Radar · 2022-06
June 2022
A Confluence OGNL injection is exploited before any patch exists and the affected range reaches back to version 1.3, the Hosting Certification Framework starts applying to new Commonwealth hosting contracts and extensions, two Travis CI endpoints let anyone enumerate build logs by counting upwards and around 73,000 secrets fall out in clear text, Guzzle turns out to carry Cookie and Authorization headers across an HTTP downgrade in Drupal's fourth Guzzle event of the quarter, and an Essential Eight Maturity Level Two mandate looms with two of nineteen audited agencies compliant.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- fyi OpenAI
Three model vendors publish joint deployment practices — openai.com
On 2 June 2022 OpenAI, Cohere and AI21 Labs jointly published recommended practices for deploying large language models, with stated support from Anthropic, Google, Microsoft and the Stanford Center for Research on Foundation Models. The recommendations group into three areas: prohibit misuse through published usage guidelines plus enforcement infrastructure such as rate limits and content filtering; mitigate unintentional harm through model evaluation and documented disclosure of known weaknesses; and collaborate with stakeholders on norms and accountability.
This is the earliest industry-level statement of what responsible LLM deployment was supposed to look like, published fourteen months before OWASP gave the same ground a vulnerability taxonomy. Its use now is comparative rather than prescriptive: if you are assessing a supplier's AI governance claims, this is the baseline they could have been designing against in mid-2022, so a product built later with no usage policy or rate limiting was not ahead of the state of the art.
- fyi Research
A paper formalises capability jumps that cannot be extrapolated — arxiv.org
Published 15 June 2022 by Jason Wei and fifteen co-authors, "Emergent Abilities of Large Language Models" defines an emergent ability as one not present in smaller models but present in larger ones, where performance cannot be predicted by extrapolating from smaller models. The paper surveys tasks where accuracy sits at chance level across several orders of magnitude of scale and then jumps sharply past a threshold, arguing that continued scaling may unlock genuinely new capabilities rather than only sharpening existing ones.
Read beside February's Anthropic paper, this is the other half of the same argument and the more empirical half. The practical consequence is for anyone writing an AI assurance statement: a model's behaviour at one size tells you less than intuition suggests about its behaviour at the next, so "we tested the smaller variant" is not evidence about the larger one. That is a hard thing to explain to a client and this is the paper to point at.
Security and edge
Sections- critical Atlassian
Confluence is exploited before a patch exists — nvd.nist.gov
CVE-2022-26134, published 3 June 2022, with exploitation observed by Volexity over the 28 to 30 May weekend and reported to Atlassian on 31 May, ahead of the 2 June advisory, is an OGNL injection letting an unauthenticated attacker execute arbitrary code on a Confluence Server or Data Center instance. CVSS 9.8, scored independently and identically by both NIST and CISA-ADP. The affected range is worth quoting because it caught people who assumed they were current — from 1.3.0 through a long list of 7.x branches, including 7.18.0 before 7.18.1. It needs nothing more than a crafted URI, and Confluence is very often internet-exposed because staff want it from home.
If you host Atlassian Server products for clients, the durable fix is not a faster patch cycle — it is to stop exposing them to the public internet and put them behind SSO-authenticated access at the edge. Where they must stay public, subscribe to Atlassian's advisory feed directly rather than waiting for a news cycle, because the gap between exploitation and coverage was days here.
- critical Log4Shell
Six months on, Log4Shell is still the most productive route in — cisa.gov
Joint advisory AA22-174A, published 23 June 2022 by CISA with US Coast Guard Cyber Command, records that threat actors including state-sponsored groups have continued to exploit CVE-2021-44228 in VMware Horizon and Unified Access Gateway servers to obtain initial access. It documents two confirmed compromises. In one, actors planted a loader masquerading as a Windows service carrying an embedded remote access tool with keylogging and desktop GUI capability. In the other, initial access in late January 2022 led to lateral movement by RDP into production systems including security and certificate servers, a disaster-recovery network, and more than 130 gigabytes exfiltrated over roughly three weeks.
