Radar · 2026-08
August 2026
A self-spreading npm worm publishes malware with valid provenance, a libheif flaw gives pre-auth code execution through Next.js and Astro image optimisation, ASD sees TeamCity and N-central servers exploited in Australia, attackers hit Kemp and NetScaler appliances and Debian 11 leaves long-term support.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- notable Anthropic
Claude's Python SDK reaches 1.0 with breaking changes as Opus 4.1 retires — anthropic.com
August brought no new Claude model but a dense month on the platform. Claude Opus 4.1 was retired on the Claude API on 5 August, so requests to it now return errors. On 19 August the computer use tool left beta as computer_toolset_20260801, with a changed request shape on migration, a browser use toolset launched, and the Files API and Agent Skills became generally available without beta headers. On 20 August Python SDK 1.0 moved to httpx2, raised its floor to Python 3.10, removed the legacy Text Completions API and the temperature, top_p and top_k parameters from the Messages methods, and made AnthropicBedrock raise an error when no AWS region is set. Sonnet 5's $2/$10 per million token pricing was also made permanent on 10 August, cancelling a rise due on 1 September.
Pin the anthropic Python package below 1.0 until the upgrade has been tested, and set the AWS region explicitly on every AnthropicBedrock client, since a missing region is now a failure rather than a default. Move anything still calling Opus 4.1 on the direct API.
- notable OWASP
OWASP publishes the 2026 Top 10 for LLM Applications — genai.owasp.org
The OWASP GenAI Security Project published the 2026 edition of its Top 10 for LLM Applications on 3 August. The new edition reorders the list, moving Excessive Agency to third, and extends its mappings to NIST, MITRE ATLAS, CWE and OWASP's own Top 10 for Agentic Applications. It is the reference security questionnaires and tender schedules cite for AI features.
Update questionnaire answers, tender responses and threat models that cite the 2025 list, and re-check any AI feature that calls tools or acts on a user's behalf against the agency risk now ranked third.
- notable WordPress
WordPress AI plugin 1.3.0 renames its meta keys and makes Custom Abilities opt-in — make.wordpress.org
The canonical WordPress AI plugin shipped 1.3.0 on 18 August, tested against WordPress 7.1. Post meta keys move from ai_* to wpai_*, Custom Abilities becomes an opt-in experiment that integrations must re-enable after upgrading, AI_Service and get_ai_service() are deprecated in favour of wp_ai_client_prompt(), and deleting the plugin now removes its data. Security changes add extra sanitisation of model output, nonce checks before bulk alt-text and summary generation, and validation of custom image URLs. The Anthropic, Google, Ollama and OpenAI connector plugins shipped updates in the same window.
Test on staging before upgrading. Anything reading the old ai_* meta keys or relying on Custom Abilities stops working until it is updated or the experiment is switched back on.
Security and edge
Sections- critical Edge appliances
Attackers exploit Kemp LoadMaster and NetScaler appliances — thehackernews.com
CISA added Progress Kemp LoadMaster CVE-2026-8037, an unauthenticated command injection across several command endpoints rated CVSS 9.6, to its Known Exploited Vulnerabilities catalogue on 7 August with a federal deadline three days later. On 26 August it added Citrix NetScaler ADC and Gateway CVE-2026-8452, a memory-bounds flaw, with threat intelligence firms reporting exploitation and one seeing web shells dropped. Citrix had shipped patches for two further NetScaler flaws, CVE-2026-19489 and CVE-2026-19490, on 19 August.
Patch any LoadMaster or NetScaler that sits in front of your origins now rather than at the next window, take management interfaces off the internet and check NetScaler hosts for unexpected PHP files. Take NetScaler to a build that includes the 19 August fixes in the same change.
Update, September 2026: On 9 September CISA added CVE-2026-19490, the NetScaler authentication bypass Citrix patched on 19 August, to its Known Exploited Vulnerabilities catalogue, so appliances that ran earlier builds need checking for compromise as well as patching.
- notable WAF
AI-assisted research proposes a new HTTP desync class and flags about 700 sites — thehackernews.com
Published on 7 August around Black Hat USA, PortSwigger researcher James Kettle's HTTP Terminator is an open-source, AI-assisted system that explored about 30,000 candidate desync vectors and proposed a new attack class, "shared-parser confusion", in which servers that reuse response-parsing logic misapply it to requests. Run against roughly 30,000 authorised websites, it flagged around 700 as vulnerable before deeper validation, banks, government infrastructure and security products among them; one multipart/byteranges technique alone exposed more than 200. It reportedly also found a desync zero-day in Apache Traffic Server.
