Radar · 2022-01
January 2022
The Online Safety Act commences and defines hosting services broadly enough that a 24-hour statutory removal clock can land on your abuse desk rather than your customer's, a maintainer deliberately sabotages colors.js and faker.js and hangs build pipelines worldwide within hours, a Symfony config regression silently switches CSRF protection off on three specific versions, a wormable pre-authentication flaw lands in the Windows kernel HTTP listener, and Eleventy 1.0 starts treating dated filenames as UTC and quietly shifts Australian permalinks by a day.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- notable OpenAI
Instruction tuning beats scale, and becomes the API default — openai.com
Published 27 January 2022, OpenAI announced that InstructGPT — GPT-3 fine-tuned with reinforcement learning from human feedback — had become the default model served by its API after more than a year in beta. The headline result is the one that reframed the field: human labellers preferred outputs from a 1.3 billion parameter InstructGPT model over a 175 billion parameter GPT-3, despite more than a hundredfold difference in size. The models scored better on TruthfulQA for fabricated facts and lower on RealToxicityPrompts for toxic output. OpenAI mitigated the alignment tax by mixing a small share of original pretraining data back into the fine-tuning stage.
This is where the default assumption shifted from bigger model to better-tuned model, which is the argument to have when someone is sizing inference cost for an Australian deployment. The operational catch is subtler: prompt patterns tuned against base completion models behave differently under instruction-tuned ones, and the API default moved underneath anyone who had not pinned a model. Re-run your benchmarks rather than assuming continuity.
- fyi OpenAI
An embeddings endpoint makes semantic search an ordinary build — openai.com
Launched 25 January 2022, exposing vector representations of text and code for similarity, semantic search and code search. Three model families shipped — text-similarity, text-search and code-search — text similarity and text search in ada, babbage, curie and davinci tiers, code search in ada and babbage only, with a claimed 20 per cent relative improvement in code search over the prior state of the art. The launch cited concrete early results: JetBrains Research at 99.85 per cent accuracy classifying astronomy data sources, FineTune Learning at 89.1 per cent top-five accuracy matching textbook content to learning objectives, and Fabius finding twice as many examples of customer requests as its previous keyword search, and six to ten times more for features with abstract use cases that lack an obvious keyword.
This is the origin point for the vector-search patterns now standard in site search and support-desk deflection, and it is the month retrieval stopped being an ML project. One cost trap to build into any quote: embeddings generated against these models are not interchangeable with later ones, so a model change forces a full re-index. Budget re-embedding for any long-lived content set from the start rather than discovering it at the first upgrade.
- fyi AWS
Computer vision at the edge reaches the Sydney region — aws.amazon.com
On 19 January 2022 AWS made Panorama — an ML appliance plus SDK bringing computer vision to on-premises IP cameras — available in Asia Pacific Sydney and Singapore, joining US East, US West, Canada Central and Europe Ireland. Its design point is local video processing at the edge for tasks such as manufacturing quality inspection, bottleneck identification and workplace safety monitoring, without uploading video to the cloud.
If an Australian client has raised camera analytics and the answer has been no on data-residency grounds, that objection weakened here. But separate the two claims before promising anything: local inference on an appliance and an in-region service endpoint are different things, and control-plane operations may still traverse a US region. Video is the workload where that distinction costs the most, both in bandwidth and in privacy exposure.
Security and edge
Sections- critical Windows
A pre-authentication flaw lands in the Windows kernel HTTP listener — nvd.nist.gov
CVE-2022-21907, published 11 January 2022, is a remote code execution flaw in http.sys — the kernel-mode HTTP listener underneath IIS and anything else serving HTTP on Windows. CVSS 9.8, assigned by Microsoft as CNA and carried by NVD, which did not publish an independent score. Affected are Windows 10 1809, 20H2, 21H1 and 21H2, Windows 11 21H2, and Windows Server 2019, 20H2 and 2022. Windows 10 1909 is not affected. Record the source disagreement: Microsoft's guidance characterised it as wormable and told customers to prioritise server SKUs, while the NVD record carries no wormability statement at all. HTTP Trailer support is the trigger: 1809 and Server 2019 are vulnerable only when it is enabled, while the later listed versions are vulnerable by default, so the practical blast radius is narrower than 9.8 implies.
If you front any Windows origin — and plenty of Australian government and enterprise workloads still are — this is January's patch that matters, because it is as reachable through a CDN as it is directly. Where patching cannot happen immediately the edge is the mitigation: strip or reject requests carrying HTTP trailers at the reverse proxy. That is a control you own rather than one you wait for.
