Radar · 2026-01
January 2026
A critical WAF bypass in the OWASP Core Rule Set is fixed, Node.js patches eight vulnerabilities across its four supported release lines, OpenSSL patches a high severity flaw in CMS parsing, Drupal CMS 2.0 ships with Canvas as the default editing experience and Let's Encrypt makes 6-day and IP address certificates generally available.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- fyi Anthropic
Anthropic publishes Claude's constitution in full — anthropic.com
Anthropic published a new constitution for Claude on 22 January 2026, describing in detail the values and behaviour the models are trained toward. It was released under a Creative Commons CC0 licence, giving organisations assessing AI vendors useful transparency material for procurement and governance reviews.
No action. Its use is in procurement and governance review, where "how does the vendor decide what the model refuses" is a real question that rarely has a documentable answer — and a CC0 licence means you can quote it straight into an assessment without asking permission.
- fyi MCP
MCP Apps becomes the protocol's first official extension — blog.modelcontextprotocol.io
On 26 January 2026 the MCP maintainers declared MCP Apps production-ready as the protocol's first official extension. Tools can now return interactive interfaces — dashboards, forms, visualisations — rendered inside the conversation in sandboxed iframes, supported at launch in Claude, Goose and VS Code Insiders, with ChatGPT rolling out the same week. The work was a joint effort by Anthropic, OpenAI and the community.
Teams building MCP servers around content APIs can now ship interactive tool UIs to Claude and ChatGPT users — review the sandboxing and consent model before exposing anything beyond read-only views.
- fyi Bedrock
Bedrock extends prompt caching to one hour for Claude models — aws.amazon.com
From 26 January 2026 Amazon Bedrock supports a one-hour prompt-cache duration — up from five minutes — for Claude Sonnet 4.5, Haiku 4.5 and Opus 4.5, generally available across the commercial regions where those models are offered. The longer window is billed at a different rate from the five-minute cache.
Agentic and long-session Claude workloads with stable system prompts can cut inference cost and latency by opting into the one-hour TTL — re-run the cost maths per workload, since cache pricing differs by duration.
Security and edge
Sections- notable OpenSSL
OpenSSL patches high severity flaw in CMS parsing — openssl-library.org
OpenSSL shipped a coordinated security release on 27 January 2026 fixing CVE-2025-15467, a high severity stack buffer overflow triggered when parsing CMS or PKCS#7 content with crafted AEAD parameters. The overflow occurs before any authentication and could lead to remote code execution. The same advisory fixed a moderate PKCS#12 verification issue and a series of low severity bugs.
Update to OpenSSL 3.6.1, 3.5.5, 3.4.4, 3.3.6 or 3.0.19, prioritising systems that process untrusted S/MIME or CMS messages.
- notable OWASP
Critical WAF bypass in OWASP Core Rule Set fixed — coreruleset.org
On 6 January 2026 the OWASP Core Rule Set project disclosed CVE-2026-21876, rated 9.3: rule 922110 validated only the last part of a multipart request's charset, letting attackers smuggle UTF-7 or UTF-16 encoded payloads past CRS-protected web application firewalls in earlier parts. Every supported version was affected; fixes landed in 4.22.0 and 3.3.8 with no configuration changes required.
The Core Rule Set underpins most ModSecurity and Coraza WAF stacks — confirm your rules are on 4.22.0 or 3.3.8, or that your managed WAF provider has taken the update.
- fyi TLS
Let's Encrypt 6-day and IP address certificates now generally available — letsencrypt.org
Let's Encrypt made short-lived 6-day certificates and certificates for IP addresses generally available on 15 January 2026 via ACME profiles. Short-lived certificates are a useful forcing function for validating renewal automation ahead of Let's Encrypt's own planned move from 90-day to 45-day default lifetimes.
Consider issuing a short-lived certificate against a test hostname to prove your renewal automation copes with tight renewal cycles.
