Radar · 2026-02
February 2026
A critical XSS flaw hits Drupal's SAML SSO Service Provider module, GitHub pushes self-hosted runner version enforcement to 16 March, maximum certificate lifetimes drop to 200 days from 15 March, WordPress 6.9.1 fixes 49 bugs and Canberra releases its annual PSPF and cyber posture reports.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- fyi Anthropic
Claude Sonnet 4.6 becomes the default on Free and Pro claude.ai plans — anthropic.com
Anthropic released Claude Sonnet 4.6 on 17 February 2026, a full upgrade across coding, computer use and long-context reasoning, with a 1M token context window in beta at unchanged pricing. On Free and Pro plans it is now the default model in claude.ai and Claude Cowork. Anthropic's safety evaluations report materially improved resistance to prompt injection compared with Sonnet 4.5, relevant for teams wiring models into agent workflows.
If you pin model versions in API integrations, review the migration notes before switching from claude-sonnet-4-5 to claude-sonnet-4-6.
- fyi Bedrock
Open-weight models arrive in Bedrock's Sydney region — aws.amazon.com
From 12 February 2026 Amazon Bedrock serves the latest open-weight models in the Sydney region, with models from DeepSeek, Google, MiniMax, Mistral, Moonshot AI, NVIDIA and OpenAI available through both the bedrock-runtime and bedrock-mantle endpoints.
Teams with data-residency constraints can rerun model evaluations against the in-region catalogue — check the Bedrock model list for exact versions, since the announcement names providers rather than model identifiers.
- fyi WordPress
WordPress developer blog introduces an official MCP adapter for the Abilities API — developer.wordpress.org
On 4 February 2026 the WordPress developer blog introduced the MCP Adapter, an official package that exposes Abilities registered through WordPress 6.9's Abilities API as Model Context Protocol tools, so MCP clients such as Claude, Cursor and VS Code can discover and call site functionality. Abilities already registered for WordPress can be enabled for those agents with one extra adapter step.
Teams experimenting with AI agents against WordPress get a supported integration path — and a new attack surface: decide which abilities are exposed, and to whom, before enabling anything on production sites.
Security and edge
Sections- notable TLS
Maximum certificate lifetimes drop to 200 days from 15 March — cabforum.org
Under the CA/Browser Forum Baseline Requirements, subscriber certificates issued on or after 15 March 2026 have a maximum lifetime of 200 days, the first step on the published schedule down to 47 days from 15 March 2029. Certificates issued before that date remain under the prior 398-day cap. Let's Encrypt also published guidance on 24 February 2026 on how its rate limits interact with shorter lifetimes, noting that renewals are exempt.
If you buy annual certificates from a commercial CA, this is the cycle where yearly manual renewal stops working; move those hosts to ACME-based automation, and check your ACME client supports ARI.
- notable nginx
nginx releases fix TLS upstream injection vulnerability — nginx.org
nginx 1.28.2 stable shipped on 4 February 2026 with a fix for CVE-2026-1642, where an attacker might inject plain text data in the response from an SSL backend. The matching mainline fix is 1.29.5. Configurations that proxy to TLS upstreams are the affected class.
Update nginx to 1.28.2 or 1.29.5 if you proxy to TLS upstreams, and rebuild container images that bake in an older version.
- notable TLS
Let's Encrypt to cut default certificate lifetimes to 64, then 45 days — letsencrypt.org
On 2 December 2025 Let's Encrypt set out the phase-down of its default certificate lifetime: from 90 days to 64 days on 10 February 2027, then to 45 days on 16 February 2028, with the tlsserver ACME profile moving to 45 days on 13 May 2026. A follow-up post on 24 February 2026 confirmed the change roughly doubles steady-state renewal volume but needs no subscriber rate-limit changes, because renewals are exempt from the limits. Let's Encrypt is shortening its own default lifetime on this timetable; the CA/Browser Forum 47-day subscriber-certificate cap is later, from 15 March 2029.
Confirm every ACME integration renews automatically and tolerates more frequent renewal — anything that needed manual attention at 90 days will fail unnoticed at 45.
Standards and compliance
Sections- fyi PSPF
PSPF assessment and Commonwealth cyber posture reports released — cyber.gov.au
The Australian Government released the 2024-25 PSPF Assessment Report and the 2025 Commonwealth Cyber Security Posture Report on 12 February 2026. While 92 per cent of entities rated Effective overall, technology security lagged at 79 per cent, and only 22 per cent of entities reached Essential Eight Maturity Level 2 when compensating controls were considered — up from 15 per cent in 2024, but still short of the 25 per cent recorded in 2023, before the requirements were hardened.
Government teams should note the recommended priorities: Essential Eight to Maturity Level 2, effective logging, legacy IT management, supply chain risk assessment in procurements, and early post-quantum cryptography planning.
- fyi Privacy Act
Tribunal partly overturns the Bunnings facial recognition ruling — oaic.gov.au
On 4 February 2026 the Administrative Review Tribunal handed down its decision in the Bunnings facial recognition matter: it upheld the Privacy Commissioner's findings that Bunnings breached APP 1 and APP 5 — no appropriate notice and no formal risk assessment — but overturned the consent finding, holding Bunnings could rely on exemptions for the limited purpose of combatting retail crime.
