Radar · 2022-08
August 2022
The Medibank intrusion begins with contractor credentials stolen from a personal device, a VPN that did not require multi-factor authentication and alerts that were generated but never triaged, an incomplete Zimbra fix removes the last precondition and more than a thousand servers are backdoored, Stable Diffusion ships weights that run on a consumer graphics card, PyPI maintainers are phished into handing over publishing accounts, and Astro 1.0 and Docusaurus 2.0 both land in the same fortnight.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- fyi Stability AI
Stable Diffusion puts image generation on a consumer graphics card — huggingface.co
Released publicly on 22 August 2022 and documented the same day in Hugging Face's Diffusers walkthrough. Built by CompVis, Stability AI and LAION and trained on 512 by 512 images from a subset of the LAION-5B database, it generates 512 by 512 images in a default 50 inference steps. Because it operates in a compressed latent space at an eight-times factor rather than in pixel space, it runs in about 10GB of VRAM at full precision, with float16 the documented fallback below that — which means consumer GPUs rather than datacentre accelerators.
The VRAM figure is the whole significance. Every generative image product before this required someone else's infrastructure and someone else's terms; from this date the model runs on hardware a client already owns, which changes the questions you get asked from "which API should we use" to "can we run this ourselves". For an Australian operator that is also the first credible answer to a data-residency objection about generative imagery, since nothing has to leave the country.
- fyi NIST
The AI Risk Management Framework reaches its second draft — nist.gov
NIST released the second draft of the AI Risk Management Framework on 18 August 2022 alongside the first draft of its companion Playbook, opening comment to 29 September. The draft carried forward feedback from the March workshop and set a third for 18 and 19 October. NIST stated it planned to publish AI RMF 1.0 in January 2023.
The Playbook is the part worth noting rather than the framework text, because a framework tells you what to achieve and a playbook tells you what to do — and the second is what a client actually needs when they ask how to govern an AI feature you built for them.
- fyi OpenAI
A free moderation endpoint arrives, scoped to OpenAI's own output — openai.com
Announced 10 August 2022, OpenAI's Moderation endpoint classifies content as sexual, hateful, violent or promoting self-harm using GPT-based classifiers, via a single API call, and was offered free to API developers alongside a technical paper and an evaluation dataset. The significant restriction is scope: it supported moderation of OpenAI API-generated content only, and third-party traffic monitoring was not supported.
Read the scope limit before building on it. A free classifier that only covers text your own OpenAI calls produced does not solve user-generated content moderation on a client site, which is the problem people immediately assumed it addressed. It is genuinely useful for checking model output before display — which is a real control if you are surfacing generated text to the public — and useless for the inbound direction.
Security and edge
Sections- critical Zimbra
An incomplete Zimbra fix turns mboximport into unauthenticated RCE — nvd.nist.gov
CVE-2022-37042, published 12 August 2022, is an authentication bypass in Zimbra's mboximport feature, which accepts ZIP archives and extracts files without an authtoken — giving arbitrary file upload, directory traversal and remote code execution. CVSS 9.8. Affected are 8.8.15 and 9.0. NVD records it as arising from an incomplete fix for CVE-2022-27925, which needed an authenticated user. CISA added both CVEs to its Known Exploited Vulnerabilities catalogue on 11 August, and its 16 August advisory cites exploitation against over 1,000 Zimbra instances.
The incomplete-fix chain is the lesson and it generalises: when a vendor patches a remote code execution that "requires administrator credentials", assume the credential requirement is the next thing to be bypassed, because it is the cheapest part of the chain to attack. If you host Zimbra, verify patch level against the p-number ranges rather than the major version, and hunt for webshells in the mailbox store — patched-but-already-breached is the common outcome here. This is the second Zimbra entry of the year after February.
- critical Chrome
Chrome patches an exploited Intents validation flaw — chromereleases.googleblog.com
On 16 August 2022 Google updated Chrome 104 with twelve security fixes, including CVE-2022-2856, high-severity insufficient validation of untrusted input in Intents. Google said an exploit for that CVE existed in the wild.
