Radar · 2022-05
May 2022
An authentication bypass in F5 BIG-IP's iControl REST interface, on the load balancer in front of the origin, reaches CISA's known-exploited catalogue within a week, the npm accounting of April's OAuth campaign reveals roughly 100,000 user records taken from a 2015 archive along with every private package name, Five Eyes issues an advisory aimed squarely at managed service providers and their customers, libcurl turns out to reuse pooled connections across differing TLS settings, and Hugo removes Blackfriday entirely.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- notable AWS
PII detection adds fourteen entity types and no Australian ones — aws.amazon.com
Comprehend expanded PII detection and redaction from 22 to 36 entity types on 23 May 2022. The localised additions covered the United States, the United Kingdom with National Insurance Number, Unique Taxpayer Reference and NHS Number, Canada, and India with Aadhaar, PAN, NREGA and Voter Number, plus country-agnostic types including Vehicle Identification Number, SWIFT code and licence plate.
The absence is the finding. Australian identifiers — Tax File Number, Medicare number, driver licence formats — are not in this set, so an out-of-the-box Comprehend redaction pass over Australian content will miss precisely the identifiers that make an OAIC notification serious. If you are relying on managed PII detection in an Australian pipeline, you need custom entity recognition on top, and you should say so explicitly rather than letting a client infer coverage from the feature name.
- fyi Meta
A GPT-3-scale model ships with its weights and its failure log — arxiv.org
Meta AI published OPT on 2 May 2022, a suite of decoder-only models from 125 million to 175 billion parameters, with OPT-175B claimed comparable to GPT-3 while requiring roughly one seventh of GPT-3's carbon footprint to develop. The release included full weights shared with researchers under a gated non-commercial arrangement, the code for all sizes, and a training logbook documenting hardware failures and loss-spike interventions. That logbook was arguably the more valuable artefact — the first honest public account of what training at that scale actually involves.
Low action, high value as a reference point. This is the release that made "open weights" a real category rather than a slogan, eight months before anyone was arguing about it commercially. The logbook is the part to keep: if a client or supplier is estimating the cost and reliability of training or fine-tuning at scale, this is the earliest public document that does not quietly omit the failures.
- fyi OpenAI
DALL-E 2 publishes operational abuse numbers for image generation — openai.com
OpenAI published a research preview update on 18 May 2022 with operational abuse figures for DALL-E 2. Users had collectively created over three million images; fewer than 0.05 per cent of downloaded or publicly shared images were flagged as potentially violating the content policy, and human reviewers confirmed roughly 30 per cent of those flags as genuine violations. OpenAI said it would begin onboarding up to 1,000 people per week from the waitlist.
Worth keeping for the shape of the numbers rather than any action. A 0.05 per cent flag rate with a 30 per cent confirmation rate is a published baseline for what moderating generative image output actually costs, which is a useful counterweight when someone proposes adding image generation to a public-facing Australian site and treats moderation as an afterthought.
Security and edge
Sections- critical F5
An undisclosed request bypasses authentication on BIG-IP — nvd.nist.gov
CVE-2022-1388, published 5 May 2022, is a flaw in which undisclosed requests may bypass authentication on the F5 BIG-IP iControl REST interface. CVSS 9.8, assigned by F5 as CNA. Affected are 16.1.x before 16.1.2.2, 15.1.x before 15.1.5.1, 14.1.x before 14.1.4.6, 13.1.x before 13.1.5, and all 12.1.x and 11.6.x. Note the assessment gap F5 states explicitly: it does not evaluate versions past end of technical support, so "not listed" does not mean "not vulnerable" on older branches. CISA added the CVE to its Known Exploited Vulnerabilities catalogue on 10 May 2022.
BIG-IP sits in front of the origin, terminates TLS and often holds the private keys, so an authentication bypass here is equivalent to full compromise of everything behind it. Patch, then treat any internet-exposed management plane from before the patch as compromised: rotate the TLS keys, review iControl REST users and check for added configuration objects. Then remove the management interface from the internet permanently — the exposure that makes this exploitable is reachability, not the flaw.
- notable OpenSSL
A four-CVE OpenSSL advisory hides a slow memory leak — openssl-library.org
Published 3 May 2022. CVE-2022-1292, moderate, is command injection in the c_rehash script, which does not properly sanitise shell metacharacters — on systems where c_rehash runs automatically, an attacker who controls certificate filenames gets arbitrary command execution. CVE-2022-1343, moderate and 3.0 only, makes OCSP_basic_verify report success when the signing certificate fails verification if the non-default OCSP_NOCHECKS flag is set. CVE-2022-1434, low, makes the RC4-MD5 MAC key predictable. CVE-2022-1473, low, breaks memory reuse in a hash-table flush so long-running processes that repeatedly decode certificates grow without bound.
The last one is the sleeper for an edge operator: a slow unbounded leak in a process that decodes certificates all day is exactly your TLS terminator, and it presents as a mystery out-of-memory event weeks later rather than as a security incident. Patch 3.0 to 3.0.3 or later and 1.1.1 to 1.1.1o or later, since the c_rehash bug also affects 1.1.1, and separately stop using c_rehash in any automation — use the openssl rehash subcommand, as OpenSSL itself recommends.
