Security advisory: critical PHP and Node.js vulnerabilities are being exploited in the wild. What you need to do →
All months

Radar · 2025-12

December 2025

A critical remote code execution in React Server Components hits the Next.js App Router, Chrome patches an actively exploited graphics-library zero-day, npm permanently revokes classic tokens, PHP 8.1 security support ends on 31 December and Drupal 11.3 and WordPress 6.9 both ship.

What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.

AI platform and models

Sections
  • notable OWASP

    OWASP publishes the Top 10 for Agentic Applications — genai.owasp.org

    On 9 December 2025 the OWASP GenAI Security Project released the Top 10 for Agentic Applications, developed over a year by more than a hundred researchers with an expert review board drawing on NIST, the European Commission and the Alan Turing Institute. Named risks include agent behaviour hijacking, tool misuse and exploitation, and identity and privilege abuse.

    Teams building agents — on Bedrock, MCP or anything else — should threat-model against the ten risks before production, the way web applications are checked against the classic Top 10.

  • fyi MCP

    Model Context Protocol moves to the Agentic AI Foundation — modelcontextprotocol.io

    Anthropic donated the Model Context Protocol to the newly formed Agentic AI Foundation under the Linux Foundation on 9 December 2025, alongside founding projects from Block and OpenAI. Vendor-neutral governance reduces lock-in risk for teams building MCP servers and integrations, which the announcement puts at 10,000 active servers.

    Nothing to change technically. It is worth the note in a procurement or architecture review, because vendor-neutral governance is the answer to the lock-in question that gets asked about a protocol controlled by a single supplier — and at 10,000 active servers, MCP is now an integration surface rather than an experiment.

  • fyi Drupal

    Drupal Canvas 1.0 ships as a React visual page builder — drupal.org

    Drupal Canvas 1.0.0 was released on 4 December 2025 as a React-based visual page builder with drag-and-drop components, in-browser code components and multi-page editing with undo. It requires Drupal core 11.2 or later and includes an AI wizard.

    Drupal sites on 11.2 or 11.3 can now give editors drag-and-drop page building without contrib page-builder lock-in — evaluate it alongside the 11.3 upgrade this issue also covers.

Security and edge

Sections
  • critical Chrome

    Chrome patches actively exploited graphics-library zero-day — thehackernews.com

    Google shipped Chrome 143.0.7499.109 on 11 December 2025 to fix CVE-2025-14174, an out-of-bounds memory access in the ANGLE graphics library reported by Apple's security team and Google TAG, with an exploit confirmed in the wild. CISA added it to the Known Exploited Vulnerabilities catalogue with a 2 January 2026 federal patch deadline.

    Managed browser fleets should take the update immediately — renderer bugs reported by TAG with in-the-wild exploitation are the do-not-wait class.

  • notable TLS

    Let's Encrypt confirms the move from 90-day to 45-day certificates — letsencrypt.org

    Let's Encrypt published its rollout plan on 2 December 2025 for shortening certificate lifetimes, as required by the CA/Browser Forum Baseline Requirements. The tlsserver profile switches to 45-day certificates in May 2026 as an opt-in, the default profile moves to 64 days in February 2027, and 45 days becomes standard in February 2028, with authorisation reuse shrinking to hours.

    Confirm every certificate in your estate renews automatically. Anything renewed by hand or by calendar reminder will not survive 45-day lifetimes.

  • notable Apache

    Apache httpd 2.4.66 fixes five vulnerabilities — httpd.apache.org

    Apache HTTP Server 2.4.66, released 4 December 2025, fixes five CVEs: three moderate — query-string exposure through SSI exec, NTLM hash leakage via UNC server-side request forgery on Windows, and a mod_userdir suexec bypass — plus two low-severity issues, including an ACME retry-interval overflow in mod_md that matters to auto-renewing TLS setups.

    Patch Apache origins on the 2.4 line, prioritising Windows deployments exposed to the NTLM leak and anything using mod_md for certificate renewal.

