Security advisory: critical PHP and Node.js vulnerabilities are being exploited in the wild. What you need to do →
All months

Radar · 2026-09

September 2026

Attackers exploit two NetScaler pre-auth zero-days and a critical WordPress core flaw within a day of its patch, Chrome fixes two exploited V8 bugs, typosquatted Terraform providers deliver a backdoor, Next.js rushes out an RCE fix and the EU Cyber Resilience Act's 24-hour vulnerability reporting clock starts for software makers.

What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.

AI platform and models

Sections
  • notable Bedrock

    Claude 5.5 reaches Bedrock with Australia-only routing as Claude 3 Haiku retires in Sydney — docs.aws.amazon.com

    Claude 3 Haiku reached end of life on Amazon Bedrock on 10 September 2026 in eleven Regions including Sydney, after six months as a legacy model. Claude Opus 5.5 (22 September) and Sonnet 5.5 (28 September) launched on Bedrock with an Australian geographic cross-Region inference profile that routes only between Sydney and Melbourne, though neither is available in-Region in either city on the standard runtime endpoint. Claude Fable 5.1, on Bedrock from 1 September, is reachable from Australia only through global cross-Region inference. Opus 5.5's model card promises no end of life before 22 September 2027. On Anthropic's own API, Opus 5.5 always thinks and rejects tool_choice any or tool with a 400 error, and Sonnet 4.5 was deprecated on 30 September with retirement set for 30 November.

    Move any remaining Claude 3 Haiku workloads now — calls in Sydney stopped on 10 September. Use the au. inference profile for the 5.5 models where data has to stay in Australia, and treat the move as an upgrade to test rather than a model-ID swap. Anything pinned to Sonnet 4.5 on the direct API has until 30 November.

    Update, October 2026: On Bedrock, Claude Sonnet 4.5 entered Legacy on 8 October in 31 Regions including Sydney and Melbourne, with end of life on 8 April 2027 and public extended access pricing from 8 January 2027. Claude Sonnet 4 reached end of life on Bedrock on 14 October in 23 Regions, again including Sydney and Melbourne; requests to it now fail.

  • notable MCP

    Official MCP Python SDK could hand OAuth client secrets to a malicious server — github.com

    GHSA-qx49-fqc8-xw99, published on 28 September 2026, shows a malicious MCP server could steer the official Python SDK's OAuth flow so the client sent its client secret, authorisation code and PKCE verifier to a token endpoint the attacker controlled. Versions 1.9.1 to 1.29.1 and 2.0.0 to 2.1.1 are affected; 1.30.0 and 2.2.0, released on 7 September, fix it. It is rated 7.5 for the machine-to-machine ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider and 6.5 for the interactive OAuthClientProvider. Only HTTP clients able to connect to servers they don't control are exposed — not MCP servers built with the SDK, and not local stdio clients. The fixed releases also follow redirects only within the same origin and expire idle Streamable HTTP sessions after 30 minutes.

    Upgrading is not enough for the two machine-to-machine providers: pass issuer= explicitly and replace the deprecated 1.x RFC7523OAuthClientProvider, which has no issuer option. Then clear stored client registrations and rotate the client secret if a client may have connected to an untrusted server — a leaked long-lived secret keeps working until it is changed.

    Update, October 2026: On 6 October the TypeScript SDK's equivalent flaw was published as CVE-2026-104850 (GHSA-6qxp-vccf-f47h): with no user interaction, the client could send a stored refresh token and client secret to an authorisation server chosen by the MCP server. It affects @modelcontextprotocol/sdk from 1.12.0 before 1.31.0 and @modelcontextprotocol/client from 2.0.0 before 2.2.0; 1.31.0 and 2.2.0 fix it.

  • notable AI security

    A repository's Git config can run code outside coding agents' sandboxes — thehackernews.com

    Research reported on 2 September 2026 described eight flaws in one class across AI coding agents: a repository whose .git/config sets core.fsmonitor to a command makes Git run that command during the routine status checks agents perform at startup — as the user, outside the agent's sandbox and with no approval prompt. The .git directory has to arrive intact, through an archive, shared drive or sync folder, rather than an ordinary clone. Fixes shipped in goose 1.44.0, Codex CLI 0.131.0, Codex Desktop and Claude Code 2.1.196; a second Claude Code path through claude ultrareview was still open on 2.1.252, and several other agents were unpatched at publication. No exploitation was reported.