- notable curl
libcurl reuses connections across differing TLS settings — curl.se
curl 7.83.1, announced 11 May 2022, is a six-CVE release, unusually large for a patch-level bump. Two are HSTS and cookie scope failures — CVE-2022-30115 bypasses HSTS via a trailing dot and CVE-2022-27779 scopes a cookie to a trailing-dot TLD, both turning on curl treating a hostname with and without a trailing dot inconsistently. CVE-2022-27782 let a connection be reused when the TLS or SSH configuration differed. The rest cover a percent-encoded path separator in a URL host, removing the wrong file on error, and a busy-loop in certificate info handling.
The connection-reuse flaw is the edge-relevant one: if libcurl performs origin fetches with per-route TLS verification settings, a stale pooled connection can silently defeat the stricter route — so the route you hardened is served over the connection you did not. Patch to 7.83.1, and separately assert that verification and pinning config is enforced per request rather than assumed from the pool. The trailing-dot bugs are a reminder that hostname normalisation is a security boundary.
Standards and compliance
Sections- notable ASD
ACSC and partner agencies write an advisory aimed at managed service providers — cyber.gov.au
Joint advisory published 12 May 2022 on cyber.gov.au, titled "Protecting Against Cyber Threats to Managed Service Providers and their Customers", and co-sealed by ASD's ACSC with NCSC-UK, CCCS, CISA, NSA and FBI. It sets out expectations on both sides of an MSP relationship — hardening the management plane, restricting and monitoring privileged access into customer environments, logging and log retention, supply-chain due diligence, and contractual clarity about who is responsible for which controls. ASD's announcement also names New Zealand's NCSC as a partner.
This is the one to read closely if you are a managed service provider, because it is the document a client's security team will hand you as the baseline — and it is explicitly two-sided, which means it also gives you language for what the customer must own. The most commercially useful section is the contractual one: ambiguity about who is responsible for a control is the thing that turns an incident into a dispute, and this advisory is a neutral reference for settling it in advance.
- notable NIST
NIST extends supply chain risk management to Revision 1 — csrc.nist.gov
NIST published SP 800-161 Revision 1, "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations", on 5 May 2022, to help fulfil NIST's responsibilities under the 2021 Executive Order on Improving the Nation's Cybersecurity. It gives organisations a structured way to identify, assess and respond to cybersecurity risk across the supply chain.
Read it as the second half of a pair rather than on its own: 800-218 in February describes how software should be built, and this describes how an organisation should manage the risk of software it did not build. Mapping to both once is more efficient than answering each supply-chain questionnaire from scratch.
CMS and platforms
Sections- notable WordPress
WordPress 6.0 consolidates the site-editing work — wordpress.org
Released 24 May 2022 and named for Arturo O'Farrill, with nearly 1,000 enhancements and bug fixes and more than 500 contributors in at least 58 countries. Editorially it added multi-block text selection, recent-post lookup, style retention when converting block types and retained custom button styles. For design it added style switching between variations within a block theme, a redesigned colour panel, border controls, colour transparency, gap controls in Gallery blocks, an improved List View with keyboard shortcuts and bulk operations, and block locking to prevent accidental moves or deletions. Five new templates arrived — author, date, categories, tag and taxonomy.
Block locking is the feature worth adopting deliberately on a government or enterprise estate, because the common failure in a block-themed site is not a security issue but an editor accidentally removing structural blocks. Style switching within a theme is the other consequential one: it changes how you quote theming work, since variations now do what used to require child themes.
- notable Drupal
Guzzle forces a second out-of-cycle Drupal release in ten weeks — drupal.org
SA-CORE-2022-010, CVE-2022-29248, published 25 May 2022 and scored 13 out of 25, is Drupal's second Guzzle-driven advisory in ten weeks after March's SA-CORE-2022-006. As with that one it was published outside the standard Wednesday security window, because the Guzzle maintainers had already disclosed publicly and there was no coordinated-disclosure headroom left. Drupal core is not itself exploitable through the flaw, but the advisory is explicit that contributed projects or custom code making outbound HTTP requests may be.
Patch core, then check your own outbound HTTP code and any contributed module that makes requests, because that is where the exploitability actually sits. The pattern across March and May is the more useful finding: two unplanned releases in ten weeks, both from one bundled dependency, both timed by an upstream project rather than by Drupal. If your maintenance windows are monthly, a bundled dependency can and will land outside them.
- notable Craft CMS
Craft CMS 4 moves the PHP floor to 8 — craftcms.com
Released 4 May 2022. Authoring gained substantially faster draft and revision creation, particularly on multi-site installs, improved assistive-technology accessibility, custom element sources, conditional field visibility, element index filtering and auto-refresh across browser tabs. User management gained address handling, a consolidated full-name field replacing separate first and last name fields, and support for inactive users with no login credentials. Asset handling gained filesystem abstraction for volumes. The PHP minimum is now 8.
