Radar · 2022-04
April 2022
Two Spring remote code execution flaws land in the same week and the panic attaches to the one most estates were never exposed to, stolen OAuth tokens issued to two CI integrators are used to enumerate and clone private repositories across dozens of organisations, Java starts accepting a blank ECDSA signature as valid so anyone can forge one without a key, the SLACIP Act commences and puts risk management programs into the SOCI Act, and Hugo switches to language-aware collation and silently reorders every sorted list page.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- fyi Anthropic
Anthropic raises US$580 million to study what appears at scale — anthropic.com
Announced 29 April 2022, a US$580 million Series B led by Sam Bankman-Fried with participation from Caroline Ellison, Jim McClave, Nishad Singh, Jaan Tallinn and the Center for Emerging Risk Research. The stated purpose was building large-scale experimental infrastructure so the company could study the predictable scaling properties of machine learning systems while examining how capabilities and safety issues emerge unpredictably at scale. Funds were earmarked for technical safeguards in large models and tools to verify those safeguards actually work.
Read it beside February's paper from the same organisation — the argument that scaling is predictable while capability is not, and then the capital to test it. Useful as supplier due diligence rather than as an action: this is the funding round that made Claude possible, which is worth knowing when you are tracing the provenance of a model you now depend on through a reseller.
- fyi AWS
Document extraction gets a natural-language query interface — aws.amazon.com
Textract's AnalyzeDocument API gained a Queries feature, announced 21 April 2022 with availability from 31 March, letting callers ask for specific fields in natural language — "What is the customer name?" — and receive the answer directly instead of parsing full OCR output and writing layout-specific extraction rules. It shipped in 16 regions including Asia Pacific Sydney, Mumbai, Seoul and Singapore, plus both GovCloud zones.
This is the pattern that made document extraction viable across heterogeneous form layouts, which is the usual blocker on digitising Australian government paper processes — the same form printed in four agencies over fifteen years is not one layout. Sydney availability from launch is the part worth noting, because it removes the residency objection that stalled most of these projects.
Security and edge
Sections- notable Spring
Spring4Shell is a 9.8 that most estates were never exposed to — nvd.nist.gov
CVE-2022-22965, published 1 April 2022 after vendor disclosure in late March, is remote code execution in Spring MVC and Spring WebFlux via data binding on JDK 9 or later. CVSS 9.8, and unusually NIST and CISA-ADP independently assigned identical scores with the same vector. Affected are Spring Framework 5.2.x before 5.2.20 and 5.3.x before 5.3.18, plus older unsupported branches. The precondition was widely misreported in the panic: the known exploit requires the application to run on Tomcat as a WAR deployment, and NVD records that a Spring Boot executable jar — the default — is not vulnerable to it, while cautioning that the underlying weakness is more general.
The triage question is deployment shape, not version alone: WAR-on-Tomcat plus JDK 9 or later plus Spring below 5.2.20 or 5.3.18 is the exposed combination, and executable-jar Spring Boot is not. Get that inventory before starting emergency patching, because in most modern hosting estates the honest answer was "we are not exposed" and the effort was better spent on the other Spring flaw the same week. Patch anyway on the normal cycle, since the weakness is more general than the known exploit.
- notable Spring
The other Spring flaw is a crafted routing-expression that executes code — nvd.nist.gov
CVE-2022-22963, published 1 April 2022 after Spring's 29 March advisory, is in Spring Cloud Function: an attacker can provide a specially crafted expression as a routing-expression that results in remote code execution and access to local resources when routing functionality is in use. CVSS 9.8, assigned by NIST, classified as improper neutralisation of expression language statements. Affected are all versions up to and including 3.1.6, and 3.2.0 through 3.2.2, plus older unsupported versions.
Grep dependency manifests for spring-cloud-function-context specifically rather than reasoning about "Spring", because the two flaws were constantly conflated at the time and the triage is opposite. This one has no Tomcat-WAR precondition and is a crafted routing-expression away from code execution, so if the component is present and routing is enabled it is more urgent than Spring4Shell despite the far lower profile. Blocking requests that carry a routing-expression at the edge is a workable interim control.