    Update coding agents, and don't open received code in an agent until its Git config has been checked for core.fsmonitor. Agencies hand code around as zips and shared folders, which is exactly the delivery route this needs.

Security and edge

Sections
  • critical NetScaler

    NetScaler under sustained attack as two pre-auth zero-days follow an exploited auth bypass — support.citrix.com

    On 27 September 2026 Citrix confirmed exploitation of CVE-2026-88771 and CVE-2026-88772, both CVSS 9.5 and pre-authentication: the first an input-validation flaw affecting default configurations of all NetScaler ADC and Gateway deployments, the second a memory-bounds flaw that needs DTLS, which is on by default for VPN virtual servers. CISA added both to its Known Exploited Vulnerabilities catalogue the same day, with a 30 September deadline for US federal agencies, and ASD's ACSC published an alert on 28 September. Fixed builds are 14.1-73.37 and 13.1-64.23, plus FIPS and NDcPP builds; 12.1 and 13.0 are end of life. Earlier in the month ASD urged priority patching of CVE-2026-19490, an authentication bypass in SAML and VPN gateway configurations patched on 19 August, which CISA added to the catalogue on 9 September.

    If you can, check for compromise before patching, preserving forensic evidence and using the indicators Citrix makes available through NetScaler Console. Then patch to the fixed builds now and move anything on 12.1 or 13.0 to a supported line — a patched appliance can still be compromised. Confirm that MSP-managed appliances are patched and monitored too.

    Update, October 2026: Two more October bulletins supersede these fixed builds. CTX697174 (3 October) fixed CVE-2026-88779, a pre-authentication denial of service in SAML configurations that Citrix said had been used in targeted attacks, in 14.1-73.41 and 13.1-64.28. CTX697191 (8 October) fixed CVE-2026-107406, a Critical memory overflow that can lead to remote code execution, affecting SAML identity provider configurations on 14.1-73.37 to 14.1-73.41 and 13.1-64.23 to 13.1-64.28, and both service provider and identity provider configurations on earlier builds. The builds to install are now 14.1-73.46 and 13.1-64.29.

  • critical Chrome

    Chrome fixes two exploited V8 zero-days, then starts warning before HTTP sites by default — bleepingcomputer.com

    Google patched two V8 flaws it said were exploited in the wild within a week: CVE-2026-85046, a type confusion fixed in Chrome 152.0.7977.82/.83 on 3 September and added to CISA's Known Exploited Vulnerabilities catalogue on 4 September, and CVE-2026-87491, an out-of-bounds write fixed in 153.0.8010.36/.37 on 8 September and added on 9 September — the sixth and seventh exploited Chrome zero-days of 2026. On 21 September a security firm reported both chained with a Windows flaw (CVE-2026-85880) and delivered through fake websites. Chrome 154, stable on 22 September, also turns on "ask before HTTP" by default: Chrome now prompts users before loading a site over an insecure connection, and administrators can change that with the HttpsOnlyMode enterprise policy.

    Make sure managed browser fleets are on 153.0.8010.36 or later. Then audit every public hostname and redirect chain for a plain-HTTP hop — legacy subdomains, vanity domains, short links and printed QR codes that start with http:// — and serve HTTPS with HSTS at the edge, because a first-time visitor now meets a warning.

  • notable BIND

    BIND patches seven high-severity flaws, with no fix for the end-of-life 9.18 branch — kb.isc.org

    ISC disclosed 14 BIND 9 vulnerabilities on 16 September 2026, fixed in 9.20.29 and 9.21.26. Seven are rated High, all CVSS 7.5: a validating resolver aborting on a mismatched NOQNAME proof, two SVCB and HTTPS AliasMode issues, a remote assertion failure in negative caching, an abort on a TKEY query when there is no global options statement, a remote crash from a single DoH SIG(0) request and a use-after-free in the DNS64 path. Of the seven Medium issues, CVE-2026-19033 applies unauthenticated IXFR deltas to the live zone before TSIG verification. ISC knows of no active exploits. There is no 9.18 fix for any of them: ISC's 9.18 matrix marks the branch end of life from 1 July 2026, after 9.18.50 on 17 June.

