Radar · 2026-04
April 2026
Drupal core patches a critical cross-site scripting flaw, Home Affairs proposes a stronger Hosting Certification Framework, curl 8.20.0 fixes eight flaws including four credential or cookie leaks, Node.js 20 reaches end of life and WordPress 7.0 is rescheduled to 20 May.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- notable ASD
ASD co-authors international guidance on adopting agentic AI carefully — cyber.gov.au
Released on 30 April 2026 in the US, "Careful adoption of agentic AI services" is an international cybersecurity information sheet that ASD's ACSC co-authored with the NSA, CISA and partners from Canada, New Zealand and the United Kingdom. It maps risks specific to agentic AI — over-privileged agents, prompt injection, privilege escalation, behavioural misalignment and accountability gaps — and recommends incremental deployment, explicit accountability, monitoring and human oversight.
Teams piloting AI agents should apply the guidance before production deployments.
- fyi Anthropic
Anthropic releases Claude Opus 4.7, also available in Amazon Bedrock — anthropic.com
Anthropic released Claude Opus 4.7 on 16 April, with improvements to complex long-running software engineering tasks, higher-resolution vision and stronger instruction following. Pricing is unchanged from Opus 4.6, and the model ships with safeguards that block high-risk cybersecurity uses. AWS added the model to Amazon Bedrock the same day, initially in four regions (US East N. Virginia, Asia Pacific Tokyo, Europe Ireland and Europe Stockholm).
Teams using Claude in content, code review or accessibility workflows should test existing prompts against the new model before switching defaults. Check regional availability before adopting it via Bedrock if data sovereignty matters to you.
- fyi OWASP
OWASP's Q1 2026 exploit round-up maps eight AI incidents to its Top 10s — genai.owasp.org
On 14 April 2026 the OWASP GenAI Security Project published its Q1 2026 exploit round-up, mapping eight real incidents from 1 January to 11 April 2026 to the LLM Top 10 and the new agentic Top 10 — including an agent supply-chain breach, indirect prompt-injection exfiltration and a remote-code-execution flaw reached through unsafe MCP configuration. Its key finding: attacks now target agent identities, orchestration layers and supply chains rather than just model outputs, and most AI-related security events are not yet mapped to traditional CVE identifiers.
Use the round-up as an incident-grounded checklist for AI agent deployments — it shows where agentic systems actually fail in the wild.
Security and edge
Sections- notable OpenSSL
OpenSSL 4.0.0 removes SSLv3 and the engine API — openssl-library.org
The 14 April feature release drops SSLv3 support entirely and removes the legacy engine API, while adding Encrypted Client Hello, a new hybrid post-quantum key-exchange group and deferrable FIPS self-tests. The engine removal is the breaking change to watch — anything integrating cryptographic hardware or custom implementations through engines must move to the provider API before adopting 4.0.
Audit custom builds and hardware security integrations for engine API usage now, before distributions start shipping OpenSSL 4.0 in their package repositories.
- notable curl
curl 8.20.0 fixes eight flaws, four of them credential or cookie leaks — curl.se
curl 8.20.0, released 29 April 2026, ships with eight security advisories — five rated Medium. Four are leaks (proxy credentials across redirects, cross-proxy Digest auth state, netrc credentials on a reused proxy connection, and a stale-host cookie leak), alongside an OCSP stapling bypass and three connection-reuse flaws. CVE-2026-6253 has existed since curl 7.14.1.
curl and libcurl sit in CI pipelines, container base images and PHP stacks everywhere — update to 8.20.0, prioritising build systems that use authenticated proxies.
Update, October 2026: curl 8.23.0, released on 14 October, fixes a High-severity HTTP/2 upload use-after-free (CVE-2026-92392) affecting 8.12.0 to 8.22.0, so 8.20.0 is no longer a safe target; update to 8.23.0 or later.
- notable Chrome
Chrome begins warning a billion users before public-site HTTP navigation — security.googleblog.com
Per the schedule Google set out in October 2025, Chrome 147 — the stable release through April 2026 — enables "Always Use Secure Connections" in its public-sites variant for the more than one billion users opted in to Enhanced Safe Browsing, warning before visiting a new or not recently visited public site without HTTPS. Sites the user visits regularly are not warned about repeatedly, and private sites such as local IP addresses are excluded. The setting becomes the default for all Chrome users in October 2026 with Chrome 154.