Standards and compliance
Sections- critical DTA
Digital Access Standard now applies beyond myGov — digital.gov.au
From 1 January 2026 the DTA's Digital Access Standard extends past Phase 1 (new and replacement services for individuals suitable for myGov, owned by non-corporate Commonwealth entities) to Phase 2: all other new and replacement public-facing digital services for individuals, businesses and providers, owned by Australian Government entities. Its five criteria include understanding how users access services and using the Australian Government Architecture to find reusable platforms and capabilities.
Agencies and their vendors scoping new or replacement public-facing government services should treat the Digital Access Standard as in force for the 2026–27 Budget proposals that have a public-facing portal.
- notable Privacy Act
OAIC's first privacy compliance sweep begins — oaic.gov.au
The OAIC's first privacy compliance sweep commenced in the first week of January 2026, reviewing the privacy policies of around sixty entities across six sectors — including rental and property services — against APP 1.4. Announced on 9 December, it puts to work the compliance-notice and infringement-notice consequences the 2024 Privacy Act amendments attached to foundational requirements, with penalties up to $66,000 for non-compliant policies.
Re-check your website privacy policy against APP 1.4's required contents — the sweep model means the OAIC can put a compliance or infringement notice on the table off the back of a policy review.
- fyi WCAG
W3C moves accessibility testing rules format toward standardisation — w3.org
On 6 January 2026 the W3C announced the proposed advancement of the Accessibility Conformance Testing (ACT) Rules Format 1.1 to W3C Recommendation, following its candidate recommendation in August 2025. The format standardises how accessibility test rules are documented and shared, so automated tools and manual WCAG methodologies test the same things the same way.
Teams running WCAG conformance testing on government sites should expect tooling and auditors to converge on ACT-formatted rules — worth asking about when procuring accessibility audits.
CMS and platforms
Sections- notable Statamic
Statamic 6 released with a rebuilt control panel, passkeys and 2FA — statamic.com
Statamic 6 shipped on 28 January 2026 with more than a thousand pull requests behind it: a complete control panel redesign on Vue 3 and Inertia, and native security additions including two-factor authentication, passkeys and elevated sessions. A command palette, collection calendar view and REST API authentication round out the release.
Teams on Statamic 5 should plan the major upgrade — and sites with MFA requirements can now satisfy them natively instead of via addons.
- fyi Drupal
Drupal CMS 2.0 released with Canvas as the default editing experience — drupal.org
Drupal CMS 2.0 shipped on 28 January 2026, introducing Drupal Canvas as the default editing experience with drag-and-drop live preview, the Mercury component library, Byte as the first site template, and optional AI features for generating pages from text prompts and for alt text.
Evaluate Canvas on a trial install before adopting it for existing sites. The release announcement does not say which themes are Canvas-ready or how sites move from Layout Builder or Paragraphs, so check both before planning a migration.
- fyi WordPress
WordPress schedules 6.9.1 to fix post-release bugs — make.wordpress.org
The WordPress core team confirmed on 20 January 2026 a short-cycle 6.9.1 maintenance release for early February (general release Tuesday 3 February 2026). It addresses tickets introduced or deferred in the 6.9 cycle, including block CSS loading changes in classic themes and an email delivery regression affecting some Sendmail configurations.
If your sites were affected by the classic theme styling or mail regressions, plan to apply 6.9.1 promptly when it lands.
Supply chain, CI/CD and IaC
Sections- notable Terraform
HashiCorp products are renamed under IBM — hashicorp.com
A support notice published 6 January 2026 records that HashiCorp business operations transitioned to IBM effective 1 September 2025, and that product names change accordingly — the Terraform Enterprise Platform License becomes IBM Terraform Self-Managed Premium. Customers see the new names on billing statements, with no change to features or functionality. The rename follows the acquisition completing in February 2025.
If you procure or renew Terraform through a government panel or reseller, check that the paperwork matches the new product names before renewal rather than at it. Nothing technical changes, but a purchase order naming a product that no longer exists is a slow problem to unwind.