The pattern to internalise is that Log4Shell's real-world damage came through a product embedding log4j, not through code anyone wrote — so the inventory that mattered was of appliances and vendor middleware in the edge and management planes, not of your own dependency trees. Note CISA's actual instruction too: where the VMware patches were not applied promptly, treat the system as compromised rather than merely patch it.
- notable Apache
httpd 2.4.54 clears eight CVEs and quietly changes what your origin sees — httpd.apache.org
Released 8 June 2022. The one that matters to a caching edge is CVE-2022-26377, mod_proxy_ajp request smuggling, rated moderate and affecting everything up to 2.4.53 — AJP smuggling in front of a Tomcat backend is a classic cache-poisoning and authentication-bypass primitive. The other seven are rated low, covering read-beyond-bounds issues in mod_isapi and two core functions, denial of service in mod_lua and mod_sed, information disclosure in mod_lua with websockets, and CVE-2022-31813, where mod_proxy drops X-Forwarded-For through the hop-by-hop mechanism.
Patch to 2.4.54, and if you run httpd as a proxy tier, specifically test that X-Forwarded-For still reaches the origin afterwards. That last CVE is the sleeper: if XFF is dropped, any origin-side access control, rate limiting or geo logic keyed on client IP silently stops seeing the real client — it does not fail, it just starts making decisions on the proxy's address. That is the kind of change that gets discovered from an abuse report weeks later.
Standards and compliance
Sections- critical DTA
The Hosting Certification Framework starts applying to Commonwealth contracts — architecture.digital.gov.au
From 30 June 2022 the Hosting Certification Framework's requirements began applying to new Commonwealth hosting contracts and to contract extensions, with an exemption pathway introduced on 24 June. The Framework establishes certification tiers for hosting providers serving Commonwealth data, with ownership, control and sovereignty conditions attached, and it applies at the point a contract is signed or renewed rather than on a transition timetable.
This is the single most commercially load-bearing Australian item of the month for a hosting provider, because it changes eligibility rather than obligation — an uncertified provider becomes ineligible for new Commonwealth work and for extensions of existing work, which means the deadline arrives whenever a client's contract happens to renew rather than on a date you can plan around. If you serve Commonwealth agencies, know your certification status and your clients' renewal dates, and treat the exemption pathway as a fallback rather than a strategy.
- notable ASD
An Essential Eight Maturity Level Two mandate looms with two of nineteen agencies ready — itnews.com.au
Reported on 10 June 2022: Commonwealth agencies faced an imminent requirement to reach Essential Eight Maturity Level Two under PSPF Policy 10, with an audit finding only two of nineteen agencies examined were compliant. The mandate was reported as applying from July 2022.
Two of nineteen is the number to remember, because it sets realistic expectations for what a government client can actually evidence when they ask you for the same. For a platform or hosting vendor the strategies that bite are patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges and regular backups — and an agency that cannot reach Maturity Level Two itself will lean on its suppliers to close the gap. Check the PSPF text itself before quoting the mandate date to a client — the date here comes from press reporting.
- notable ASD
The June 2022 Information Security Manual lands — cyber.gov.au
ASD published the Information Security Manual with a title-block publication date of 16 June 2022.
IRAP-assessed providers and agencies holding an authorisation to operate reconcile each ISM release into their system security plans, so the change register is where the work is rather than the manual.
CMS and platforms
Sections- notable Drupal
Guzzle carries credentials across an HTTP downgrade — drupal.org
SA-CORE-2022-011, published 10 June 2022, is the third Guzzle pass-through of 2022 and the most serious. Two flaws: failure to strip the Cookie header on a change of host or an HTTP downgrade, and failure to strip the Authorization header on an HTTP downgrade. In other words, session cookies and credentials could follow a redirect off the original host or onto plaintext HTTP. Guzzle rated the issue high. A fourth Guzzle event followed within weeks — CVE-2022-31090, handled in Drupal 9.4.1 — making four in one quarter.
