Radar · 2022-02
February 2022
ACSC tells every Australian organisation to urgently adopt an enhanced cyber security posture on the eve of the invasion of Ukraine and names five years-old internet-facing flaws rather than any zero-day, a backup plugin on three million WordPress sites lets any subscriber download the entire database, Chrome patches the first of nine actively exploited zero-days it will ship this year, npm starts enforcing two-factor authentication on the maintainers of its hundred most-depended-on packages, and Drupal 10 slips to August because CKEditor 4 is dying and CKEditor 5 is not ready.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- fyi Anthropic
A paper argues that scaling is predictable and capability is not — arxiv.org
Published 15 February 2022 on arXiv, authored by 30 people including Deep Ganguli, Jack Clark, Chris Olah and Jared Kaplan. The argument is that large generative models have a paradoxical character: loss on a broad training distribution is highly predictable and follows clean scaling laws, while the specific capabilities, inputs and outputs those models exhibit are not predictable at all. The authors argue this combination is exactly what makes the field move quickly and safe deployment hard. Section 4 then lists interventions: narrowing the compute gap with academia, red teaming before deployment, voluntary best practices, and better governance and evaluation tools.
Low action, high citation value. This is the clearest early statement of why "we tested it and it behaved" is a weak assurance for a generative system, which is the argument you will eventually need when a client asks for a guarantee about model behaviour.
- fyi AWS
Machine translation gets a formality control — aws.amazon.com
Amazon Translate added formality customisation during February 2022, letting a caller request formal or informal register in the target language for six languages. The feature addresses a specific class of translation failure rather than raw accuracy — a system that renders a government notice in casual register is wrong in a way that a fluency score does not capture.
Relevant if you build multilingual Australian government sites, where translated content is routinely reviewed against a tone-of-voice standard and machine output gets rejected for register rather than for meaning. Worth testing before quoting human post-editing hours, because the formality control removes one of the more common reasons a reviewer sends a translation back.
Security and edge
Sections- critical Chrome
Chrome patches an in-the-wild Animation use-after-free — chromereleases.googleblog.com
Chrome 98.0.4758.102 shipped 14 February 2022 for Windows, Mac and Linux, with Google stating plainly that it was aware of reports an exploit for CVE-2022-0609 existed in the wild. That flaw is a use after free in Animation, rated High, reported by Google's Threat Analysis Group with no bug-bounty reward. It shipped alongside six other High-severity fixes covering File Manager, Tab Groups, the Webstore API, ANGLE, the GPU process and Mojo, for eleven security fixes in total.
Browser zero-days are a staff-endpoint problem rather than a server one, but they are the standard entry point to the admin consoles that control your edge — so the assets actually being protected here are your CDN, DNS and registrar control panels. Force-restart Chrome across the fleet by policy rather than waiting for users to do it, because an updated binary on disk is not an updated browser in memory.
- critical Zimbra
A webmail cross-site scripting flaw is worth more than its score — nvd.nist.gov
CVE-2022-24682, published 8 February 2022, is a cross-site scripting flaw in the Zimbra Collaboration Suite Calendar component, where HTML containing executable JavaScript placed inside element attributes is left unescaped. It scores CVSS 6.1 Medium, assigned by NIST. CISA added it to the Known Exploited Vulnerabilities catalogue on 25 February with an 11 March federal remediation deadline.
The score understates this badly, and the KEV listing is the correction — a Medium-rated flaw that lands on a federal remediation deadline inside three weeks was being used, whatever the vector string says. The general lesson is worth more than the specific patch: for internet-facing collaboration products, check the KEV catalogue rather than sorting your queue by CVSS, because exploitation and severity score are measuring different things.
- notable ASD
ACSC tells Australian organisations to raise their posture, and names old flaws — cyber.gov.au
Advisory 2022-02, first published 23 February 2022 and revised to version 11 by 28 April, is the defining Australian security communication of the year. Issued on the eve of Russia's invasion of Ukraine, it was candid in both directions — there is a heightened cyber threat environment globally, and there are no specific or credible cyber threats to Australian organisations at this time. It named the destructive malware families WhisperGate, HermeticWiper, IsaacWiper and CaddyWiper, plus Conti ransomware and Cyclops Blink, and it named specific flaws to prioritise: CVE-2018-13379 in FortiGate VPN, CVE-2020-0688 and CVE-2020-17144 in public-facing applications, CVE-2020-1472 in Netlogon and CVE-2021-34527, PrintNightmare.