Force a restart across the fleet. Intents is a boundary between the browser and another application, which is the same class of surface embedded Chromium engines and Electron apps expose on slower update cycles.
- notable curl
A cookie parsing quirk from the 1990s finally gets a CVE — curl.se
curl 7.85.0, announced 31 August 2022, carried a single advisory: CVE-2022-35252, a control code in cookie denial of service, rated low. The affected range is extraordinary — curl 4.9 through 7.84.0, essentially every curl ever shipped — because the underlying cookie parsing behaviour had been in place since the 1990s. A server can set a cookie containing a control code that curl stores and later returns, and the resulting request is rejected, producing a self-inflicted denial of service against that host.
Low priority alone, and a useful prompt for a different question: confirm your base images track curl releases at all. A fleet still on a 7.7x build in late 2022 is also missing May's connection-reuse and HSTS fixes, which do matter — so the value of this advisory is as a cheap probe of whether anything in your image pipeline is actually pulling curl forward.
Standards and compliance
Sections- notable eSafety
eSafety issues its first legal notices under the Basic Online Safety Expectations — itnews.com.au
On 30 August 2022 the eSafety Commissioner issued legal notices to Apple, Meta (including WhatsApp), Microsoft (including Skype), Snap and Omegle, requiring them to detail anti-child-exploitation measures. They were the first legal notices issued under the new Basic Online Safety Expectations.
The significance is that the notice power was used against named consumer platforms. A hosting or designated internet service inside the Online Safety Act's definitions should treat a notice as a live possibility rather than a theoretical one, and should know who would answer it.
- fyi OAIC
The OAIC names security of personal information a regulatory priority — oaic.gov.au
The OAIC published its Corporate Plan 2022-23 on 1 August 2022, setting four regulatory priorities including online platforms, social media and high privacy impact technologies, and security of personal information.
Worth keeping for the timing rather than the content: the regulator has put security of personal information on its list of priorities, which is the signal to expect closer attention to how breaches are prevented and handled.
CMS and platforms
Sections- notable WordPress
WordPress patches SQL injection in the Link API back to 3.7 — wordpress.org
WordPress 6.0.2, released 30 August 2022, is a combined security and maintenance release carrying three security fixes: a SQL injection in the Link API, a cross-site scripting issue on the Plugins screen and an output escaping defect in the_meta. It also bundles 12 core bug fixes and five block editor fixes. Backports reached every branch since 3.7.
Patch, and note the backport range again — fixes issued as far back as 3.7 is the WordPress security team assuming it will find nine-year-old installations, which it does. The Link API injection is the one to prioritise on any site with contributor-level accounts, and the Plugins screen cross-site scripting matters most where you have granted plugin management to someone you would not grant database access to.
- notable Drupal
A CKEditor 5 flaw arrives through release notes rather than an advisory — drupal.org
Drupal 9.4.5, released 3 August 2022, addresses CVE-2022-31175, a cross-site scripting issue in CKEditor 5 caused by the editor instance destroying process, and moves the bundled CKEditor 5 to 35.0.1. The practical exposure is narrow — it primarily affects users on the full HTML text format with CKEditor in QuickEdit mode. It carries no SA-CORE number because it was handled as a release-note security fix rather than a coordinated core advisory.
The delivery mechanism is the thing worth knowing. A security fix that ships in release notes rather than as an SA-CORE advisory will not appear in an advisory feed, so a monitoring process that watches only the advisory register misses it entirely — which is the same gap Drupal formalised a year later when it moved lower-risk issues into the public queue. Watch core release nodes as well as the advisory register.
- notable Drupal
Drupal pins the branch support dates, not just the release date — drupal.org
Published 24 August 2022, this is the most useful single lifecycle document of Drupal's 2022 cycle because it fixes the branch support table rather than only the release date. Drupal 10.0.x and 9.5.x entered beta the week of 12 September with a 9 September deadline for major-release-only changes, the release candidate phase began the week of 14 November, and the final release stayed at 14 December 2022.