Patch, then look at your own outbound HTTP code, because the exposure lands wherever contributed or custom code makes requests rather than in core. The failure mode is worth understanding rather than just closing: a credential that follows a redirect to plaintext HTTP is disclosed to anyone on the path, and nothing in your logs distinguishes that from a normal request. Four advisories from one bundled dependency in a quarter is also a reasonable argument for auditing what else core bundles.
- fyi Drupal
Drupal 9.4 makes Olivero and Claro the defaults — drupal.org
Drupal 9.4.0 landed on 15 June 2022, five days after the out-of-cycle Guzzle advisory, and made Olivero the default front-end theme — named for Rachel Olivero, who led the organisational technology group at the US National Federation of the Blind — and Claro the default administration theme. It also added an experimental Starterkit theme generator that produces a theme from a template rather than requiring one to be inherited from core.
The theme defaults are the part that changes new-build conversations: Claro as the admin theme is a material accessibility improvement over Seven, which is worth raising with government clients who standardised on the old admin experience. Starterkit is the strategically interesting one — generating a theme rather than inheriting from a core base theme is meant to remove the constraint that core theme changes ripple into every child theme.
- fyi Drupal
Drupal 7 support is extended to November 2023 — drupal.org
The 9.4.0 announcement restated the two lifecycle facts that framed every Drupal migration conversation in 2022: Drupal 8 reached end of life on 17 November 2021, and Drupal 7 support was extended to 1 November 2023 with bug and security fixes continuing throughout. That makes 1 November 2023 the operative date.
This date has moved more than once already. For an Australian government estate the useful framing is that Drupal 7 keeps receiving extensions while Drupal 9 will not, because Drupal 9's end is forced by upstream dependencies rather than chosen. A date the project controls can move; a date Symfony controls cannot.
Update, June 2023: PSA-2023-06-07, published 7 June 2023, set Drupal 7's end of life at 5 January 2025 and called it the final extension.
Supply chain, CI/CD and IaC
Sections- notable Travis CI
Anyone could read Travis CI build logs by counting upwards — bleepingcomputer.com
Disclosed between 13 and 15 June 2022: two Travis CI API endpoints allowed unauthenticated enumeration of build logs by sequential integer, from zero upwards, with no application or customer identifier required. Researchers sampled the range and found roughly 73,000 sensitive strings in clear text — GitHub tokens, AWS access keys and Docker Hub credentials. This is the same platform whose stolen OAuth tokens were used in April's GitHub campaign.
Rotate anything a Travis build ever touched, on the assumption it was readable. The structural lesson is about where secrets accumulate: build logs are treated as debug output and retained indefinitely, but they are the one place a secret reliably appears in plain text — so the control is masking at the CI layer plus short-lived credentials, not log access policy. Any long-lived token used in CI should be treated as already disclosed, which is the argument for OIDC-based publishing that arrives across the registries the following year.
- fyi GitHub
GitHub open-sources its access-as-code system — github.blog
On 9 June 2022 GitHub open-sourced Entitlements, the system it uses to manage access as code — group membership and permissions expressed in a repository, reviewed as pull requests and applied by automation.
Relevant as infrastructure-as-code applied to the thing that actually gets exploited. The April OAuth campaign and this month's Travis CI log exposure both turned on standing access nobody had reviewed — and access defined in a reviewable repository has a diff, an approver and a history, where access granted through a console has none of those. Worth considering even if you never adopt this specific tool, because the reviewable-diff property is the transferable part.
Languages, runtimes and frameworks
Sections- notable PHP
PHP moves all three branches again, and opens 8.2 — php.net
PHP 7.4.30, 8.0.20 and 8.1.7 shipped together on 9 June 2022, all flagged as security releases by php.net, with PHP 8.2.0 Alpha 1 opening the same day. php.net's CVE wiki shows CVE-2022-31625 and CVE-2022-31626 allocated in this window, though the wiki records allocation against bug IDs and does not itself state fixed versions — so treat the CVE-to-version mapping as corroborated rather than primary.