Where a WAF or CDN talks to your origin over HTTP/1.1, move that hop to HTTP/2. Where that can't happen yet, allow-list methods at both ends and restrict which methods may carry a body.
- notable BGP
A BGP hijack gets a valid certificate and pushes a malicious Virtualizor update — virtualizor.com
Softaculous disclosed on 31 August that from about 20:57 UTC on 28 August to 06:10 UTC on 30 August, AS62390 announced 162.55.80.0/24, a more-specific slice of the hosting address space behind its update endpoint and client site, diverting traffic wherever the route propagated. Because the certificate authority's domain validation was routed through the hijack too, the attacker obtained a valid Let's Encrypt certificate covering 26 names across Softaculous, Virtualizor, Webuzo, Backuply, SitePad and its other product domains, so clients saw no warning. The update clients did not verify package signatures, and a malicious Virtualizor update reached "a handful" of servers.
TLS did not protect this update channel once routing was subverted, so treat signature checks on anything your servers auto-update from as mandatory. Add CAA records with accounturi to pin issuance to your own ACME account, publish RPKI ROAs for any prefixes you hold and monitor Certificate Transparency logs for your names.
Update, September 2026: On 29 September Softaculous said it had started signing all packages across its products, not only Virtualizor, and that all API responses are now signed.
Standards and compliance
Sections- notable ASD
ASD tells boards to treat foreign control of AI vendors as a cyber risk — cyber.gov.au
On 5 August ASD, with the Australian Institute of Company Directors, released guidance for boards on how frontier AI models change the cyber threat by making vulnerabilities easier to find and exploit, with actions across preventing, detecting, responding to and recovering from AI-related incidents. It asks boards to weigh "the foreign ownership, control or influence risks" their AI providers may pose, warns that frontier AI could cut exploitation timelines "from days to hours" as models chain low-severity vulnerabilities into high-impact compromises, and says AI agents should get only the minimum access their duties require.
Write down, for each AI feature you run or supply, whose model it uses, who owns and controls that provider and where inference happens. Agency boards now have ASD's word that this is a question to ask, and their suppliers will be the ones answering it.
- fyi Privacy Act
Exposure draft Privacy Bill proposes a 72-hour breach notification deadline — consultations.ag.gov.au
The Attorney-General's Department opened consultation on 31 August on an exposure draft Privacy Amendment (Personal Data Protection) Bill 2026, framed around risks from AI and wearables such as smart glasses. According to iTnews, eligible data breaches would have to be notified to the Information Commissioner within 72 hours of the entity becoming aware of reasonable grounds to believe one occurred, replacing "as soon as practicable", while the 30-day assessment window stays. The draft also proposes a narrow erasure right limited to large digital platforms and, iTnews reports, clarifies that personal information extends to behavioural data generated by wearable devices. Submissions close on 18 September, and the department says the Bill remains subject to further consideration by government.
The watch: introduction of the Bill to Parliament, and whether the 72-hour figure survives it. Nothing changes until then, but 72 hours is the number to hold against any hosting contract that still promises notification "as soon as practicable".
CMS and platforms
Sections- notable WordPress
WordPress 7.1 iframes every post editor after two 7.0 security releases — wordpress.org
WordPress 7.0.3 on 6 August fixed 12 security issues, headed by a pre-authentication reflected XSS on the login screen "with potential to lead to PHP code execution" (CVE-2026-64638), alongside four Contributor-level stored XSS bugs, a multisite privilege escalation and an SSRF in URL validation that could reach link-local ranges. WordPress 7.0.4 on 12 August fixed an Author-level remote code execution through malicious uploads on sites using Imagick and Ghostscript (CVE-2026-65640). WordPress 7.1 "Mary Lou" then shipped on 19 August as scheduled, with per-breakpoint block styling, in-browser image compression with AVIF, HEIC and HDR support, Playlist and Tabs blocks, an icon registration API and a post editor that is now always iframed for every theme. React 19 was deferred, so 7.1 stays on React 18.3.