    Upgrade recursive and authoritative BIND servers to 9.20.29. 9.18 is end of life and will get no fix, so move anything still on it to 9.20, and review zone-transfer setups that rely on TSIG — the IXFR flaw applies changes before the signature is checked.

Standards and compliance

Sections
  • critical EU CRA

    EU Cyber Resilience Act reporting starts for software makers selling into the EU — enisa.europa.eu

    From 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents affecting those products' security. ENISA launched the first stage of its CRA Single Reporting Platform the same day to receive them. The European Commission sets three deadlines: an early warning within 24 hours of becoming aware, a full notification within 72 hours and a final report, due no later than 14 days after a corrective measure is available for an exploited vulnerability or within a month of the notification for a severe incident. Open-source software stewards' reporting duties and the Act's main cybersecurity requirements apply from 11 December 2027.

    If you ship a software product into the EU, such as an SDK, CLI, plugin, module or app, you now need to spot active exploitation of it and send an early warning within 24 hours. Name who makes that call and who files the report, and start planning for the main requirements that apply from December 2027.

  • notable PSPF

    PSPF Direction 002-2026 orders a government-wide legacy technology stocktake — protectivesecurity.gov.au

    Issued by the Secretary of Home Affairs on 29 September 2026 and binding on all non-corporate Commonwealth entities, the Direction says that where frontier AI capabilities have targeted the Commonwealth's technology estate, continuing to run vulnerable legacy systems "poses an unacceptable risk to the Australian Government". By 31 March 2027 every entity must complete a legacy technology stocktake, prioritising public-facing services, and give Home Affairs a Legacy Technology Risk Management Plan with a reduction target, prioritisation strategies and mitigations for legacy systems it keeps. Entities operating Systems of Government Significance face an earlier date: by 31 December 2026 they must apply risk-reduction measures for those systems and report their stocktake. Entities should also strengthen patch management across their whole estate, rapidly patching vulnerabilities deemed critical by vendors or their own processes. Policy Explanatory Note 002-2026 is due by 13 October with further detail. The Direction came days after the disclosure that an OpenAI agent had accessed a legacy Medicare statistics portal in June.

    Suppliers to Commonwealth agencies should expect stocktake questions about every legacy public-facing system they host or maintain — old CMS versions, unsupported PHP and self-hosted web stacks — and requests for evidence of patch timeframes on vendor-critical vulnerabilities. Have version inventories and patch records ready before the deadlines drive the asks.

  • notable ASD

    September ISM gives AI agents their own identities and tightens OAuth and workload credentials — cyber.gov.au

    ASD's September 2026 changes to the Information Security Manual add controls for AI agents: each agent gets a unique identity distinct from staff accounts and other agents (ISM-2133) and an entry in an AI agent register recording its owner, purpose, credentials and the tools and data it can reach (ISM-2134, ISM-2135). Agentic AI applications should be limited to the minimum tools and permissions they need, treat retrieved external content as untrusted and centrally log every tool invocation (ISM-2156 to ISM-2159). Other new controls reach web and hosting teams directly: only administrators may consent to third-party OAuth applications (ISM-2137); applications and workloads should use short-lived, centrally managed credentials that are not shared across development, testing, staging and production (ISM-2141 to ISM-2143); session cookies and refresh tokens should be bound to the device they were issued to (ISM-2147); dependencies should be pinned (ISM-2154), builds reproducible (ISM-2155) and backups immutable (ISM-2151). Vulnerability assessments and penetration tests move from annual to every six months (ISM-2118), and the control to disable IPv6 on dual-stack devices (ISM-0521) is rescinded. Separately, ASD guidance on agentic AI harnesses, published on 11 September, says prompt injection cannot be reliably addressed within the model alone, so controls belong in the harness around it.

    Re-baseline system security plans and IRAP evidence against the September edition. For hosted sites, check the controls that land on us first: admin-only OAuth consent, per-environment workload credentials held in a secrets manager, pinned dependencies, immutable backups and six-monthly penetration tests. Anything on a government site that lets a model call tools now needs its own identity, a register entry and tool-call logging.