- notable Java
Java accepts a blank ECDSA signature as valid — nvd.nist.gov
CVE-2022-21449, "Psychic Signatures", published 19 April 2022, is a flaw in the Java SE and GraalVM Libraries component where a blank ECDSA signature is accepted as valid — so an attacker can forge signatures without any key at all. CVSS 7.5, assigned by Oracle, integrity-only impact, which is why it is not scored higher. Affected are Oracle Java SE 17.0.2 and 18, and GraalVM Enterprise Edition 21.3.1 and 22.0.0.2. Oracle's framing emphasises sandboxed applets, but the record also notes exploitation via APIs exposed through web services.
That second exploitation route is the one that matters, because ECDSA underpins JWT ES256 tokens, SAML assertions, WebAuthn and OIDC id_tokens — so check JDK patch levels on anything that verifies a signature: SSO brokers, API gateways doing JWT validation, token-issuing services. Note the version quirk carefully, because it inverts the usual advice: only the newer JDKs are affected, so an estate on 11 or 8 was untouched and one on 17.0.2 was not. "We are on the latest LTS" was the wrong answer this month.
Standards and compliance
Sections- notable SOCI
Risk management programs enter the SOCI Act — legislation.gov.au
The SLACIP Act received assent on 1 April 2022 and commenced the next day, inserting the critical infrastructure risk management program obligations and the enhanced cyber security obligations into the Security of Critical Infrastructure Act 2018. This is the framework rather than the switch: the Act creates the power, and the risk management program applies to an asset only once rules specify it.
For a vendor the useful distinction is between the Act commencing and the obligation biting. What is real from April 2022 is that the power exists and the asset classes are being argued over — so the sensible position is to prepare the supply-chain evidence rather than to attest to a program that does not yet have rules.
Update, February 2023: The Critical infrastructure risk management program Rules (LIN 23/006) 2023 were registered on 16 February 2023, applying the program to specified assets after a six-month grace period.
- fyi Parliament
Dissolution lapses the anti-trolling bill; the digital identity draft was never introduced — aph.gov.au
The 46th Parliament was dissolved on 11 April 2022. The Social Media (Anti-Trolling) Bill 2022 lapsed at dissolution, having reached only second reading debate on 31 March. An exposure draft of the Trusted Digital Identity Bill 2021 had been circulated in October 2021 but was never introduced, so dissolution did not lapse a sitting bill.
This is why two things a client may remember consulting on simply vanished. The digital identity thread is the one to follow: the draft was never introduced, so nothing carries over to the new Parliament and accreditation planning built on it is on hold.
- fyi ACMA
Telcos get a customer identity authentication determination — legislation.gov.au
The Telecommunications Service Provider (Customer Identity Authentication) Determination 2022 was made on 1 April 2022 and registered on 6 April. Its obligations were reported as applying from later in 2022.
Peripheral unless you build for a carrier, and included for the sequence rather than the content: this is an early instance of a regulator specifying authentication requirements by instrument rather than leaving them to industry practice.
CMS and platforms
Sections- notable Drupal
Drupal 10 is confirmed for 14 December, opening an 11-month window — drupal.org
Announced 27 April 2022, the second Drupal 10 date change this year, moving the release from August to 14 December 2022 to stabilise the CKEditor 5 integration and test the upgrade path. The full dependency and lifecycle picture was set out here: PHP 8.1 as the minimum, Symfony 6.2, Claro and Olivero as core's default themes, a 9 September beta deadline. The target has now moved from 15 June to 17 August to 14 December.
This post sets the Drupal timetable government sites will plan against, and the number that matters is not the release date but the migration window it opens — roughly eleven months before Drupal 9 support ends. PHP 8.1 as a minimum is the part that turns a CMS upgrade into a platform upgrade, and it has the longer lead time of the two, so sequence it first.