Look at that list — every one is years old and internet-facing, which is the real Australian threat picture rather than exotic zero-days. Use this advisory as the citation when justifying edge-hardening spend to an Australian client, and map the work against Essential Eight rather than a generic overseas framework, because that is what the advisory itself points at. That it ran to eleven revisions in nine weeks is part of the story: this was a live document, not a one-off notice.
Standards and compliance
Sections- notable NIST
The Secure Software Development Framework reaches v1.1 — csrc.nist.gov
NIST published SP 800-218 on 3 February 2022, superseding the April 2020 white paper (CSWP 13). It recommends high-level secure development practices that can be added to each SDLC, in four groups — prepare the organisation, protect the software, produce well-secured software, and respond to vulnerabilities — deliberately framed as a common vocabulary between software purchasers and suppliers rather than a prescriptive control set. NIST updated it in response to Section 4 of Executive Order 14028, and it maps the order's clauses to its practices.
This is a ready-made vocabulary for clients' security questionnaires, so mapping your own development lifecycle to its four practice groups is cheap and reusable across every tender you answer. For an Australian vendor it is load-bearing indirectly rather than directly — it is the definition of secure development that purchasers and regulators are likely to reach for.
- fyi OAIC
Human error notifications up 43 per cent as breaches rise 6 per cent — oaic.gov.au
The OAIC's half-yearly Notifiable Data Breaches report, published 22 February 2022, recorded 464 notifications for July to December 2021, up 6 per cent on the preceding half. Malicious or criminal attack remained the largest single cause at 256 notifications, 55 per cent of the total, but the movement was in human error, which rose 43 per cent to 190 notifications and 41 per cent of the total; system faults fell 18 per cent to 18. Health service providers led by sector with 83 notifications, followed by finance with 56, then legal, accounting and management services with 51.
The 43 per cent rise in human error is the number to take into a design conversation rather than a security one. Breaches caused by sending information to the wrong recipient, or by publishing something that should have stayed unpublished, are largely defeated by interface and workflow decisions — confirm steps, recipient checks, staged publishing, clear distinction between draft and live. That is squarely a web platform's responsibility rather than an infosec team's.
- fyi SOCI
The second half of the critical infrastructure package clears the House in six days — aph.gov.au
The Security Legislation Amendment (Critical Infrastructure Protection) Bill 2022 was introduced on 10 February 2022 and passed the House of Representatives on 16 February — six days. It implements the second tranche of changes to the critical infrastructure framework, including risk management programs and additional cyber security obligations for systems of national significance. The urgent elements of the original 2020 Bill, including mandatory cyber incident reporting, had passed separately on the PJCIS's recommendation and commenced on 2 December 2021, leaving these provisions for further consultation. Home Affairs consulted on an exposure draft of this Bill from 15 December 2021 to 1 February 2022, and the Bill was referred to the PJCIS on the day it was introduced.
The compressed House timetable is the finding rather than the content. Consultation ran on the exposure draft, which closed nine days before introduction, and the PJCIS was still taking submissions until 1 March, after the House had already passed the Bill. For a vendor serving critical infrastructure clients that means watching exposure drafts rather than Bills, because six days in the House is not a window for new argument.
CMS and platforms
Sections- notable WordPress
A backup plugin hands the whole database to any logged-in user — thehackernews.com
UpdraftPlus, with over three million installations, shipped a missing permissions check that let any logged-in user download existing site backups. CVE-2022-0633 carries CVSS 8.5. Affected versions are 1.16.7 through 1.22.2, fixed in 1.22.3 free and 2.22.3 Premium. The Hacker News (19 February 2022) says the issue was reported on 14 February by Marc-Alexandre Montpas of Automattic, and that 1.22.4 was already the latest version as of 17 February.