Patch all three branches together, on the same reasoning as February: a project moving its oldest supported branch alongside its newest is telling you the defect reaches back. The 8.2 alpha opening is the planning signal — PHP majors land in late November each year, so an alpha in June means a client considering a platform upgrade has a target version and a date, which is more useful than waiting for the release.
- notable Node.js
Node 17 dies seven months after it shipped — github.com
Per the release team's schedule data, Node 17 started on 19 October 2021, moved to maintenance on 1 April 2022 and reached end of life on 1 June 2022, with no LTS phase at all — the schedule entry has no lts field. Its last release was v17.9.1, an OpenSSL 3.0.3 update that Node.js said can be treated as a security release.
The pattern matters more than the version: odd-numbered Node majors never get an LTS phase and get roughly seven months of life in total, so they should never carry production workloads. That is worth writing into a version policy explicitly, because "use the latest Node" and "use a supported Node" point at different versions half the time, and the odd-numbered lines are where teams accidentally land when they optimise for newest.
- fyi Go
Go ships another pair of point security releases — go.dev
go1.17.11 and go1.18.3 shipped during June 2022, both security releases, narrow in scope compared with the April and July batches.
Routine, and recorded for the cumulative picture rather than the content: this is the fourth consecutive month with Go security releases, in a year that ended with them in ten of twelve months. If you are making the case internally that toolchain currency needs a standing process rather than a quarterly review, 2022's Go cadence is the evidence.
Static site and web tooling
Sections- notable Next.js
Next.js marks Middleware stable and breaks its API doing it — nextjs.org
Released 28 June 2022. Middleware went stable with an improved API based on feedback and its own migration guide — so this is a stable-marking release that is simultaneously a breaking change for anyone using the beta API. On-Demand ISR also went stable, replacing 12.1's unstable_revalidate with res.revalidate. The markup item is the experimental next/future/image, which renders a single img element with no wrapping div or span and drops the layout and objectFit props.
If you adopted Middleware during the beta, this release requires a migration rather than a version bump — which is an unusual and easily-missed shape, because "now stable" reads as reassurance rather than as work. The future image component is worth previewing on a branch: removing the wrapper elements changes generated markup, so any CSS selector or snapshot test keyed on the old structure breaks when it eventually becomes the default.
- notable Hugo
Hugo changes inline code markup and stops flattening animated GIFs — discourse.gohugo.io
Hugo 0.101.0, released 16 June 2022, has three output-relevant additions. A slug-or-filename permalink keyword gives a new way to construct URLs — opt-in, but a URL-shaping feature and therefore a redirect question if adopted on a live site. An inline highlighting option changes the markup emitted for inline code. And image processing operations such as resize and rotate now preserve animated GIF properties instead of flattening them, which changes the bytes of every processed GIF.
The GIF change is the one that will surprise someone: an image pipeline that previously produced a static first frame now produces an animated file, so anything sized or cached on the old output changes — including cache keys and CDN storage. Worth checking if you process user-supplied images. The permalink keyword is safe until adopted, and then it is a redirect exercise rather than a config change.
- fyi Astro
Astro 1.0 slips from June to late July — astro.build
On 6 June 2022 Astro moved the 8 June 1.0 date to late July, citing performance work, better compiler error handling, improved dev-server stacktraces and clearing incoming bug reports. The post makes no mention of breaking changes — April's beta announcement had already committed to no further major breaking changes before 1.0, and the 8 June date came from that same April post — and it told users to keep using the beta, which ships weekly.
Treat the new 1.0 date as advisory: the April beta's commitment to no further major breaking changes is the more useful marker of when an Astro project's API surface settles. The general point for anyone planning around a pre-1.0 framework: the commitment worth relying on is a stability declaration, not a date.
Update, August 2022: Astro 1.0 was released on 9 August 2022, later than the late-July date set in June.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more