- fyi OpenSSL
The month's only OpenSSL advisory affects MIPS and nothing else — openssl-library.org
CVE-2021-4160, published 28 January 2022 and rated moderate, is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure, affecting elliptic curve operations including some of the TLS 1.3 default curves. Note the mismatch: the CVE carries a 2021 identifier and the fixes had already shipped in 1.1.1m and 3.0.1 on 15 December 2021, so the advisory is a disclosure catch-up rather than a new patch cycle. OpenSSL's own assessment is that attacks on RSA and DSA would be very difficult and attacks on Diffie-Hellman are just feasible, though very difficult, and even then TLS is largely protected because servers no longer share DH private keys across clients.
Almost certainly nothing to do on an x86-64 or ARM fleet. The one place worth checking is MIPS-based network gear — older consumer CPE, some embedded routers, a handful of appliance platforms — where you cannot patch OpenSSL yourself and depend on a vendor firmware release. The openssl-announce list for January 2022 carries this advisory only.
Standards and compliance
Sections- critical Online Safety Act
A hosting service is inside the Online Safety Act, not outside it — legislation.gov.au
The Online Safety Act 2021 commenced on 23 January 2022, six months after assent, and put the eSafety Commissioner on a statutory footing with substantially expanded powers. The Online Safety (Basic Online Safety Expectations) Determination 2022 was registered that day and commenced the day after, on 24 January, setting core expectations on providers of social media services, relevant electronic services and designated internet services, and underpinning the Commissioner's power to issue reporting notices. The Act cut the removal-notice turnaround for cyber-bullying and image-based abuse from 48 hours to 24, and extended the scheme beyond social media to app distribution services, hosting services, internet carriage services and search engines.
Read the definitions rather than the headlines. "Designated internet service" and "hosting service" are drawn broadly enough that ordinary website hosting sits inside the regime, which means a 24-hour statutory removal clock can land on your abuse desk directly rather than on your customer's. Removal tooling, logging and an out-of-hours escalation path became procurement questions from this date, and government clients running user-generated content will ask whether you can evidence takedown inside the window rather than merely promise it.
- notable eSafety
The age-gating specification gets written down — legislation.gov.au
The eSafety Commissioner's Online Safety (Restricted Access Systems) Declaration 2022 is dated 13 January 2022, was registered on 17 January and commenced on 23 January with the Act. It is the instrument that says in operational terms what a compliant age-restriction system actually looks like for relevant class 2 material — specifying the access-control system, the process for applying for access, the warnings that must be shown, the age-confirmation step and the mechanisms for limiting access.
Providers of designated internet services carrying class 2 material rely on this as a safe harbour: meeting the Declaration is what makes the material lawfully accessible rather than exposing the provider to a removal notice. Worth reading beside the Basic Online Safety Expectations Determination made the following week. The Declaration specifies implementation detail rather than outcomes, which makes it unusually checkable in an assurance conversation.
- fyi Privacy Act
The Privacy Act Review consultation closes with 200-plus submissions — consultations.ag.gov.au
The Attorney-General's Department closed submissions on the Privacy Act Review Discussion Paper on 10 January 2022, having opened on 25 October 2021 and received over 200 responses. Nothing in the Discussion Paper had legal force yet, but everything in it was openly on the table: a direct right of action, a fair and reasonable test, questions over the small business and employee records exemptions, and stricter rules for children's data under an online privacy code.
The useful framing for the year is that structural change to the Privacy Act is a live question, which is why client requirements can start moving ahead of any law. Two exemptions would reach a delivery partner directly if they were removed or narrowed — small business and employee records — so they are worth tracking regardless of where the review lands.
Update, February 2023: The Privacy Act Review Report was released on 16 February 2023.
CMS and platforms
Sections- critical WordPress
A backdoor reaches 360,000 sites through 93 themes and plugins — bleepingcomputer.com
Reported in January 2022, threat actors compromised the AccessPress distribution channel and backdoored 93 products — 40 themes and 53 plugins — reaching over 360,000 active sites. The mechanism was an initial.php dropper carrying base64-encoded PHP that wrote a webshell into wp-includes/vars.php, then deleted itself to remove the evidence. Injection probably happened in early September 2021, researchers found it that month, and AccessPress pulled the extensions from its download portal on 15 October 2021. On 17 January 2022 it released cleaned versions of the affected plugins; the themes had not yet been cleaned.
Detection is specific enough to run today: inspect wp-includes/vars.php around lines 146 to 158 for a bogus wp_is_mobile_fix function. The wider lesson is about where you got the code. Products downloaded from a vendor's own portal bypass the wordpress.org repository entirely and so bypass whatever assurance you attach to it — worth knowing which of your installed themes came from where, because a four-month gap between compromise and disclosure is long enough for a site to have been backdoored, cleaned and backdoored again.