The consequence is worse than the description reads. A full site backup contains the database, so an attacker who downloads one obtains password hashes, every secret stored in options and the database credentials themselves — this is a route to complete takeover, not a data exposure. Prioritise any site that accepts registration: membership areas, WooCommerce, consultation portals. And treat it as an incident rather than a patch, because a backup already downloaded cannot be un-downloaded and those credentials need rotating.
- notable Drupal
Drupal patches Form API validation and a Quick Edit access bypass — drupal.org
Two moderately critical core advisories landed together on 16 February 2022. SA-CORE-2022-003, CVE-2022-25271, scored 14 out of 25, is an improper input validation flaw in the Form API where certain contributed or custom module forms could let an attacker inject unauthorised values or alter data, though the security team characterised the target distribution as uncommon. It affects Drupal 7.0 to 7.87, 8.0 to 9.2.12 and 9.3.0 to 9.3.5, fixed in 7.88, 9.2.13 and 9.3.6. SA-CORE-2022-004, CVE-2022-25270, scored 12 out of 25, is an information disclosure in Quick Edit that fails to check entity access properly, letting a user with in-place editing permission see content they should not.
Patch to 7.88, 9.2.13 or 9.3.6. Neither advisory is covered by Drupal Steward and both restate that Drupal 8 is already end of life, so a site still on 8.x is not getting either fix. Drupal 7 is not affected by the Quick Edit advisory. The Form API issue lands on contributed and custom code rather than core, so the audit is of your own forms.
- fyi Drupal
Drupal 10 slips to August, blocked on CKEditor 5 — drupal.org
Announced 22 February 2022. Having originally targeted 15 June 2022, the core team named 17 August as the new date after concluding June was not reachable. The stated blocker is the editor: Drupal 8 and 9 both integrate CKEditor 4, which reaches end of life at the end of 2023, so Drupal 10 must ship CKEditor 5 to have security coverage beyond that. Stabilising the CKEditor 5 module needed substantial JavaScript expertise, and the post is an explicit call for help. The other named requirements were updating JavaScript dependencies, making Olivero the default front-end theme, stabilising Claro as the admin theme and testing Starterkit.
This is the entry that explains why the CKEditor 4 to 5 migration was never optional and never really about features — an upstream end-of-life date was driving a CMS major release.
Supply chain, CI/CD and IaC
Sections- notable npm
npm starts enforcing 2FA on its hundred most-depended-on packages — github.blog
From 1 February 2022, with a same-day update clarifying the phased rollout, all maintainers of the top 100 npm packages by dependents were required to hold a second factor. Enforcement was not cosmetic: non-compliant maintainers had web sessions revoked and could not change an email address or add a project maintainer until they enrolled. GitHub also scheduled two 24-hour brown-outs, on 16 and 23 February, temporarily opting every npm account into enhanced login verification rather than rehearsing top-100 2FA, ahead of making that verification permanent on 1 March. Shipped alongside were token naming for CI/CD automation tokens, organisation-level 2FA enforcement and 2FA adoption auditing.
Use the organisation-level enforcement and the adoption audit on your own npm organisation rather than waiting to be conscripted by the registry. The quieter win is token naming: name your automation tokens now, because the moment you need to revoke one under pressure is the worst possible moment to work out which of six unnamed tokens belongs to which pipeline.
- fyi OpenSSF
Alpha-Omega funds hands-on help and scanning of 10,000 projects — openssf.org
OpenSSF launched Alpha-Omega on 1 February 2022 with an initial US$5 million from Microsoft and Google, splitting the problem in two. Alpha does hands-on work with the handful of most critical projects — threat modelling, code audits, automated security testing and actual vulnerability remediation — with targets drawn from the OpenSSF Criticality Score and the Harvard Census. Omega goes the other way, applying automated analysis at scale across at least 10,000 widely deployed projects, backed by analysts and a confidential reporting path so findings are not dumped into public issue trackers.
The initial US$5 million buys two things: tailored help for a handful of critical projects through Alpha, and automated analysis of at least 10,000 widely deployed ones through Omega. Two practical uses: check whether the critical libraries in your dependency tree have had an Alpha engagement, and if you depend commercially on an unfunded single-maintainer package, budget a sponsorship line for it rather than assuming someone else will.