Audit delivered sites for residual HTTP-only endpoints, legacy redirect chains and hard-coded http:// links now — from October, all Chrome users get a bypassable warning before visiting a new or not recently visited public site without HTTPS.
Standards and compliance
Sections- critical Privacy Act
OAIC finds dark-pattern web forms breach the Privacy Act — oaic.gov.au
In a determination dated 1 April 2026 and announced on 22 April, the Privacy Commissioner found the 2Apply rental application platform breached the Privacy Act by collecting information a tenancy decision does not need — including citizenship and bankruptcy history — and by using manipulative form design such as confirmshaming and bundled consent. It is the first determination to treat dark-pattern choice architecture itself as unfair collection under APP 3.5.
Audit the forms on your sites against the "reasonably necessary" test and strip nudge patterns from consent flows — the determination gives the OAIC a template it can reuse anywhere personal information is collected online.
- fyi HCF
Home Affairs proposes a stronger Hosting Certification Framework — homeaffairs.gov.au
On 22 April 2026 the Department of Home Affairs announced reforms to the Hosting Certification Framework, centred on a strengthened, standardised HCF Deed of Certification with security requirements uplifted for the current threat environment across hosting infrastructure, supply chains, and cyber and technology dependencies. Consultation on the revised Deed runs for six weeks and is aimed exclusively at existing HCF-certified service providers.
Anyone hosting Australian Government data on certified platforms should expect flow-down obligations from the revised Deed; certified providers have a time-boxed consultation window to shape it.
- fyi OAIC
OAIC and eSafety formalise joint regulation of privacy and online safety — oaic.gov.au
On 23 April 2026 the OAIC and the eSafety Commissioner signed a memorandum of understanding coordinating their regulation where privacy and online safety intersect, explicitly naming age assurance and Social Media Minimum Age compliance, and noting that AI is amplifying online risks. The two regulators will share information and expertise rather than acting in separate lanes.
Sites subject to age-assurance or minimum-age obligations should treat privacy-by-design in their age checks as expected practice — evidence provided to one regulator can now inform the other.
CMS and platforms
Sections- notable Drupal
Drupal core patches critical cross-site scripting flaw — drupal.org
Drupal released three core security advisories on 15 April. SA-CORE-2026-001 is a critical cross-site scripting issue in core's jQuery integration for AJAX modal dialogs, alongside a moderately critical gadget chain (SA-CORE-2026-002) and a stored cross-site scripting issue in CKEditor 5 entity link suggestions (SA-CORE-2026-003).
Update to Drupal 10.5.9, 10.6.7, 11.2.11 or 11.3.7 as soon as possible. Sites on unsupported minor versions should move to a supported branch first.
- fyi WordPress
WordPress 7.0 rescheduled to 20 May — make.wordpress.org
After slipping its original 9 April date, WordPress 7.0 was rescheduled to 20 May. The updated schedule, published on the Make WordPress Core blog on 22 April, added RC3 on 8 May — treated like a beta in practice — and RC4 on 14 May, with a dry run / 24-hour code freeze on 19 May. The extra time went to what the release team described only as necessary architectural improvements, aimed at the most stable and most performant release possible.
Plan 7.0 testing around a 20 May release, and test against each release candidate as it lands rather than waiting for the final build.
Update, May 2026: WordPress 7.0 shipped on 20 May as planned, as "Armstrong", after a fifth release candidate on 19 May.
- fyi Drupal
Drupal AI Initiative marks one year with 34 partners and nearly 14,000 installs — drupal.org
A 23 April retrospective marks a year since the initiative took shape at Drupal Developer Days Leuven: 34 partner organisations (12 added since DrupalCon Vienna), nearly 14,000 sites running Drupal AI and growing at roughly 260 a week, and US$380,000 in cash plus US$1.5 million in in-kind contributions from more than 50 contributors across partner organisations. Dries Buytaert calls it the largest multi-company collaboration in Drupal community history — a useful marker of how quickly funded AI capability is compounding in the Drupal ecosystem.
No action. Keep the numbers for the conversations where they help: nearly 14,000 sites and roughly 260 new installs a week answers whether Drupal AI is safe to propose, and 34 partner organisations answers whether it survives its founders' attention.
Supply chain, CI/CD and IaC
Sections- notable npm
npm trusted publishing extends to CircleCI — github.blog
npm added CircleCI as a trusted publishing provider on 6 April. Trusted publishing authorises package publishes directly from CI without stored long-lived tokens.