  • notable Privacy Act

    OAIC finalises guidance on the automated decision-making transparency obligation — oaic.gov.au

    On 30 September 2026 the OAIC published a fact sheet on the APP 1.7–1.9 transparency obligation, a supplementary fact sheet for government agencies, a flowchart and updated APP 1 Guidelines. From 10 December 2026, APP entities must say in their privacy policy what kinds of personal information computer programs use, which kinds of decisions programs make solely, and which they do something substantially and directly related to, where a decision could reasonably be expected to significantly affect an individual's rights or interests. The fact sheet treats advisory machine-learning and generative AI outputs that inform significant decisions as generally in scope unless subject to extensive human oversight, says human review does not automatically take an activity out of scope, and lists personalised pricing and programmatic advertising tied to significant goods or services as generally in scope.

    Inventory the personalisation, AI search, eligibility and pricing logic on your sites and draft the privacy-policy wording before 10 December, when the obligation commences.

CMS and platforms

Sections
  • critical WordPress

    Critical WordPress core flaw is exploited within a day of its patch — wordpress.org

    WordPress 7.1.2, released on 22 September 2026, fixes CVE-2026-87902, which the project rates critical severity: under certain conditions an unauthenticated attacker can make page-template resolution include a chosen readable PHP file outside the theme directories, leading to remote code execution. The fix is backported to every branch back to 4.7, and sites that support automatic background updates will start updating on their own. Exploitation attempts were reported within a day of release, and CISA added the flaw to its Known Exploited Vulnerabilities catalogue. Code execution needs an active theme with a top-level directory whose name starts with "page-" (such as page-templates) and a readable PHP file to include, such as pearcmd.php with register_argc_argv on. The release came five days after 7.1.1, which fixed eleven security issues.

    Update every WordPress origin to 7.1.2, or 7.0.6, 6.9.9 or 6.8.10 on older branches, now — a static or cached front end does not protect the origin — and check whether the active parent or child theme has a top-level directory whose name starts with "page-".

    Update, October 2026: WordPress 7.1.3, released on 6 October, fixes seven further security issues, so it is now the version to patch to.

  • notable Drupal

    Drupal 12 reaches beta with PHP 8.5 required, as Drupal 10's end of life nears — drupal.org

    Drupal 12.0.0-alpha1 was tagged on 2 September 2026 and 12.0.0-beta1 on 30 September, two weeks after the scheduled beta week. Drupal 12 requires PHP 8.5, Symfony 8.1 and PHPUnit 12.5; database minimums rise to MySQL 8.0, MariaDB 10.11 and PostgreSQL 19, and argon2id becomes the default password hash. Nine modules, including Contact, Search, Telephone and Toolbar, and the Claro, Stable 9 and Olivero themes move from core to contrib, while Migrate Drupal and Migrate Drupal UI are removed. The update system refuses to update from 11.2 or earlier, and 11.4 or later is recommended. Release candidates are scheduled for the week of 9 November and 12.0.0 with 11.5.0 for the week of 7 December, and Drupal 10 reaches end of life on 9 December 2026. The month's only core advisory, SA-CORE-2026-013 on 16 September, fixed a CKEditor 5 cross-site scripting flaw in 11.4.7, 11.3.17 and 10.6.17.

    Plan Drupal 10 upgrades now — under three months of support remain. Check that hosting can provide PHP 8.5 and the new database minimums, and add the contrib versions of Search, Contact or Olivero before upgrading any site that uses them so configuration isn't lost.

  • notable Drupal

    Webform ships 20 security advisories, led by a code execution flaw — drupal.org

    Pre-announced by the Drupal Security Team on 21 September 2026, Webform released 20 security advisories on 23 September. The headline, SA-CONTRIB-2026-175 (CVE-2026-96355), is rated Critical 18/25: submitted data could be evaluated as template code when a submission renders, but only where a webform uses a custom multiple-value item format containing submission-value tokens. It is fixed in 6.2.12 and 6.3.1. Sixteen further advisories are moderately critical, mostly cross-site scripting and access bypass with one server-side request forgery. The same day brought a Critical-rated CSRF fix for Project Browser, which ships with Drupal CMS.

    Update Webform to 6.2.12 or 6.3.1 and Project Browser to 2.0.3 or 2.1.5 in your next window. Webform takes anonymous input on many agency sites, and twenty advisories in one module are an update to schedule rather than skim; these are not covered by Drupal Steward.