- fyi GitHub Actions
Organisations get visibility into hosted runner concurrency — github.blog
From 23 February 2022 GitHub gave organisations visibility into their GitHub-hosted runner concurrency usage, so an org could see how much of its available parallelism was actually being consumed rather than inferring it from queue times.
Minor on its own. The new view shows an organisation its concurrency limits and how much of each runner type is in use at a given time, and lets it cancel jobs that are blocking more critical workflows, so capacity becomes a number rather than something inferred from queue times. If you are carrying self-hosted runners for capacity reasons rather than network-access reasons, this is the number to test that reasoning against.
Languages, runtimes and frameworks
Sections- notable PHP
PHP moves all three supported branches on the same day — php.net
PHP 7.4.28, 8.0.16 and 8.1.3 all shipped on 17 February 2022 and php.net marks each as a security release — the first coordinated security day of the year across every supported branch. The individual release page for 7.4.28 states only that it is a security release and defers detail to the ChangeLog, so treat specific CVE attribution as unresolved from php.net's own pages.
Patch all three branches together and do not assume an 8.x-only exposure, because 7.4 was moved in the same batch — when a project moves every live branch simultaneously, that is its signal that the underlying defect reaches back to the oldest one. Worth taking the shape of a release as information in its own right when the changelog is thin.
- notable Laravel
Laravel 9 continues the yearly cadence and adopts Symfony 6 — laravel.com
Laravel 9, announced on 10 February 2022, continues the yearly major cadence that began with Laravel 8 (majors previously came every six months). Laravel had pushed it back from September 2021 so it could adopt Symfony 6.0, due that November, rather than wait until September 2022. Headline changes are Symfony 6.0 components, SwiftMailer replaced by Symfony Mailer, Flysystem 3.0, a new accessor and mutator syntax, enum casting, implicit route bindings and full-text indexes.
The SwiftMailer to Symfony Mailer replacement is the migration that bites, because it touches every transactional email path in an application and SwiftMailer was already abandoned upstream. The cadence change is the more useful thing to internalise for planning: from here, a Laravel major inherits the previous November's Symfony major, so Symfony's release calendar tells you what Laravel is about to require.
Static site and web tooling
Sections- notable Next.js
Next.js 12.1 changes the deployable artefact and patches an SVG script vector — nextjs.org
Released 17 February 2022. The build-output change is standalone output mode, which produces a folder containing only the files needed for production — Next's own figure is roughly 80 per cent smaller Docker images, deployable without installing node_modules. Also shipped: on-demand ISR in beta, SWC minification in release candidate at seven times faster than Terser, zero-config Jest and Image Optimization moving to a stale-while-revalidate caching pattern. The same day brought CVE-2022-23646, improper Content Security Policy handling in the Image Optimization API, affecting 10.0.0 through 12.0.10 and patched in 12.1.0 (GitHub advisory GHSA-fmvm-x8mv-47mj, rated Moderate).
Upgrade to 12.1.0, then note two separate consequences. Standalone mode is a genuinely different artefact shape, so a pipeline that assumes the build directory plus node_modules needs reworking before it can benefit — and the Image Optimization cache change alters edge behaviour whether or not you adopt it. On the advisory, the precondition is narrow but specific: it only triggers where your allowed image domains serve user-supplied SVG and you use the default loader. An SVG through an optimiser that does not neutralise scripts is cross-site scripting wearing an image's clothes.
- fyi Hugo
Hugo lets you replace its generated code block markup — discourse.gohugo.io
Hugo 0.93.0, released 28 February 2022, introduced Markdown diagrams and code block render hooks, letting you supply a template for fenced code blocks either globally or per language. This is a build-output feature by nature: define a hook and Hugo stops emitting its default pre and code structure for that language and emits yours instead. The release was 68 commits, most of them small.
Useful rather than urgent, with one consequence worth planning for. Client-side diagram rendering through Mermaid and similar became idiomatic in Hugo from this release, which means documentation sites start shipping a rendering library to the browser — that is a payload and a Content Security Policy question for whoever operates the site, not just an authoring convenience.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more