Standards and compliance

Sections
  • critical DTA

    AI-in-government policy overhauled, with mandatory impact assessments — dta.gov.au

    The DTA announced version 2.0 of the Policy for the responsible use of AI in government on 2 December 2025, effective 15 December. The update mandates an AI impact assessment for use cases and a clearly assigned accountable officer for each, and requires agencies to develop a strategic position on AI adoption within six months of the policy taking effect, with accountable use case owners designated within 12 months. A new impact-assessment tool and procurement guidance align to the Digital Sourcing Lifecycle.

    Anyone selling AI-adjacent capability into Commonwealth agencies now faces impact-assessment and procurement checkpoints — build the policy's artefacts into proposals rather than treating them as the agency's problem.

  • notable ISM

    ASD releases the December 2025 update to the ISM — github.com

    The Australian Signals Directorate published its December 2025 update to the Information security manual, with new artificial intelligence controls including a general-purpose AI usage policy (ISM-2074) and controls covering AI documentation, model poisoning, unbounded consumption and excessive agency. Agencies and suppliers aligned to the ISM should review the updated controls and guidelines.

    Review the changed controls against your statement of applicability and update system security plans where the December changes touch your environment.

  • fyi ACSC

    New ACSC principles for AI in operational technology — cyber.gov.au

    On 3 December 2025 CISA and ASD's ACSC, with international partners, published principles for the secure integration of artificial intelligence in operational technology environments. The guidance covers risk assessment across the AI lifecycle, software bills of materials for embedded AI, and limiting active OT control by AI without a human in the loop.

    No obligation attached, and most readers do not run operational technology. Two parts travel anyway: a software bill of materials for AI systems, and humans in the loop for critical decisions. Both get asked about in Australian government AI reviews regardless of sector, so the guidance is useful as the citation for a position you probably already hold.

CMS and platforms

Sections
  • notable Drupal

    Drupal 11.3 ships with the biggest performance boost in a decade — drupal.org

    Drupal 11.3.0 was released on 17 December 2025, allowing sites to serve 26 to 33 per cent more requests with the same database load. It also adds native HTMX support, a stable Navigation module, native content export and cleaner object-oriented hooks for themes. Drupal 11.3.x receives security coverage until December 2026.

    Schedule the minor update in your next maintenance window and test contributed modules against 11.3 before deploying.

  • notable WordPress

    WordPress 6.9 "Gene" released with collaboration notes and Abilities API — wordpress.org

    WordPress 6.9 landed on 2 December 2025 with block-level Notes for editorial collaboration, an expanded Command Palette, and frontend performance work including on-demand block styles for classic themes. The new Abilities API provides a machine-readable permissions layer aimed at AI and automation workflows.

    Test the update on a staging copy first, particularly if you run a classic theme, because 6.9 loads classic-theme block styles on demand.

  • fyi WordPress

    WordPress proposes its 2026 major release schedule — make.wordpress.org

    The WordPress project published a proposed 2026 release calendar on 18 December 2025, with WordPress 7.0 slated for April 2026, 7.1 for August and 7.2 for December. The proposal switches WordPress back to three major releases a year after 2025's two, so content teams can plan upgrade and testing windows well ahead.

    Diary work. Three majors in 2026 against two in 2025 raises the testing burden by half for any WordPress estate, and April, August and December are the windows to protect. Treat it as a proposal rather than a commitment until the dates hold.

Supply chain, CI/CD and IaC

Sections
  • critical npm

    npm classic tokens permanently revoked — github.blog

    npm completed its token security overhaul by permanently revoking all remaining classic tokens on 9 December 2025, following the creation freeze announced in November. From that day npm login issues a two-hour session token, and GitHub recommends granular tokens or OIDC trusted publishing for CI.

    Audit CI/CD pipelines for classic tokens, replace them with granular tokens, and move publish workflows to trusted publishing on GitHub Actions or GitLab CI where possible.

  • notable GitHub Actions

    GitHub sets a minimum self-hosted runner version — github.blog

    GitHub announced on 12 December 2025 that self-hosted Actions runners will need v2.329.0 or later to register, as part of an Actions rearchitecture, and that runners on older versions will be blocked from connecting. Updated on 19 December, the timeline has brown-outs from 9 February 2026 and full enforcement from 2 March 2026.