Supply chain, CI/CD and IaC

Sections
  • critical Terraform

    Typosquatted Terraform providers on the public registry deliver a remote-access backdoor — thehackernews.com

    On 23 September two malicious providers on HashiCorp's public Terraform Registry were reported: gocommunity-io/dockerd, with 222 downloads, and kreuzwenker/docker, one letter away from the widely used kreuzwerker/docker provider, with 1,449. They and two malicious Go modules, gocommunity.io/orderedbtree and gogets.dev/btreex, carry a Go backdoor that sends host details to an attacker's Slack channel and polls an Ethereum smart contract every three seconds for code to run. Researchers link it to Graphalgo, a campaign tied to North Korea that lures developers with fake job interviews.

    Search every repo and CI runner's .terraform.lock.hcl and required_providers for gocommunity-io/dockerd and kreuzwenker/docker, and go.sum for the two Go modules, and treat any host that ran them as compromised. Copy provider addresses from the registry rather than typing them, and pin providers by version and lock-file hash: a one-letter slip is the whole attack.

  • notable HashiCorp

    HashiCorp rotates its Linux package signing key after a delivery-pipeline security incident — hashicorp.com

    On 10 September 2026 HashiCorp replaced the GPG key that signs its Linux APT and RPM packages with a new key, fingerprint D55C 0D1A C78A 8D81 26CB 631C FC9C A96A CA02 6560. Bulletin HCSEC-2026-33 says the rotation was a precaution following a security incident affecting part of HashiCorp's internal software delivery pipeline; remediation revoked unauthorised access, rotated potentially exposed credentials including the package-signing key and re-signed affected packages. HashiCorp says it found no evidence that customer data was accessed or that any released artifact or package was modified, and does not say whether the old key itself was exposed. Users hit signature failures before the rotation was announced, and aarch64 RPMs were reported still signed with the old key afterwards. A separate bulletin, HCSEC-2026-39, fixed a go-getter privilege escalation from crafted archives in 1.8.9 and 2.2.4.

    Import the new key and replace every cached or pinned copy of the old one (798A EC65 4E5C 1542 8C8E 42EE AA16 FCBC A621 E701) in CI images, Dockerfiles and configuration-management roles that install Terraform, Packer or Vault, verifying the fingerprint against hashicorp.com rather than a forum post. Expect a client's security team to ask what the incident was; HashiCorp has not said.

  • notable GitHub Actions

    GitHub drops Node 20 from Actions and sets dates for safer workflows and npm publishing — github.blog

    On 23 September 2026 GitHub removed Node 20 from Actions runners, so JavaScript actions now run on Node 24 with no opt-out. Workflow execution protections reached general availability on 17 September; public repositories without an applicable event policy get a default rule disabling pull_request_target, in evaluate mode now and enforced on 2 November. Self-hosted runners below 2.329.0 can no longer register on GitHub Enterprise Cloud from 29 September, and ubuntu-latest moves to Ubuntu 26.04 between 19 October and 19 November. On npm, a stage-only permission for granular tokens (18 September) lets automation stage a version that a maintainer then approves with 2FA, and multiple trusted-publishing configurations per package went generally available on 3 September — the migration path before direct publishing with bypass-2FA tokens ends around January 2027.

    Check public-repository workflows that rely on pull_request_target before 2 November, pin ubuntu-24.04 where the 26.04 move would break a build, and move npm publishing off bypass-2FA tokens to trusted publishing or stage-only tokens well before January.

    Update, October 2026: On 21 October GitHub moved automatic enforcement of the default rule that disables pull_request_target in public repositories from 2 November to 2 December 2026.

Languages, runtimes and frameworks

Sections
  • notable PHP

    PHP security releases fix an FPM IPv6 access bypass and TLS hostname checks — php.net

    PHP 8.2.34, 8.3.35, 8.4.26 and 8.5.11, released on 24 September 2026, are security releases. The 8.5.11 changelog lists eleven advisory-tagged fixes, among them an FPM listen.allowed_clients bypass through partial IPv6 address comparison (CVE-2026-91768), TLS hostname verification falling back to the certificate's CN after a SAN mismatch (CVE-2026-91769), a heap overflow on a crafted wildcard CN (CVE-2026-91767), a cross-origin credential leak when the HTTP stream wrapper follows redirects (CVE-2026-91766) and Phar TAR entry injection (CVE-2026-6103).

