Radar · 2022-07
July 2022
An Atlassian add-on turns out to create a Confluence account with a hardcoded password that survives uninstalling the app, OpenSSL ships heap corruption with a plausible remote code execution path in a release only two weeks old, every package in the npm registry is re-signed with keys held in a hardware security module and verification becomes one command, Drupal ships four core advisories in a day including arbitrary PHP execution through an uploaded .htaccess file, and Vite 3 moves the dev server port and changes build output file extensions.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- notable OpenAI
DALL-E opens to paid beta with full commercial rights — openai.com
On 20 July 2022 OpenAI moved DALL-E into paid beta, inviting one million people from the waitlist. Pricing was credit-based — 50 free credits in the first month, 15 monthly thereafter, and 115-credit packs at US$15. Users received full rights to commercialise the images they create, including reprinting, selling and merchandising, an unusually unambiguous grant for a hosted image generator at the time. Safety controls blocked photorealistic generations of real individuals' faces, rejected uploads containing realistic faces and filtered violent and adult content.
The commercial rights grant is the line that mattered and it is the one to check when auditing any 2022-era asset: from 20 July 2022 OpenAI granted full commercial rights to images created with DALL-E, including images from the research preview, so a 20 July production-date cutoff is the wrong test. If an Australian agency site carries generated imagery from that period, the useful question is whether anyone recorded the terms that applied, not which side of 20 July it was produced on.
- fyi BigScience
BLOOM is the first openly published model at GPT-3 scale — huggingface.co
Released 12 July 2022, BLOOM is a 176-billion-parameter autoregressive language model generating text in 46 natural languages and 13 programming languages. It was trained over 117 days from 11 March to 6 July 2022 on the Jean Zay supercomputer in Paris, using compute valued at roughly three million euros granted by French research agencies, with more than 1,000 researchers from over 70 countries and 250-plus institutions involved. It was run as an open science collaboration rather than a single-vendor product.
Read alongside May's OPT release: within ten weeks, two separate efforts put GPT-3-scale weights into researchers' hands, which is what made "open model" a real procurement option rather than a hypothetical one. The multilingual coverage is the part with direct Australian relevance — a model trained across 46 languages is a materially different proposition for government multilingual content than one trained predominantly on English and then asked to translate.
- fyi OpenAI
A system-level diversity mitigation lands on unspecified prompts — openai.com
On 18 July 2022 OpenAI deployed a technique making DALL-E 2 produce more demographically diverse people when a prompt does not specify race or gender — the canonical example being "firefighter". The single published figure is that users were twelve times more likely to say images included people of diverse backgrounds after the technique was applied. OpenAI credited preview users who flagged biased outputs and notably did not explain how the mitigation works.
Worth knowing for one reason: an undisclosed system-level intervention between the prompt a user submits and the prompt the model receives means the output is not a function of the input alone. That matters if you ever need to explain or reproduce a generated asset. Treat "the model produced this" as an incomplete account.
Security and edge
Sections- critical Atlassian
A Confluence add-on ships a hardcoded password that survives uninstalling — nvd.nist.gov
CVE-2022-26138, published 20 July 2022: the Atlassian Questions for Confluence app creates a Confluence account in the confluence-users group with the username disabledsystemuser and a hardcoded password, so any remote unauthenticated attacker who knows that password can log in and read everything accessible to that group. CVSS 9.8, scored independently and identically by NIST and CISA-ADP. Affected are Questions for Confluence 2.7.34, 2.7.35 and 3.0.2. The credential was published within days, making this trivially scriptable mass exploitation. The nasty detail is the remediation: uninstalling the app does not necessarily remove the account.
Search your Confluence user directories for disabledsystemuser even if the app was uninstalled long ago and even if you have patched, because the account is the vulnerability and the app is only how it got there. This is the second Confluence emergency in seven weeks after June's CVE-2022-26134, so if you manage Atlassian Server for clients, "reduce internet exposure" stops being advice at this point and becomes a project with a budget.