Sequence the platform work first: PHP 8 is the gate and it has the longer lead time, so a Craft 4 upgrade on a PHP 7 host is really two projects. Note the user-model change if you integrate — a consolidated full-name field replacing separate first and last names will break any integration, export or mail merge that reads those fields individually, and that is the kind of thing that surfaces after go-live rather than during testing.
Supply chain, CI/CD and IaC
Sections- notable npm
The npm accounting of April's OAuth campaign is worse than April implied — github.blog
Published 26 May 2022 with an update on 2 June. Using AWS keys obtained via the stolen integrator tokens, the attacker reached a 2015 archive containing roughly 100,000 npm user records — usernames, email addresses and password hashes generated with obsolete PBKDF2 and salted SHA1. They also took all private package manifests and metadata as of April 2021, private package names and versions as of 10 April 2022, and the private packages of two organisations outright. GitHub confirmed through log analysis and package hash verification that no published package was modified. Separately, GitHub disclosed it had found plaintext npm access tokens and passwords in its own internal logs.
Two concrete consequences. Assume any npm password set before 2016 is recoverable and change it, since salted SHA1 is not a meaningful barrier. More importantly, treat your private package names as public from this date — an attacker knowing the naming of your internal packages is the precondition for dependency confusion, so if you rely on obscurity rather than a scoped registry and explicit resolution config, that assumption is now void.
- notable npm
The npm 2FA ladder reaches the top 500 — github.blog
From 31 May 2022 npm enforced two-factor authentication for maintainers of the top 500 packages by dependent count. Note the threshold is dependents rather than downloads, so a small utility that many other packages import lands in scope while a heavily downloaded leaf application does not.
If you publish anything other packages depend on, enrol now and move release publishing to a CI token with granular scope, so an enforcement wave never blocks a hotfix. The dependents-not-downloads threshold is the part worth checking rather than assuming — teams routinely guess wrong about which of their packages is load-bearing in someone else's tree, and the registry's answer is the one that counts.
- notable Terraform
Terraform 1.2 adds preconditions and drops cloud config into the environment — hashicorp.com
Released 18 May 2022. Preconditions and postconditions let a module author assert assumptions on resources, data sources and outputs, so failures surface early and in context rather than as an incoherent provider error deep into an apply. For CI specifically, 1.2 added environment variables for cloud organisation, hostname and workspace, which together let you declare the cloud block as an empty block and supply the rest from the pipeline environment.
The condition blocks are the cheapest reliability win available in a Terraform codebase: an assertion that a data source returned what you expected turns a confusing mid-apply failure into a named plan error. The environment-variable change is the one that improves CI hygiene — it removes the last reason to template or commit workspace names into configuration, which is how the wrong workspace gets applied to.
Languages, runtimes and frameworks
Sections- notable Symfony
Symfony 6.1 expires before the LTS it looks newer than — symfony.com
Released 27 May 2022 as a standard non-LTS release, and its lifecycle is short by design: Symfony's own releases page puts both end of bug fixes and end of security fixes at January 2023, the same month as 6.0. That is the trap — 6.1 looks newer than the 5.4 LTS but runs out first by a wide margin: 5.4 gets bug fixes to November 2024, nearly two years past 6.1's January 2023 cut-off, and security fixes to November 2025, nearly three years past it.
Teams that jumped from 5.4 to 6.1 for features bought themselves an eight-month support window, which is almost certainly not what they intended. The rule worth writing down: in Symfony, a higher version number is not a longer support window, and the only versions worth landing a client project on are the LTS releases. Check what your integrations actually target rather than assuming current is safest.
Update, October 2024: Symfony extended security support for 5.4 LTS to February 2029, sponsored by Ibexa.
- notable Go
Go patches syscall on both supported branches — go.dev
go1.17.10 and go1.18.2 shipped on 10 May 2022, both security releases covering the syscall package. Narrow in scope compared with the April batch.
Routine but prompt patching, with no upgrade breakage expected on a point release — which makes it the easy kind of change to actually schedule. Worth noting that this is the fourth consecutive month with Go security content, after February, March and April: the argument for treating toolchain currency as a standing process rather than a periodic review is accumulating.
Update, December 2022: Go shipped a release in every month of 2022, and every month from February to December included security fixes.
Static site and web tooling
Sections- notable Hugo
Hugo removes Blackfriday and lets RenderString handle shortcodes — discourse.gohugo.io
Hugo 0.100.0, released 31 May 2022, changes generated output in two ways. RenderString finally supports shortcodes, closing a long-standing limitation — so content that previously rendered shortcode syntax as literal text now renders the shortcode. And Blackfriday, deprecated in favour of Goldmark since 0.60, was removed entirely.
The RenderString change is the one that alters existing pages without any action from you: anywhere a shortcode was previously emitted as visible literal text, it now executes. That will be a fix in most places and a surprise in a few, so diff the output. Blackfriday's removal is a hard stop rather than a warning — any site still setting the Blackfriday markup handler in config fails to build, which is the preferable failure mode of the two.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more