If you publish npm packages from CI, switch to trusted publishing and revoke standing automation tokens.
- notable GitHub Actions
Copilot code review will consume Actions minutes from 1 June — github.blog
GitHub announced on 27 April that Copilot code review will start consuming GitHub Actions minutes from 1 June 2026. Public repositories are unaffected, but private repositories with Copilot review enabled on busy pull request queues will see it drawing on their Actions allowance.
Review where automatic Copilot review is enabled and check your Actions minutes budget before the change lands.
- notable Terraform
GitHub webhook secrets were exposed in a subset of deliveries to Terraform — hashicorp.com
Security bulletin HCSEC-2026-09, published 20 April 2026, discloses that a GitHub webhook-delivery bug leaked webhook secrets in an
X-Github-Encoded-Secretheader from 11 September to 10 December 2025, and briefly on 5 January 2026. GitHub patched the bug on 26 January 2026. The bulletin's audience is all HCP Terraform and Terraform Enterprise customers using GitHub VCS workflows; GitHub exposed secrets on a subset of outbound deliveries. HashiCorp rotated secrets automatically for the hosted service. Self-managed operators rotate only if GitHub notified them.If you run self-managed Terraform Enterprise with GitHub VCS, audit load balancer, proxy, gateway and log-aggregation stores for the
X-Github-Encoded-Secretheader between 11 September 2025 and 26 January 2026, and purge any matching logs. If GitHub notified you that your webhooks were affected, also rotate the webhook secrets with HashiCorp support.
Languages, runtimes and frameworks
Sections- notable Node.js
Node.js 20 reaches end of life — github.com
Node.js 20 (Iron) reached end of life on 30 April 2026 and now receives no security fixes; its final update was the 24 March security release (20.20.2). End-of-life versions remain affected by every future security release, so builds and servers pinned to Node 20 accumulate unpatched vulnerabilities.
Move build images, CI matrices and .nvmrc files to Node.js 22 or 24 (both LTS). Check engines fields and Dockerfiles for hardcoded Node 20 references.
- notable Go
Large Go security release spans the compiler and the TLS stack — groups.google.com
Released 7 April 2026, go1.26.2 and go1.25.9 fix ten security issues across the
gocommand, the compiler itself,archive/tar,crypto/tls,crypto/x509,html/templateandos. Two of the fixes are in the compiler (CVE-2026-27143 and CVE-2026-27144).Rebuild and redeploy every Go binary with go1.26.2 or go1.25.9. Go links the runtime and standard library into each binary, so redeploying existing binaries picks up none of these fixes, and the compiler fixes reach only code that is compiled again.
Static site and web tooling
Sections- notable Next.js
Next.js patches high severity denial of service in Server Components — github.com
An 8 April advisory (CVE-2026-23869) covers a flaw in React Server Components affecting Next.js 13 through 16 applications that use the App Router. A crafted HTTP request to any Server Function endpoint can trigger excessive CPU usage when deserialised — enough to deny service in unpatched environments. The issue was fixed upstream in React and in Next.js 15.5.15 and 16.2.3.
Upgrade self-hosted App Router deployments to 15.5.15 or 16.2.3. Sites shipped as fully static output have no Server Function endpoints and are not exposed.
- notable Vite
Vite patches an arbitrary file read over the WebSocket — github.com
On 6 April 2026 Vite published GHSA-p9ff-h696-f583 (CVE-2026-39363, High): an arbitrary file read through the dev server's WebSocket. Two same-day advisories cover a High
server.fs.denyquery-string bypass (CVE-2026-39364) and a Moderate path traversal in optimised-dependency.maphandling (GHSA-4w7w-66w2-5vf9).Upgrade, and note that the WebSocket path means blocking HTTP requests to the dev server is no longer sufficient mitigation. The only reliable control remains not exposing the dev server beyond localhost.
- fyi Astro
Astro 6.2 adds structured logging and build-time font helpers — astro.build
Astro 6.2, released 30 April, adds an experimental custom logger with JSON output suited to CI logs and coding agents, a redesigned SVG optimiser API with a built-in SVGO-based optimiser, and an experimental helper for loading font file data during prerendering, useful for generating Open Graph images at build time.
Nothing forced, though two of the three suit specific jobs. JSON logging makes an Astro build legible to CI tooling and to coding agents parsing output, and the build-time font helper is what lets generated Open Graph images match the site's typography without shipping a runtime dependency. Both are experimental, so prototype rather than adopt.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more