- notable Drupal
A new revision access API arrives incompletely wired to permissions — drupal.org
Two core advisories landed together on 20 April 2022. SA-CORE-2022-009, CVE-2022-25274, scored 13 out of 25, is the more interesting because it is a regression introduced by a new feature rather than an imported third-party flaw: Drupal 9.3 added an entity revision access API that was not completely integrated with the existing permission system, so users holding general view-revisions permissions could reach node and media revisions of items they should not see. The affected range is narrow and specific to the new code, 9.3.0 through 9.3.11. Alongside it, SA-CORE-2022-008, CVE-2022-25273, repeats February's Form API improper input validation pattern.
Patch, and note where the risk came from: the newest code in the release, not the oldest. A site that upgraded promptly to 9.3 to stay current was the exposed one, which is the opposite of the usual pattern and a useful counterweight when arguing about upgrade cadence. The Form API repeat is a prompt to audit custom and contributed forms rather than to check a core version.
Supply chain, CI/CD and IaC
Sections- critical GitHub
Stolen integrator tokens clone private repositories across dozens of organisations — github.blog
Disclosed 15 April 2022 with updates running to the 27th. An attacker abused OAuth user tokens issued to two third-party CI/CD integrators — Heroku Dashboard and Travis CI — to enumerate organisations, list private repositories and selectively clone them across dozens of organisations. GitHub detected it on 12 April when the same actor used a stolen AWS API key to reach npm production infrastructure, and ran notification waves on 18, 22 and 27 April. Private npm organisation repositories were downloaded and the attacker could reach package tarballs in storage, though GitHub found no package modification and no npm credential theft. The tokens were never compromised at GitHub — the blast radius came entirely from a trusted integration holding broad repository scope.
Audit the OAuth apps and GitHub Apps authorised against your organisation today and revoke anything a departed vendor still holds, because any CI integrator with repository scope is equivalent to giving that vendor a clone of every private repository you own. Then answer the operational question this incident actually posed: Salesforce revoked every Heroku integration token within hours, which broke customers' deployments. Know which of your deployments would stop if your CI provider mass-revoked its tokens, and keep a documented manual path — this class of incident is remediated by breaking your pipeline, not by fixing it.
- notable GitHub
Secret scanning moves from detection to prevention — github.blog
From 4 April 2022 GitHub Advanced Security secret scanning gained push protection, blocking a push that contains a recognised credential rather than alerting after the secret is already in history. The distinction is the whole value: a secret that reaches a remote must be treated as compromised and rotated regardless of how quickly it is removed, because history is cheap to read and rewriting it does not recall what was already fetched.
Turn it on if you have Advanced Security. Where you do not, the same shape is achievable with a pre-commit or pre-receive hook, and it is worth the effort precisely because the alternative is not "detect and delete" but "detect and rotate" — which involves a person, a change window and a credential you may not fully control. Prevention is cheaper than the cheapest response.
- notable Terraform
A required Terraform Enterprise release breaks airgapped upgrade paths — hashicorp.com
Terraform Enterprise v202204-1 and v202204-2 shipped during April 2022 bundling Terraform CLI 1.1.7, and v202204-2 is flagged as a required release: online upgrades install it automatically, but airgapped customers must land on it before proceeding to any later version. Dates here are month-level only — the register encodes the year and month in the version identifier but not the day.
A genuine CI hazard rather than a footnote for anyone running Terraform Enterprise airgapped, because an estate that skips a required release cannot simply jump to current — it has to walk the chain. Worth building the required-release list into your upgrade runbook rather than discovering it mid-window, since the failure mode is being stuck between two versions with a maintenance window already open.
Languages, runtimes and frameworks
Sections- notable Node.js
Node 18 puts fetch in the global scope, silently — nodejs.org
Released 19 April 2022, Node 18 put a browser-compatible fetch in the global scope by default, along with FormData, Headers, Request and Response, plus the Web Streams API globals and an experimental node:test runner, on V8 10.1.
