilled, and any secondary use needs unambiguous, easily withdrawn consent — with a failure to meet those rules capable of being an interference with privacy.
The expectations generalise well beyond social platforms — any site implementing age gates or identity checks should mirror the data-minimisation and destruction rules rather than waiting to be told.
- fyi ACSC
ASD releases the Annual Cyber Threat Report 2024-25 — cyber.gov.au
The ASD's ACSC published the Annual Cyber Threat Report 2024–25 on 14 October. It highlights state-sponsored actors as a serious and growing threat to Australian government, critical infrastructure and business networks, and includes fact sheets for organisations and critical infrastructure operators.
Use the report's trends to sanity-check your threat model and patching cadence, particularly for internet-facing services and edge devices.
CMS and platforms
Sections- notable WordPress
WordPress 6.9 enters beta ahead of a 2 December release — make.wordpress.org
WordPress 6.9 Beta 1 shipped on 21 October, starting the public testing phase. The final release is scheduled for 2 December. Notable changes land in the Site Editor and performance.
Test themes and plugins against the beta in a staging environment now, and plan your 6.9 upgrade window for early December.
- notable Drupal
XSS advisory for CivicTheme, the AU government design system theme — drupal.org
SA-CONTRIB-2025-113, published 22 October 2025, rates a cross-site scripting flaw in the CivicTheme Design System theme moderately critical: field data reaches Twig rendering insufficiently filtered and embedded SVG markup goes unsanitised, allowing script injection by users with content-author permissions. All versions before 1.12.0 are affected.
CivicTheme is widely used across Australian government Drupal sites — upgrade to 1.12 and review who holds authoring and approval roles, since the attack path runs through them.
- fyi Drupal
Drupal AI Initiative raises US$1 million at DrupalCon Vienna — drupal.org
At DrupalCon Vienna on 14 October, Dries Buytaert announced that the Drupal AI Initiative had reached its US$1 million fundraising goal five months after launching — which the announcement calls the largest fundraising effort in Drupal's history. Twenty-two Maker organisations now back the initiative, funding a managed delivery team with six full-time contributors. For a community project, that is a product-company level of sustained AI investment.
Teams planning Drupal work into 2026 should factor the initiative in — AI capability is now a funded certainty in the Drupal ecosystem, not a community experiment.
Supply chain, CI/CD and IaC
Sections- notable npm
npm tightens authentication and retires classic tokens — github.blog
Following recent npm supply-chain compromises, GitHub announced a phased hardening of npm publishing on 29 September, rolling out through mid-November. New write-enabled granular tokens now default to a seven-day expiry with a 90-day maximum, classic tokens are being revoked, new TOTP 2FA setups are disabled, and trusted publishing via CI/CD identity is the recommended path.
Audit CI pipelines that publish npm packages, migrate to trusted publishing from GitHub Actions or GitLab CI, and replace long-lived tokens before the mid-November revocation.
Languages, runtimes and frameworks
Sections- notable Node.js
Node.js 24 promoted to LTS — nodejs.org
Node.js 24.11.0 'Krypton' entered long-term support on 28 October, with updates through the end of April 2028. The 24.11.0 notes say there are no further changes from 24.10.0 besides metadata. Node.js 24 arrived with V8 13.6, npm 11 and a permission model enabled with a plain
--permissionflag. With Node.js 20 reaching end of life on 30 April 2026, 24 is now the sensible target for new build pipelines.Schedule build-image and CI upgrades to Node.js 24, and start migration planning for anything still pinned to Node.js 18 or 20.
- notable Python
Python 3.9 reaches end of life — python.org
Python 3.9.25, published in October, is the final security release of the 3.9 line, which left support at the end of October 2025. Anything still running 3.9, including build tooling and automation scripts, will receive no further fixes of any kind.
Inventory build containers, serverless functions and utility scripts for Python 3.9 and upgrade to a supported release such as 3.12 or 3.13.
- notable Go
Go ships a large security release, then a follow-up six days later — groups.google.com
Released 7 October 2025, go1.25.2 and go1.24.8 span an unusually wide surface:
archive/tar,crypto/tls,crypto/x509,encoding/asn1,encoding/pem,net/http,net/mail,net/textprotoandnet/url— nine packages, with ten CVEs listed on the same-day golang-announce post. A follow-up on 13 October, go1.25.3 and go1.24.9, includes further fixes tocrypto/x509.Go straight to the 13 October point releases, even if you have already applied the 7 October pair: Go's vulnerability database lists go1.25.3 and go1.24.9 as the fixed versions for CVE-2025-58187 in
crypto/x509.
Static site and web tooling
Sections- notable Next.js
Next.js 16 makes Turbopack the default bundler — nextjs.org
Next.js 16, released 21 October, promotes Turbopack to the stable default bundler for development and production, with webpack builds behind an opt-out flag. It is a genuinely breaking major. Node.js 20.9 or newer is required, request APIs are async-only, and middleware.ts is replaced by proxy.ts, with an automated codemod handling the common migrations.
Self-hosted Next.js sites should test builds on 16 in a branch, confirm build images run a supported Node.js version, and budget time for the middleware-to-proxy rename.
- notable Lighthouse
Lighthouse 13 replaces legacy performance audits with insights — developer.chrome.com
Lighthouse 13.0, released 10 October, consolidates its performance audits with the Chrome DevTools performance panel into a shared set of insights. Scores are calculated the same way, but the legacy audits are removed from both the report and the JSON output, and PageSpeed Insights moved to Lighthouse 13 from 20 October.
If CI performance budgets or Lighthouse CI assertions reference old audit IDs, update them to the new insight names before they silently stop matching.
- fyi Astro
Astro 5.15 adds adapter APIs and finer font preload control — astro.build
October's Astro release, 5.15, brought granular font preload filtering, new adapter APIs and other 5.x additions, while Biome announced full support for Astro files. The font preload options are worth a look for performance-sensitive sites.
The font preload filtering is the part with a real payoff, because over-preloading fonts is a common self-inflicted performance regression — worth a look on any site where Largest Contentful Paint sits close to a threshold.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more