    Take the 24 September release on every PHP origin. The TLS and redirect fixes touch any PHP code that calls out over HTTPS — payment, CRM and API integrations — and the FPM fix matters wherever listen.allowed_clients is relied on with IPv6.

  • notable Python

    Python 3.10 reaches end of life with a final security release — python.org

    Python 3.12.15, 3.13.16 and 3.14.8, released on 30 September 2026, and 3.10.22 and 3.11.17, released on 1 October, fix six CVEs across all five branches, including an ssl use-after-free when an SNI callback switches contexts, missing server_hostname validation in SSLContext.wrap_bio(), zipfile decompression memory exhaustion, a tarfile filter that lets directories be created outside the destination and urllib sending credentials across URL schemes. 3.10.22 is the final 3.10 release: the series has reached end of life. 3.13.16 is the last full maintenance release, leaving 3.13 on security fixes only, and the 3.13 and 3.14 installers move to OpenSSL 3.5.9.

    Move anything still on Python 3.10 — Ubuntu 22.04-era images, older Lambda runtimes and CI runners — to a supported version, because it gets no further upstream fixes, and patch supported branches to this release.

Static site and web tooling

Sections
  • critical Next.js

    Next.js rushes out a critical RCE fix, then patches self-hosted cache poisoning — nextjs.org

    On 22 September 2026 an out-of-band release, 16.3.6, fixed a Critical remote code execution flaw (GHSA-vcvr-r3jv-pc5j) in the Node.js ImageResponse implementation in next/og, through improper SVG escaping in the upstream Satori library. It affects 16.2.0 and later versions before 16.3.6; the Edge runtime's ImageResponse and the 15.x line are not affected. The scheduled release on 30 September, 16.3.8 and 15.5.27, fixed seven more: a High-severity SSRF in Image Optimization when images.remotePatterns is set, SSG and ISR cache poisoning in self-hosted Pages Router apps, root catch-all shared-cache poisoning, Draft Mode content leaking into public prerenders through use cache, and a cross-origin disclosure in the next dev MCP endpoint. Two further fixes, one Critical and one High, were postponed pending upstream coordination.

    Upgrade to 16.3.8 or 15.5.27, then purge CDN caches for self-hosted and headless-CMS sites — poisoned pages and leaked Draft Mode content persist at the edge until revalidated. Expect another release for the two postponed fixes.

    Update, October 2026: On 14 October Next.js shipped 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS) out of band, including the two fixes postponed from 30 September. They fix two Critical unauthenticated remote code execution flaws: use cache functions returning multiple typed arrays under Cache Components (GHSA-673q-mjm6-r5xr), and Image Optimization with SVG on glibc-based Linux through an upstream sharp memory bug (CVE-2026-96889; sharp 0.35.5 or later is the workaround). A High denial of service in App Router Server Actions (GHSA-p3m5-59mp-jv5r) is fixed too.

  • notable Hugo

    Hugo fixes three build-confinement flaws and blocks Org-mode content by default — github.com

    Hugo v0.166.0, announced on 10 September 2026, stops Org-mode content files rendering raw HTML unescaped — anyone who can supply or influence content could inject script (CVE-2026-100694, affecting v0.56.0 to v0.165.x) — by adding a security.allowContent allowlist that denies text/org by default. It also fixes symlink confinement that stopped at the mount root, which let a theme or module pull files from outside the project into public/ (CVE-2026-100692). On 11 September two more advisories covered fixes that had shipped quietly in v0.165.0: TailwindCSS's place on the default security.exec.allow list required permissive Node flags that let build tools read and write outside the project (CVE-2026-89259), and symlinks in parent directories were followed on direct resource lookups (CVE-2026-89258).

    Upgrade to v0.166.0, which covers all four, then check build output: sites that use Org-mode content must allowlist it, Tailwind users need tailwindcss added back to security.exec.allow, and transform.ToMath users need KaTeX CSS 0.18.4 or later.

Build on what the radar tracks

Integrations

How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.

Learn more

AI applications

Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.

Learn more

For developers

REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.

Learn more