The migration hazard is the silent one: code that previously required node-fetch or undici explicitly now resolves to the built-in, so behaviour can differ between a Node 16 and a Node 18 runtime with no change to your source and nothing in a dependency manifest to show it. Check any HTTP client behaviour you depend on — redirect handling, timeouts, header casing — rather than assuming a drop-in. The built-in test runner is the other thing worth weighing, since it makes a test framework optional for straightforward suites.
- notable Node.js
Node 12 reaches end of life — github.com
Per the release team's own schedule data, Node 12 started 23 April 2019, entered LTS in October 2019, moved to maintenance in November 2020 and reached end of life on 30 April 2022. Its last release is v12.22.12 on 5 April 2022, which the project called the planned final 12.x build.
Treat any surviving Node 12 workload as unsupported from 1 May 2022, and migrate to 16 or 18 rather than to 14 — 14 is already in maintenance and is scheduled to reach its own end of life a year later, on 30 April 2023, so it buys twelve months and costs a second migration. Take the date from the release team's schedule rather than an end-of-life tracking vendor.
- notable Ruby
Ruby patches four branches back to 2.6 for two parsing flaws — ruby-lang.org
Ruby released 3.1.2, 3.0.4, 2.7.6 and 2.6.10 on 12 April 2022 alongside two advisories. CVE-2022-28738 is a double free in Regexp compilation and CVE-2022-28739 is a buffer overrun in the String-to-Float conversion algorithm. The breadth of the backport — reaching back to 2.6 — indicates long-lived defects in core parsing paths.
Prioritise this above a typical Ruby patch release, because both flaws are reachable from ordinary user input: Float() on a submitted string, and dynamically constructed regular expressions. Those are not exotic patterns, they are what form handling and search filters are made of. As with the PHP release in February, a project patching its oldest supported branch is telling you where the defect lives.
Static site and web tooling
Sections- notable Hugo
Hugo reorders every sorted list page without saying so — discourse.gohugo.io
Hugo 0.97.0, released 14 April 2022, replaced Hugo's text sorting with language-aware collation for ByTitle, ByLinkTitle and ByParam, and localised the date-grouping methods. This is a silent output change of the most awkward kind — no error, no deprecation warning — but every list page, index and grouped archive built with those methods can come out in a different order. Anything with accented characters, non-ASCII titles or mixed case reorders, because byte-order sorting and locale collation disagree precisely there.
Pagination is what turns this from cosmetic into breaking: a reordered list moves items between paginated pages, so URLs that pointed at page three now show different content and any item deep in a long list changes address. Diff the generated output, not just the build result, and pay attention to paginated archives specifically. This is the second Hugo release in two months where the hazard is output rather than API.
- notable SvelteKit
SvelteKit removes fallthrough routes with no major to signal it — svelte.dev
Announced 1 April 2022 in the project's monthly post, titled "Goodbye fallthrough routes, hello param validators!". Fallthrough routes were removed and replaced with parameter matchers, which changes routing resolution — URLs that previously fell through to a later route now return 404 unless a matcher is added.
Audit every dynamic route for reliance on fallthrough behaviour before bumping, because the failure is a 404 on a working URL rather than a build error. This is a pre-1.0 breaking change with no major version to signal it, which is the recurring hazard of running SvelteKit through 2022: the version number carries no promise and the monthly posts are the only changelog of record.
- fyi Nuxt
Nuxt 3 changes what a deployable Nuxt application is — nuxt.com
The Nuxt 3 Release Candidate landed 12 April 2022, six months after the beta, and it is the release where the build output changed shape entirely. Nitro, the new server engine, builds the application into one universal output directory deployable anywhere JavaScript runs — Node.js, serverless, Workers and edge — without requiring additional Node.js dependencies at the destination. Nuxt also shipped Nuxt Bridge so Nuxt 2 projects could adopt the new server engine incrementally.
For a hosting platform this is the whole story: a single output directory with zero runtime dependency installation is a fundamentally different deployment contract from Nuxt 2's build directory plus node_modules, and any pipeline, cache key or container build that assumes the old shape needs reworking. Worth reading Bridge as the migration route rather than treating this as a rewrite — the incremental path is the reason the RC was usable at all.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more