- notable WordPress
WordPress opens the year with two SQL injections and a backport to 3.7 — wordpress.org
WordPress 5.8.3 shipped 6 January 2022 with four security fixes. Two are SQL injections — one in WP_Query reported through the Zero Day Initiative, and one in WP_Meta_Query found by the WordPress security team, affecting only 4.1 to 5.8. The other two came from SonarSource: a stored cross-site scripting issue through post slugs, and an object injection issue that only affects multisite installations. Affected versions run from 3.7 to 5.8, and every branch since 3.7 received a backport. Sites with background updates enabled had already begun updating when the announcement went up.
The object injection issue is the one to check first on Australian government estates, because multisite is a common pattern for whole-of-portfolio and agency-network builds and this issue only bites there. The backport range is the other thing worth noting — fixes issued as far back as 3.7 means the security team expected to find sites eight years out of date, which is a useful calibration when someone argues an old site is too small to matter.
- notable Drupal
Drupal patches five jQuery UI cross-site scripting issues — drupal.org
Two moderately critical advisories published 19 January 2022, both scored 14 out of 25. SA-CORE-2022-001 covers CVE-2021-41184, a cross-site scripting flaw in the jQuery UI position utility, which resurfaced when the jQuery UI project came out of dormancy and disclosed a batch of issues in 1.13.0. Affected ranges are Drupal 7.0 to below 7.86, 8.0.0 to below 9.2.11 and 9.3.0 to below 9.3.3. The companion SA-CORE-2022-002 is Drupal 7 only and backports four further jQuery UI issues in Datepicker and Dialog into 7.86 without moving the bundled library version.
Treat this as a Drupal 7 problem first: 7.86 is the only fix line for the four backported issues, and legacy Drupal 7 sites are exactly where custom Datepicker and Dialog usage tends to persist. The exposure is indirect: Drupal's advisories say the issues may be exploitable through some contributed modules, and SA-CORE-2022-002 adds custom code, so the audit is of your own JavaScript rather than of your core version alone.
Supply chain, CI/CD and IaC
Sections- critical npm
A maintainer sabotages his own packages and bricks thousands of projects — bleepingcomputer.com
By 9 January 2022 Marak Squires had deliberately broken his own packages: colors.js was pushed with an infinite loop printing garbage characters forever, and a sabotaged faker.js 6.6.6 was published alongside it. colors was carrying over 20 million weekly downloads across roughly 19,000 dependent projects and faker over 2.8 million weekly downloads across more than 2,500 dependents, and BleepingComputer reported thousands of projects bricked. By 13 January the sabotaged versions had been removed from npm, and GitHub had reportedly suspended the account. The stated grievance was going unpaid for work large companies depended on.
This is the canonical demonstration that a floating semver range on a transitive dependency is an unauthenticated write to your build. Two controls follow: pin or lockfile every dependency including transitives, and run CI against a proxy registry or vendored cache so that an upstream unpublish or sabotage cannot reach your builds on the day it lands. The second is the one most teams skip, and it is the one that would have helped here — the lockfile does not save you if the resolved version is the sabotaged one.
- notable GitHub Actions
The dependency graph starts tracking the Actions you call — github.blog
From 31 January 2022 GitHub extended the dependency graph to parse workflow YAML, so the actions a repository calls became first-class tracked dependencies rather than opaque strings, displayed in the dependency graph under Insights. Repositories that publish actions also gained a count of the repositories depending on them through the Used By control. Until this landed, the dependency graph did not track actions, even though they are third-party code running inside a workflow with access to secrets and the repository token.
Open the dependency graph on your busiest repository and look at the Actions section — most teams find a third-party action nobody remembers adding, pinned to a mutable tag rather than a commit SHA.
- notable npm
npm rolls out emailed one-time codes to every publisher, and they are not 2FA — github.blog
GitHub's plan of 7 December 2021 set 4 January 2022 as the date enhanced login verification would finish rolling out to every npm publisher: any account with publish rights but no two-factor authentication would have to enter a one-time password delivered by email in addition to its password. GitHub was explicit that this is a baseline rather than a substitute for TOTP or WebAuthn. The same announcement laid out the 2022 enforcement ladder — the top 100 packages by dependents on 1 February, the top 500 in early 2022, then all high-impact publishers.
Do not record emailed one-time codes as two-factor authentication in your own risk register, because an attacker with mailbox access walks straight through. If an npm publishing account still relies on it, move it to a hardware key or TOTP rather than waiting for the enforcement deadline that applies to you.
Languages, runtimes and frameworks
Sections- notable Symfony
A config regression silently switches Symfony's CSRF protection off — symfony.com
CVE-2022-23601 is a regression in FrameworkBundle config loading that dropped the long-standing default of enabling CSRF protection whenever sessions were enabled. Affected releases are exactly Symfony 5.3.14, 5.4.3 and 6.0.3, fixed in 5.3.15, 5.4.4 and 6.0.4, which shipped on 29 January 2022. Symfony's advisory lists no 4.4.x release as affected. Symfony's advisory is dated 29 January 2022; the vulnerable releases shipped on 28 January.