- notable OpenSSL
OpenSSL corrupts heap memory during routine RSA on modern CPUs — openssl-library.org
CVE-2022-2274, published 5 July 2022 and rated High, is heap memory corruption in OpenSSL's RSA implementation on x86-64 CPUs supporting AVX512IFMA, triggered during computation with 2048-bit private keys. The advisory is unusually direct about consequence: this could enable remote code execution on the machine performing the computation. The saving grace is the window — only OpenSSL 3.0.4 is affected, a release about two weeks old at the time, so anyone on a slower cadence stepped over it entirely. Fixed in 3.0.5. The same advisory carries CVE-2022-2097, where AES OCB mode on 32-bit x86 fails to encrypt all the data, exposing sixteen bytes of memory or plaintext.
If any TLS terminator picked up 3.0.4, get it to 3.0.5 as a priority — this is the rare OpenSSL bug with a plausible remote code execution path on a server doing nothing unusual. Check your newer Intel and AMD server SKUs specifically, because AVX512IFMA is the precondition and it is present on exactly the modern hardware you would put at the edge. There is also a rueful lesson here for fast patchers: the only affected version was the newest one.
- fyi Log4Shell
The Cyber Safety Review Board calls Log4j an endemic vulnerability — cisa.gov
Published 11 July 2022, the CSRB's Log4j report is the closest thing to an authoritative retrospective on the event, and its central finding is a surprise reported honestly: despite widespread exploitation attempts, the Board did not learn of any significant attacks impacting organisations including critical infrastructure — while being candid that this may reflect the absence of mandatory reporting rather than the absence of harm. It found the things that went right, including a mature Apache process and fast patch availability, were not enough because organisations lacked visibility into where log4j was embedded, drowned in advisory noise and ran out of people. It projects vulnerable instances will remain for a decade or longer.
The three named failure causes are the useful part, because none of them is fixed by patching faster: you cannot patch what you cannot locate, advisory noise is a triage problem, and running out of people is a capacity problem. Read it beside June's CISA advisory showing continued exploitation of the same flaw — the Board's "endemic" framing is what turns Log4Shell from an incident into a standing inventory requirement.
Standards and compliance
Sections- critical ASD
Essential Eight Maturity Level Two replaces the Top Four — protectivesecurity.gov.au
From 1 July 2022 a PSPF Policy 10 amendment requires non-corporate Commonwealth entities to implement Essential Eight Maturity Level Two mitigations to achieve a PSPF maturity rating of "Managing". The four additional strategies that become core requirements on that date are Office macro settings, user application hardening, multi-factor authentication and regular backups — on top of the earlier Top Four (application control, patch applications, restrict administrative privileges, patch operating systems).
The replacement is the substantive change rather than the level: Top Four was four mitigation strategies, and Essential Eight Maturity Level Two is eight assessed at a defined maturity, which is a considerably larger evidence burden. For a hosting or platform vendor the strategies that reach you are patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges and regular backups — and with the ANAO finding only two of nineteen major entities self-assessed at Managing, agencies will lean on suppliers. Check the Policy 10 text for the full control wording before quoting it to a client.
- fyi APRA
APRA proposes CPS 230 and consolidates five standards into one — apra.gov.au
On 28 July 2022 APRA released its discussion paper "Strengthening operational risk management" with a draft Prudential Standard CPS 230, covering banking, insurance and superannuation. CPS 230 consolidates five existing standards — CPS 231 and CPS 232 for banking, life and general insurance, SPS 231 and SPS 232 for superannuation, and HPS 231 for health insurance — into a single operational risk standard covering operational risk management, business continuity and service provider management.
APRA planned to finalise the standard in early 2023, with CPS 230 coming into effect for all APRA-regulated entities from 1 January 2024. The service provider chapter is the one to read: it is where "material service provider" gets defined, and that definition is what determines whether your outage tolerances, notification obligations and audit rights end up written into someone else's prudential compliance.
Update, July 2023: APRA released the final CPS 230 on 11 July 2023, with commencement set at 1 July 2025.