Take 7.0.4 now if 7.1 has to wait: the login XSS is pre-auth on every site, and the link-local SSRF matters wherever cloud metadata endpoints live. Before moving to 7.1, test plugin and theme code that reaches the editor canvas through the global document or window, because the always-iframed editor breaks it.
- notable Drupal
Entity API access fix leads a busy month of Drupal contrib advisories — drupal.org
Drupal core published no security advisory in August, and the 19 August core window passed without one, but contrib was busy: two moderately critical advisories on 5 August, five on 12 August, three projects marked unsupported on 19 August and 15 advisories across 14 projects on 26 August. The fix that matters most for decoupled sites is in Entity API. SA-CONTRIB-2026-113, rated Moderately critical (12/25), found that JSON:API collection endpoints did not enforce access on sites with both JSON:API and Entity API enabled; 8.x-1.8 fixes it (CVE-2026-81158).
Update Entity API to 8.x-1.8 on any site that exposes JSON:API. Decoupled front ends and static builds that read content over JSON:API are exactly the affected configuration. Check too whether any site uses one of the projects marked unsupported on 19 August, and uninstall it if so.
Supply chain, CI/CD and IaC
Sections- critical npm
ChainDrop worm spreads through npm with valid provenance — bleepingcomputer.com
On 4 August a compromise of the Keyv maintainer's GitHub account produced malicious releases of keyv, flat-cache, file-entry-cache and packages in the cacheable namespace. A preinstall dropper fetches the Bun runtime and runs a stealer that harvests GitHub, npm, cloud, Kubernetes, Vault, database and private-key secrets, including from GitHub Actions runner memory, then republishes other packages under the stolen npm identities; estimates of the spread run from more than 400 to more than 1,300 packages. Because the attacker pushed to main and let the projects' own release workflows publish, the malicious versions carried valid provenance. The repositories also gained Claude Code and VS Code hooks that re-run the payload when a checkout is opened.
Check lockfiles and build logs for affected versions installed from 4 August, and treat any CI runner or developer machine that installed one as compromised: remove the payload's revocation watcher before rotating tokens, then rotate everything it could reach. Look for unexpected .claude/settings.json and .vscode/tasks.json files in cloned repositories. Provenance alone is no longer a trust signal; npm 12's default block on unapproved install scripts is the control that stops this kind of dropper.
- critical ASD
ASD sees TeamCity and N-central servers exploited in Australia — cyber.gov.au
ASD's ACSC warned on 24 August that it has observed active exploitation of TeamCity On-Premises servers within Australia. CVE-2026-63077 may let an unauthenticated attacker with HTTP(S) access bypass authentication and run arbitrary operating-system commands; ASD says all On-Premises versions are affected and points to the vendor for fixes, and iTnews reports the flaw was patched in late July. Five days earlier ASD had warned of attacks on N-able N-central remote monitoring and management platforms, putting managed service providers and the client networks they run at risk. N-able said on 10 August that an attacker exploited a flaw giving remote administrative access without authentication, then registered tunnelling services on managed devices to keep access after it was revoked. ASD names two authentication bypasses, CVE-2026-18556 and CVE-2026-18577, in all current versions including 2026.3, patched on 1 August with Hotfix 2 following on 6 August.
If you run TeamCity yourself, patch it, take its interface off the internet unless it truly needs to be there and hunt with the vendor's indicators, because that server holds deploy credentials for everything it builds. If an MSP runs your desktops or servers, ask whether N-central is on Hotfix 2 and whether managed devices were swept for unexpected tunnel services.
- notable Debian
Debian 11 bullseye leaves long-term support — debian.org
Debian announced on 31 August that Debian 11 "bullseye" reached the end of its Long Term Support that day, five years after its August 2021 release; only a subset of packages continues under support from external parties. Debian points users to Debian 12 "bookworm", which itself moved to LTS on 12 July with support until 30 June 2028.
Rebase every image built FROM debian:bullseye or a -bullseye official language image such as node, php or python. Bookworm is already on LTS, so trixie (Debian 13) is the rebase that buys the longest runway.