Unusually narrow and unusually nasty: only sites that upgraded into that three-version window were exposed, but while exposed their forms accepted submissions with no CSRF token at all. If any deploy in late January 2022 landed on 5.3.14, 5.4.3 or 6.0.3, do not just patch forward — assume forms were unprotected for that period and review logs for anomalous POSTs. A community-suggested check is
debug:config framework csrf_protection.enabled. - notable Node.js
Node patches three certificate-verification bypasses at once — nodejs.org
Released 10 January 2022 as v12.22.9, v14.18.3, v16.13.2 and v17.3.1, closing four issues of which three are in certificate handling. CVE-2021-44531 let a certificate with a URI subjectAltName slip past name-constrained intermediates. CVE-2021-44532 allowed injection into the SAN string format so that name constraints in a chain could be bypassed. CVE-2021-44533 mishandled multi-value Relative Distinguished Names, permitting Common Name injection to defeat subject verification. The fourth, CVE-2022-21824, is prototype pollution through console.table. All four affected every 12.x, 14.x, 16.x and 17.x line then in support.
If you terminate mutual TLS or validate client certificates in Node, treat this as a trust-boundary fix rather than a routine patch — three separate ways to defeat name constraints in one release is a pattern, not a coincidence. The practical consequence is that any authorisation decision made from a certificate's subject or SAN on an unpatched Node is unreliable, so confirm the version before confirming the control.
- notable Rust
Rust fixes a privilege-escalation race a week after shipping 1.58 — github.com
Rust 1.58.0 arrived on 13 January 2022 with captured identifiers in format strings. A week later 1.58.1 shipped alongside CVE-2022-21658, a time-of-check to time-of-use race in std::fs::remove_dir_all scored 7.3 High by the rust-lang advisory itself. The function checked whether a target was a symlink before deleting, so an unprivileged user who swapped a directory for a symlink inside that window could steer a privileged program into deleting directories it should never touch. Every release from 1.0.0 through 1.58.0 is affected. Note the sting in the advisory itself: the mitigation relies on platform APIs that macOS before 10.10 and Redox do not provide, so those targets stay vulnerable even after upgrading.
Anything running remove_dir_all as root or in CI cleanup needs 1.58.1 or later. The transferable part is the pattern rather than the CVE — check-then-act on a filesystem path is a race wherever it appears, and cleanup code is where it hides, because nobody threat-models the tidy-up step. Worth auditing your own deletion helpers with the same lens.
Static site and web tooling
Sections- notable Eleventy
Eleventy 1.0 moves Australian dates by a day — 11ty.dev
Eleventy's first stable major shipped 9 January 2022 after years of pre-releases, and the breaking changes reach the build output rather than only the config. Data Deep Merge is on by default and the Data Cascade ordering shifted so front matter in layout files takes lower precedence, meaning the same source tree can resolve different values into the same template. Files named with a leading date are now assumed to be UTC rather than local. Also breaking: jstl removed in favour of 11ty.js, EJS v3 include syntax, liquidjs v9 with dynamicPartials defaulting to true and strict_filters renamed, dataTemplateEngine defaulting to false, and gitignore files outside the project root no longer honoured. Minimum Node moved from 10 to 12.
The UTC change is the one that specifically bites here: for a site at UTC+10 or +11 it silently moves dates and any date-derived permalinks by up to a day, which breaks existing URLs without any error. Diff the generated output directory before and after the upgrade rather than trusting a green build — both the UTC shift and the Data Cascade reorder are silent output changes, and a build that succeeds is not evidence that the site is the same.
- notable Next.js
A Next.js denial of service that only hits self-hosters — github.com
CVE-2022-21721, published 28 January 2022, is a denial of service scored 5.9 moderate by GitHub, classified as improper input validation and uncontrolled resource consumption. It affects Next.js 12.0.0 through 12.0.8 and only bites when three conditions hold together: Next 12.0.x before 12.0.9,
next startor a custom server, and built-in i18n enabled. The advisory notes that deployments on the vendor's own platform are unaffected because requests are filtered upstream. The documented mitigation is to block/${locale}/_next/from reaching the Next.js instance.Upgrade to 12.0.9, or add an edge rule blocking that path. The asymmetry is the part worth naming, because it recurs: a customer self-hosting Next.js on your infrastructure is exposed to a flaw that the same code is not exposed to on the framework vendor's platform, and an advisory that says "unaffected on our platform" is not a statement about your origin. Read those notes as scope limitations rather than as reassurance.
Update, February 2022: NIST's initial NVD analysis on 4 February 2022 scored CVE-2022-21721 at 7.5 high, above GitHub's 5.9.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more