For anyone considering biometric or camera analytics, the enforceable lesson is what was upheld, not what was overturned: notice and a documented risk assessment before deployment are non-negotiable.
Update, March 2026: On 5 March the Privacy Commissioner said she would not appeal, calling the decision a high bar and a useful case study rather than a green light.
- fyi DTA
DTA's major digital projects report shows delivery confidence rising — dta.gov.au
The DTA released the Major Digital Projects Report 2026 on 9 February, covering 103 active investments involving $5.9 billion in digital technology spending against $9.7 billion in total budget commitment. Projects rated medium-high or high delivery confidence now represent 69.5 per cent of total budget, up from 52.9 per cent the year before.
Agency teams get the current benchmark for digital-project assurance expectations — and the project-level data is published as an open dataset for anyone tracking where Commonwealth digital spend is heading.
CMS and platforms
Sections- notable Drupal
Critical XSS in Drupal's SAML SSO Service Provider module — drupal.org
SA-CONTRIB-2026-018, published 25 February 2026, discloses a critical reflected cross-site scripting flaw (CVE-2026-3217) in the SAML SSO Service Provider module, caused by insufficiently sanitised user input. All versions before 3.1.3 are affected; the fix is 3.1.3.
SSO modules sit on the login path of government and enterprise Drupal sites — update to 3.1.3 immediately if installed, and audit other authentication-path contrib modules while you are there.
- fyi WordPress
WordPress 6.9.1 maintenance release fixes 49 bugs — wordpress.org
WordPress 6.9.1 shipped on 3 February 2026 as a short-cycle maintenance release with fixes for 49 bugs across core and the block editor, addressing issues in areas including the block editor, mail and classic themes. At the time of release, WordPress 7.0 was scheduled for 9 April 2026.
Apply 6.9.1 if you have not already; sites with auto-updates enabled will have received it.
- fyi Drupal
Drupal publishes its 2026 AI roadmap and hires delivery teams — drupal.org
On 11 February Dries Buytaert published Drupal's AI roadmap for 2026 — eight capabilities including page generation, context management, background agents and advanced governance — and the Drupal AI Initiative detailed how delivery is being scaled: 28 sponsoring organisations pledging more than 23 full-time-equivalent contributors and over US$1.5 million in combined cash and in-kind contributions. Delivery contracts were awarded through a formal RFP on six-month terms, with QED42 coordinating innovation and 1xINTERNET leading product development.
The eight capabilities show where Drupal CMS's AI surface is heading this year — review them before commissioning custom equivalents that may be superseded.
Supply chain, CI/CD and IaC
Sections- notable GitHub Actions
GitHub delays self-hosted runner version enforcement to 16 March — github.blog
GitHub's December 2025 plan to block self-hosted Actions runners older than v2.329.0 changed in February. A changelog post dated 5 February 2026 and updated on 20 February set full enforcement for 16 March 2026, with brownouts from 23 February, and clarified that the minimum applies when a runner is configured or registered, not to runners already executing workflows. GitHub Enterprise Server is not affected.
Upgrade self-hosted runners to v2.329.0 or later before you next register or re-register them, and enable automatic runner updates so they stay current.
Update, March 2026: GitHub paused enforcement on 13 March 2026, three days before the revised 16 March start.
Update, June 2026: On 12 June GitHub resumed enforcement with a new timeline: full enforcement from 31 July 2026 for Enterprise Cloud with data residency and 25 September 2026 for Enterprise Cloud. Runners must also install each new release within 30 days of its publication to keep receiving jobs.
Update, September 2026: GitHub moved full enforcement for Enterprise Cloud to 29 September 2026, with the requirements unchanged.
Languages, runtimes and frameworks
Sections- notable Go
Go 1.26 released, ending support for Go 1.24 — go.dev
Go 1.26 was released on 10 February 2026 with the Green Tea garbage collector enabled by default, roughly 30 per cent lower cgo overhead, and two language changes (expression new, and self-referential type parameters). Under Go's release policy each major release is supported until there are two newer major releases, so Go 1.24 no longer receives security fixes.
Move build images and tooling written in Go off 1.24 and onto 1.26, and retest GC-sensitive workloads given the collector change.
Static site and web tooling
Sections- fyi Interop
Interop 2026 sets twenty focus areas for browser alignment — webkit.org
The annual Interop project launched its 2026 round on 12 February, with Apple, Google, Igalia, Microsoft and Mozilla committing to twenty focus areas, fifteen of them new. Highlights for site builders include anchor positioning, cross-document view transitions, the Navigation API, scroll-driven animations and container style queries, all of which become safer to adopt as cross-browser scores climb through the year.
Nothing now. Use it the way the 2025 round was used: a focus area is a feature you can plan to build on without a fallback by the end of the year. The five worth prototyping against early are anchor positioning, cross-document view transitions, the Navigation API, scroll-driven animations and container style queries.
- fyi Docusaurus
Docusaurus 4 will require Node 24 — github.com
The Docusaurus v4 umbrella issue, opened 6 February 2026, lists planned floors of Node 24 or later, React 19.2 or later, TypeScript 6.0 or later, Rspack 2.0 or later and DocSearch 4.6 or later. No target date was published.
Put the Node 24 floor into capacity planning. The umbrella issue publishes no target date; treat the dependency list as a living checklist.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more