    Upgrade self-hosted runners to v2.329.0 or later before the February brown-outs, and enable automatic runner updates so they stay current.

    Update, March 2026: GitHub paused enforcement on 13 March 2026, three days before a revised 16 March start.

    Update, June 2026: GitHub resumed enforcement, with full enforcement from 31 July 2026 for Enterprise Cloud with Data Residency and 25 September 2026 for Enterprise Cloud. Runners must also install each new release within 30 days to keep running jobs.

    Update, September 2026: GitHub moved full enforcement for Enterprise Cloud to 29 September 2026. Runners below v2.329.0 can no longer register or re-register.

  • notable OpenTofu

    OpenTofu 1.11 adds ephemeral secrets handling, with a list of breaking changes — github.com

    Released 9 December 2025, OpenTofu 1.11.0 added ephemeral resources and write-only attributes so secrets can stay out of plan and state, plus an enabled meta-argument. The breaking changes matter more than the features: macOS 12 or later is now required, the azurerm backend drops the endpoint and msi_endpoint settings and their environment variables, SHA-1 signatures are no longer accepted for TLS or SSH connections, and module packages installed from S3 source addresses now use the same credentials as the AWS CLI and SDK.

    Read the azurerm compatibility notes before upgrading if any backend sets endpoint or msi_endpoint. If you install modules from S3 source addresses, check which credentials module installation picks up in a non-production workspace first.

Languages, runtimes and frameworks

Sections
  • notable PHP

    PHP 8.1 security support ended on 31 December 2025 — php.net

    PHP 8.1 reached end of life on 31 December 2025 (last release 8.1.34) and is listed on php.net's unsupported-branches table as no longer receiving security fixes.

    Upgrade remaining 8.1 workloads to a currently supported 8.x line and confirm extension compatibility before cutting over.

  • notable Go

    Go patches certificate verification again — go.dev

    On 2 December 2025 Go 1.25.5 and 1.24.11 shipped two crypto/x509 security fixes (GO-2025-4175 / CVE-2025-61727 and GO-2025-4155 / CVE-2025-61729). In the 1.25 line this followed the 7 October 1.25.2 security release, which included crypto/x509, and the 13 October 1.25.3 x509 follow-up.

    Rebuild anything validating certificates in Go.

Static site and web tooling

Sections
  • critical Next.js

    Critical RCE in React Server Components hits Next.js App Router — nextjs.org

    A CVSS 10.0 remote code execution flaw in the React Server Components protocol (CVE-2025-55182, dubbed React2Shell), tracked for Next.js App Router as CVE-2025-66478, was disclosed on 3 December 2025 and affects Next.js 15.x and 16.x App Router apps. Next.js told operators to rotate secrets if an affected app was online and unpatched as of 4 December 2025. Follow-up advisories on 11 December patched a related denial of service and source code exposure in the same protocol.

    Upgrade self-hosted Next.js sites to the latest patched release in your line, and rotate application secrets if an affected site was reachable while unpatched. Pages Router, Next.js 13.x and 14.x stable, and Edge Runtime are not affected.

    Update, January 2026: On 26 January 2026 React added a further high-severity denial of service flaw in the same protocol (CVE-2026-23864, CVSS 7.5), so sites patched in December need another upgrade.

  • notable Vite

    Vite 8 beta replaces esbuild and Rollup with a single Rust bundler — vite.dev

    Announced 3 December 2025, the Vite 8 beta replaces both esbuild and Rollup with Rolldown, a single Rust bundler. Rollup-specific and esbuild-specific configuration may need adjustment, and framework users have to override the vite dependency to try it.

    Test on the opt-in rolldown-vite path on Vite 7 before the stable release rather than after — Vite recommends that path for larger projects, and Rollup- or esbuild-specific options may need to change.

Build on what the radar tracks

Integrations

How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.

Learn more

AI applications

Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.

Learn more

For developers

REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.

Learn more