- fyi ACMA
Telcos must start identifying, tracing and blocking scam SMS — acma.gov.au
New ACMA rules commenced on 12 July 2022 requiring telecommunications providers to identify, trace and block scam short messages.
Peripheral unless you build for a carrier, and worth tracking as part of a pattern: this is the second 2022 instance of an Australian regulator specifying operational obligations for a communications provider by instrument rather than leaving them to industry code, after April's customer identity authentication determination.
CMS and platforms
Sections- notable Drupal
Two old fixes fail to compose and allow arbitrary PHP execution — drupal.org
SA-CORE-2022-014, published 20 July 2022, rated Critical at 15 out of 25, CVE-2022-25277. Two earlier security fixes — filename sanitisation and dot-stripping — did not compose correctly, so on Apache an attacker could upload a .htaccess file where an administrator had explicitly allowed the htaccess extension, giving arbitrary PHP code execution. It was one of four core advisories Drupal shipped that same day.
Patch immediately, and note the mechanism because it is the interesting part: neither prior fix was wrong on its own, and the vulnerability lives in the interaction between them. That is an argument for testing security fixes in combination rather than individually, and it is why "we applied every advisory" is not the same claim as "we are not exploitable". The precondition — an administrator explicitly allowing the htaccess extension — is rare but it is a configuration someone chose, so check rather than assume.
- notable Drupal
Three more Drupal advisories land the same day — drupal.org
Alongside the critical advisory, three others published 20 July 2022. SA-CORE-2022-012, CVE-2022-25275, 13 out of 25: the Image module does not correctly check access to files held outside the public files directory when generating derivatives, so a private image can be disclosed through its derivative — affected ranges are unusually broad and include Drupal 7. SA-CORE-2022-013 is a Form API flaw evaluating element access incorrectly. SA-CORE-2022-015, CVE-2022-25276, 11 out of 25: the Media oEmbed iframe route does not validate the iframe domain setting, so embeds render in the context of the primary domain instead of the isolated one.
The oEmbed one deserves attention beyond its score. The separate oEmbed domain exists precisely to sandbox third-party embed content away from your primary origin, so a failure to validate it defeats the entire control and reopens cross-site scripting and cookie theft paths that the architecture was designed to close. If you configured a separate media domain, verify it is actually being enforced after patching rather than assuming the setting still does what it says.
Supply chain, CI/CD and IaC
Sections- notable npm
Every npm package is re-signed and verification becomes one command — github.blog
Announced 26 July 2022 with an update on the 28th, and the most consequential npm change of the year. Every package in the registry was re-signed using ECDSA with keys held in a hardware security module, replacing a PGP scheme almost nobody verified because the workflow was unusable — and npm audit signatures landed in CLI 8.13.0 so verification is one command against a whole dependency tree. The same post shipped browser-based login with a five-minute remember-me window, and defined the next 2FA cohort as accounts maintaining packages with over one million weekly downloads or more than 500 dependents, which GitHub said would triple accounts under enforcement.
Add npm audit signatures to CI immediately after install and fail the build on a mismatch. It is a single command and it detects registry-level tampering that a lockfile hash will not, because a lockfile hash verifies you got the same bytes as last time rather than that those bytes came from the publisher. This is also the change that makes the 2023 provenance work possible — signing had to be usable before attestation could mean anything.
- notable PyPI
PyPI mandates 2FA for critical projects and a maintainer walks — bleepingcomputer.com
Announced 8 and 9 July 2022: PyPI made two-factor authentication mandatory for maintainers of projects it classes as critical — the top one per cent by download volume over six months, plus anything PyPI itself depends on — working out to roughly 3,818 projects and 8,218 accounts. To remove the cost excuse PyPI shipped 4,000 free hardware security keys funded by Google's Open Source Security Team and the Python Software Foundation. The pushback was real: the maintainer of atomicwrites, with over six million monthly downloads, deleted and republished the project to reset its download count and shed the designation, then stepped back from maintaining it.
Enrol every publishing account before you are conscripted, and move release publishing off personal accounts onto a scoped API token held by CI so the mandate never lands on one person's phone. The critical-project list is recomputed, so a package can enter scope without its maintainer doing anything — which is the structural difference from npm's cohort approach and the reason this generated a revolt where February's npm rollout, with its brown-out rehearsals, did not.