- fyi GitHub Actions
GitHub-hosted runner pricing reduced by up to 39 per cent — github.blog
GitHub reduced pricing for hosted GitHub Actions runners from 1 January 2026, with cuts of up to 39 per cent depending on machine type. Standard runners on public repositories remain free, though larger runners are not. The same announcement flagged a $0.002 per minute platform charge on self-hosted runner usage from 1 March 2026, which GitHub then postponed while keeping the hosted-runner reductions; free minute quotas are unchanged.
Review CI budgets and any workarounds built to minimise runner minutes; larger runners may now be cost-effective for slow builds.
Languages, runtimes and frameworks
Sections- notable Node.js
Node.js security releases patch eight vulnerabilities — nodejs.org
Node.js shipped security releases on 13 January 2026 covering eight CVEs across the 20.x, 22.x, 24.x and 25.x lines, including a permission model bypass via symlinks, a remotely triggerable HTTP/2 denial of service, and uninitialised buffer exposure. Fixed versions are v20.20.0, v22.22.0, v24.13.0 and v25.3.0.
Update Node.js in build pipelines and server runtimes now. Node 20 reaches end of life on 30 April 2026 per the Node.js release schedule, so plan the jump to 22 or 24 at the same time.
- notable Go
Go patches the toolchain, TLS and archive handling — go.dev
On 15 January 2026 Go released go1.25.6 and go1.24.12 with security fixes in the go command, archive/zip, crypto/tls and net/url. A fix in the go command is a build-pipeline concern rather than a runtime one, since it affects the machine doing the building.
Update the Go toolchain in build images, not just the runtime base image. These are often different pins in the same pipeline and only one of them usually gets attention.
- notable Symfony
Symfony 7.3 leaves security support — symfony.com
Symfony 7.3 reached end of support in January 2026, holding to the same eight-month pattern as 7.1 and 7.2 before it. The LTS alternative is 7.4, released in November 2025 with bug fixes to November 2028 and security fixes to November 2029.
Move unattended projects to 7.4 LTS. A standard minor such as 7.3 has about eight months of support.
Static site and web tooling
Sections- notable Astro
Astro 6 beta arrives with a redesigned dev server and breaking changes — astro.build
The first Astro 6 beta was released on 13 January 2026, rebuilding the development server on Vite's Environment API so development runs in the same runtime as production. The release stabilises Content Security Policy support and live content collections, but brings breaking changes including a Node 22 minimum, Zod 4, and removal of Astro.glob() and legacy content collections.
Test existing Astro sites against the beta and plan the Node 22 upgrade now, since build pipelines pinned to Node 18 or 20 will block adoption of the stable release.
- notable React Router
Critical unauthorised file access in React Router session storage — github.com
On 8 January 2026 React Router published GHSA-9583-h5hc-x8cw, rated Critical 9.1:
createFileSessionStorage()with an unsigned cookie can read or write a session file outside the configured directory. Affected is@react-router/node7.0.0 through 7.9.3, fixed in 7.9.4 (and Remix v2node/denopackages through 2.17.1, fixed in 2.17.2).Patch immediately if you use the file session store, and check whether your cookies are signed — the Critical finding requires both conditions.
- notable Svelte
Svelte ecosystem advisory includes server-side request forgery in apps with prerendered routes — svelte.dev
Published 15 January 2026, a coordinated Svelte ecosystem post covers five CVEs. CVE-2025-67647 is denial of service and possible server-side request forgery in apps that use prerendering, in
@sveltejs/kitandadapter-node. CVE-2026-22803 is a memory-amplification denial of service in remote functions, and CVE-2026-22775 and CVE-2026-22774 are denial of service indevalue.parse. The fifth is CVE-2025-15265, XSS viahydratable. Fixed versions are svelte 5.46.4, @sveltejs/kit 2.49.5, adapter-node 5.5.1 and devalue 5.6.2.Upgrade all four packages together. The SSRF finding is the one to understand: an app with a prerendered route on adapter-node, without
ORIGINset or Host-header validation at a reverse proxy, can be made to reach internal resources from the SvelteKit server runtime. SetORIGINas well as upgrading.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more