Languages, runtimes and frameworks
Sections- notable Python
Python security releases close a tarfile filter bypass on 3.10 to 3.12 — python.org
Source-only security releases 3.12.14, 3.11.16 and 3.10.21, published on 12 August, fix a bypass of the tarfile data and tar extraction filters that let symlinks escape the destination directory, alongside CVE-2026-2297 (SourcelessFileLoader not using io.open_code()), CVE-2026-4224 (an expat recursion crash) and CVE-2026-3644 (control characters in http.cookies.Morsel), and complete the fix for CVE-2021-4189 in ftplib. Around 25 further hardening fixes include CR/LF rejection in HTTPConnection.set_tunnel(), header-injection protection in wsgiref and several quadratic-time denial-of-service fixes. Python gives no severity ratings.
Rebuild images and runners on these releases. The security-only branches ship no installers, so containers and distro packages are the patch route, and anything unpacking untrusted archives with tarfile filters was relying on exactly the protection that was bypassed.
- notable Go
Go patches TLS, HTTP and template flaws, then ships 1.27 — go.dev
go1.26.6 and go1.25.13, released on 13 August after a two-day slip, carry security fixes to the go command and to crypto/tls, encoding/asn1, encoding/xml, html/template, net/http and net/url. Go 1.27 followed on 19 August with generic methods, encoding/json now backed by encoding/json/v2, and post-quantum ML-DSA in crypto/x509 and crypto/tls. Under Go's policy of supporting the two newest major releases, 1.27 moves 1.25 out of support; 1.25 got one more net/http fix in go1.25.14 the same day.
Rebuild Go SDK consumers and Go services on 1.26.6 or later now, then plan the move to 1.27. The encoding/json switch to v2 is the change to test before upgrading.
Static site and web tooling
Sections- critical Next.js
A libheif flaw gives unauthenticated RCE through Next.js and Astro image optimisation — nextjs.org
Next.js 16.3.3 (Active LTS) and 15.5.24 (Maintenance LTS), released on 25 August, fix two vulnerabilities the project rates Critical. The first is unauthenticated remote code execution in the Image Optimization API when it optimises an attacker-controlled AVIF image, through the libheif library that sharp uses; the patched releases disable AVIF optimisation until the upstream fix propagates. The second gives unauthenticated RCE on Windows-hosted servers for apps that mix Pages Router and App Router without Cache Components, with no workaround. Astro published a Critical advisory for the same libheif flaw on 27 August: its default Sharp image service is exposed when it can be made to process an untrusted AVIF, and astro 7.2.8, which requires Sharp 0.35.4, is the fix.
Upgrade Next.js and Astro now if either optimises images at request time. For Astro, make sure no lockfile or override holds sharp below 0.35.4, which the fix requires; the patched Next.js releases instead switch AVIF optimisation off. Any other pipeline that runs sharp over uploaded or remote images should check its sharp version too.
- notable Hugo
Hugo stops letting Tailwind configs run commands by default — github.com
Hugo v0.165.0, released on 12 August and announced on 14 August, removes tailwindcss from the default security.exec.allow list. The release notes list it only as a note, but it is a security fix: CVE-2026-75926, published on 18 August, records that from v0.162.0 a tailwind.config.js supplied by a theme, module or starter could spawn a shell outside Node's permission model and run arbitrary commands as the build account. Versions 0.162.0 to 0.164.0 are affected. Sites that call css.TailwindCSS without their own security.exec.allow setting will fail to build until they add ^tailwindcss$.
Upgrade, and add ^tailwindcss$ to security.exec.allow so the build keeps working. Then review any third-party theme, module or starter that ran on 0.162 to 0.164 on a CI runner holding deploy credentials.
- notable Chrome
Chrome 152 starts the removal clock on client-side XSLT — chromestatus.com
Chrome 152 reached stable on 25 August. Its release notes say client-side XSLT is deprecated and planned for removal from the web platform, with a deprecation trial available from 152; chromestatus says XSLT processing stops working in stable from Chrome 158. The same release removes the Private Aggregation API along with related Privacy Sandbox APIs, and adds suspicious-site warnings for Enhanced Safe Browsing users, a pop-up users can bypass on sites with signals of potential malicious activity.
Find any XML sitemap, RSS or Atom feed or legacy XML document styled through an xml-stylesheet XSLT, and pre-render it to HTML at build time or on the server before Chrome 158 reaches stable on 17 November 2026. If a client reports a browser warning on a brand-new microsite, the Safe Browsing change is the first place to look.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more