- notable Terraform
Another required Terraform Enterprise release lands mid-year — hashicorp.com
Terraform Enterprise shipped further releases during July 2022 on its monthly cadence, with the register encoding year and month in the version identifier but not the day. As with April, the pattern that matters is the required-release flag: online upgrades install those automatically, but an airgapped installation must land on each required release in sequence before proceeding.
Keep the required-release list in your upgrade runbook rather than discovering it during a maintenance window, because the failure mode is being stranded between versions with the window already open. This is the second entry on this pattern in 2022 and the reason it recurs is that the constraint is invisible from the version number alone — nothing about v202207 tells you whether you can skip it.
Languages, runtimes and frameworks
Sections- notable Node.js
Node fixes three request smuggling flaws in its HTTP parser — nodejs.org
Released 7 July 2022 as v14.20.0, v16.16.0 and v18.5.0, fixing seven issues. Three are HTTP request smuggling in the parser — CVE-2022-32213 for flawed Transfer-Encoding parsing, CVE-2022-32214 for improper delimiting of header fields, and CVE-2022-32215 for incorrect parsing of multi-line Transfer-Encoding — all rated medium and all affecting 14.x, 16.x and 18.x. The two High-severity items are CVE-2022-32212, DNS rebinding through the inspector via invalid IP addresses, and CVE-2022-32223, DLL hijacking on Windows.
Three request smuggling flaws in one release is the finding, and it matters most if Node sits behind a proxy or CDN, because smuggling is how a request that the edge authorised becomes a different request at the origin. Patch all three branches. The DNS rebinding item is a reminder that the inspector should never be reachable from anywhere but localhost, which is worth verifying rather than assuming in a containerised deployment.
- notable Go
Go's broadest batch of the year is all parsers and path handlers — go.dev
go1.17.12 and go1.18.4 shipped on 12 July 2022 covering compress/gzip, encoding/gob, encoding/xml, go/parser, io/fs, net/http and path/filepath. Every one of those is a parser or a path handler.
Prioritise this batch above the May or June ones if you are triaging, because the attack surface is decompression and deserialisation — which is to say, everything reachable from untrusted input. That is the useful way to read a Go security release: the package list tells you the exposure more reliably than the severity ratings do, and a batch spanning gzip, gob and xml is a different proposition from one touching syscall.
- notable PHP
PHP 8.1.8 is a security release and 8.0.21 is not — php.net
Released 7 July 2022. php.net flags 8.1.8 as a security release while 8.0.21, published the same day, is a bug-fix release only — an unusual asymmetry meaning the defect was 8.1-specific rather than a shared backport. CVE-2022-31627 is recorded as allocated against the corresponding bug. PHP 8.2.0 Beta 1 followed on 21 July.
Do not read across from the 8.0 announcement: this one is 8.1-only and does need patching. It is the inverse of the February and June pattern, where all branches moved together and that told you the defect reached back — here only one branch moved, and that tells you it did not. Worth building the habit of reading which branches moved rather than only the version you run.
Static site and web tooling
Sections- notable Vite
Vite 3 moves the dev server port and changes output file extensions — vite.dev
Released 23 July 2022 — noted because the release is frequently cited as mid-July elsewhere, while the announcement and the blog index both give the 23rd. It is breaking in several ways that reach tooling and output. The dev server default port moved to 5173 and the preview server to 4173. In SSR and library mode, output file extensions now use a valid js, mjs or cjs based on the format and the package type — a direct change to the names of the files your build emits.
The port change breaks every hardcoded localhost:3000 in a proxy config, Docker Compose file or CI smoke test, and those are exactly the places nobody greps. The extension change is the more consequential one for a deploy pipeline: if anything downstream matches emitted filenames — a CDN rule, an asset manifest consumer, a copy step — it stops matching. Check both before upgrading, and remember Astro, SvelteKit and Nuxt all sit on Vite, so this propagates.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more