Radar 2022

December 2022

Drupal 10 ships with hard floors on PHP, a database version and a CKEditor migration that has to be done by hand, starting an eleven-month clock on Drupal 9, the privacy penalty rises from two million dollars to the greater of fifty million or thirty per cent of turnover and applies to investigations already open, Fortinet takes a second emergency in three months where the implanted libraries survive the patch, an attacker claims a name PyTorch's own nightly builds resolve ahead of their private index, and PHP 8.2 arrives ten days after 7.4 dies with the deprecation that decides whether legacy code can move at all.

November 2022

OpenAI puts a conversational language model in front of the general public on 30 November and every acceptable-use question about staff feeding client data to a hosted model starts here, OpenSSL's pre-announced critical arrives downgraded to high and affects only the 3.0 branch most fleets were not yet running, Citrix ADC takes unauthorised access to Gateway user capabilities, the Medibank attackers publish stolen records on the dark web from 9 November while the Bill lifting privacy penalties to fifty million dollars passes both Houses, and PHP 7.4 dies two days after 8.0 drops to security fixes only.

October 2022

An authentication bypass hands an unauthenticated attacker the Fortinet management interface that terminates the VPN, Medibank confirms attackers hold 200 gigabytes including diagnosis codes that cannot be reissued the way a licence number can, the Commonwealth legislates in a hurry with emergency telecommunications regulations registered and a privacy penalties Bill introduced inside a fortnight, WordPress ships fifteen vulnerabilities in a single security-only release, and Next.js 13 renames the image component so an unmodified upgrade changes the HTML of every image on the site.

September 2022

Optus discloses a breach exposing identity document numbers for millions of Australians and becomes the reference case for an unauthenticated API reachable from the edge, a phishing campaign impersonating CircleCI relays one-time codes in real time so app-based two-factor authentication fails while hardware keys hold, Node tells developers that patching is not enough and every key generated with WebCrypto must be re-issued, two WordPress plugin zero-days are exploited millions of times before their patches land, and SvelteKit redesigns its filesystem router with no major version to announce it.

August 2022

The Medibank intrusion begins with contractor credentials stolen from a personal device, a VPN that did not require multi-factor authentication and alerts that were generated but never triaged, an incomplete Zimbra fix removes the last precondition and more than a thousand servers are backdoored, Stable Diffusion ships weights that run on a consumer graphics card, PyPI maintainers are phished into handing over publishing accounts, and Astro 1.0 and Docusaurus 2.0 both land in the same fortnight.

July 2022

An Atlassian add-on turns out to create a Confluence account with a hardcoded password that survives uninstalling the app, OpenSSL ships heap corruption with a plausible remote code execution path in a release only two weeks old, every package in the npm registry is re-signed with keys held in a hardware security module and verification becomes one command, Drupal ships four core advisories in a day including arbitrary PHP execution through an uploaded .htaccess file, and Vite 3 moves the dev server port and changes build output file extensions.

June 2022

A Confluence OGNL injection is exploited before any patch exists and the affected range reaches back to version 1.3, the Hosting Certification Framework starts applying to new Commonwealth hosting contracts and extensions, two Travis CI endpoints let anyone enumerate build logs by counting upwards and around 73,000 secrets fall out in clear text, Guzzle turns out to carry Cookie and Authorization headers across an HTTP downgrade in Drupal's fourth Guzzle event of the quarter, and an Essential Eight Maturity Level Two mandate looms with two of nineteen audited agencies compliant.

May 2022

An authentication bypass in F5 BIG-IP's iControl REST interface, on the load balancer in front of the origin, reaches CISA's known-exploited catalogue within a week, the npm accounting of April's OAuth campaign reveals roughly 100,000 user records taken from a 2015 archive along with every private package name, Five Eyes issues an advisory aimed squarely at managed service providers and their customers, libcurl turns out to reuse pooled connections across differing TLS settings, and Hugo removes Blackfriday entirely.

April 2022

Two Spring remote code execution flaws land in the same week and the panic attaches to the one most estates were never exposed to, stolen OAuth tokens issued to two CI integrators are used to enumerate and clone private repositories across dozens of organisations, Java starts accepting a blank ECDSA signature as valid so anyone can forge one without a key, the SLACIP Act commences and puts risk management programs into the SOCI Act, and Hugo switches to language-aware collation and silently reorders every sorted list page.

March 2022

An infinite loop in OpenSSL's certificate parsing is reachable before any signature is verified, so a hostile certificate alone hangs the process, a maintainer ships code to node-ipc that overwrites files on any host geolocating to Russia or Belarus and Vue CLI picks it up automatically, SOCI Part 2A and the Data Availability and Transparency Act both clear Parliament in the final 48 hours before the election is called, two bundled third-party libraries force unplanned Drupal core releases six days apart, and Go 1.18 ships generics and quietly changes the build hash of unchanged source.

February 2022

ACSC tells every Australian organisation to urgently adopt an enhanced cyber security posture on the eve of the invasion of Ukraine and names five years-old internet-facing flaws rather than any zero-day, a backup plugin on three million WordPress sites lets any subscriber download the entire database, Chrome patches the first of nine actively exploited zero-days it will ship this year, npm starts enforcing two-factor authentication on the maintainers of its hundred most-depended-on packages, and Drupal 10 slips to August because CKEditor 4 is dying and CKEditor 5 is not ready.

January 2022

The Online Safety Act commences and defines hosting services broadly enough that a 24-hour statutory removal clock can land on your abuse desk rather than your customer's, a maintainer deliberately sabotages colors.js and faker.js and hangs build pipelines worldwide within hours, a Symfony config regression silently switches CSRF protection off on three specific versions, a wormable pre-authentication flaw lands in the Windows kernel HTTP listener, and Eleventy 1.0 starts treating dated filenames as UTC and quietly shifts Australian permalinks by a day.