Build a Drupal migration plan from these branch dates, because a release date on its own does not tell you when the branch you are actually running stops receiving fixes — and the branch dates are what a client's risk register needs. Worth reading beside June's Drupal 7 extension: the project controlled that date and moved it repeatedly, while the Drupal 9 end was forced by upstream Symfony and did not move.
Supply chain, CI/CD and IaC
Sections- critical PyPI
PyPI maintainers are phished with a fake mandatory validation deadline — bleepingcomputer.com
Warned by PyPI on 24 August 2022: the first documented phishing campaign aimed squarely at PyPI maintainers. Emails claimed a mandatory validation process was underway and that unvalidated packages would be removed, driving maintainers to a lookalike site that harvested credentials. Successful hijackings followed, with malicious versions published to legitimate package names. The actor was subsequently named JuiceLedger. PyPI had no blog at the time, so its contemporaneous warning was issued through status and social channels.
Note the social engineering, because it is unusually well aimed: the lure was a fabricated registry security requirement, at exactly the moment PyPI genuinely was imposing new security requirements on maintainers. That is what made it credible. The defence is procedural rather than technical — treat any registry email demanding action through a link as hostile, and verify policy changes by navigating to the registry yourself. Hardware keys defeat this entirely, which is the argument for July's giveaway.
- notable GitHub Actions
Dependabot starts alerting on vulnerable Actions — github.blog
From 9 August 2022 the GitHub Advisory Database covered GitHub Actions, with Dependabot alerts following over the next few days when a workflow calls an action with a published advisory. This closes the loop opened in January, when actions first became visible to the dependency graph — from August a vulnerable one generates an alert like any other dependency.
Turn the alerts on and treat them with more weight than the equivalent for an application library, because an action runs inside your workflow with whatever secrets that workflow can read. A vulnerable npm package in your application is a runtime risk; a vulnerable action in your release pipeline is a credential risk. This is also the payoff for having cleaned up the January inventory — the alerting is only as useful as the graph is accurate.
- notable GitHub Pages
GitHub Pages moves remaining sites onto Actions by default — github.blog
From 10 August 2022 GitHub Pages builds and deploys all sites with GitHub Actions. Public repositories had already moved in December 2021; this announcement extends the default to private and internal repositories. GitHub said the change is transparent and that operators do not need to do anything. A Pages site that previously built through an opaque internal pipeline now builds through a workflow, with a runner, third-party actions and a deployment token all in scope.
This is a net improvement in auditability — you can read the build log, which was not possible before, and a site that opts into a custom workflow can pin its dependencies — but it moves a whole class of sites that nobody thought of as CI into CI. If you or a client run documentation or marketing sites on Pages, know which ones still use the default build and which have started managing a workflow in the repository. For those that have, read that workflow, pin the actions to commit SHAs and know which token deploys it. Sites nobody considers infrastructure are exactly where nobody looks.
Languages, runtimes and frameworks
Sections- notable Go
Go 1.19 adds a memory limit and reformats every doc comment — go.dev
Released 2 August 2022. Go 1.19 brought GOMEMLIMIT, a soft memory limit, plus doc comment reformatting with links and lists, and a revised memory model aligned with C, C++, Java, JavaScript, Rust and Swift. Under the support policy — each major supported until two newer majors exist — 1.19 arriving put Go 1.17 out of support.
GOMEMLIMIT is the operationally significant one: it lets a Go process be told a heap ceiling rather than relying on GOGC percentages, which is the difference between a container that degrades and one that gets killed. The doc comment reformat is the quiet breaking change — gofmt in 1.19 rewrites comment formatting, so a repository formatted with 1.18 shows a large diff on first run and any CI check that fails on unformatted code will fail on the upgrade rather than on your changes.
- notable Go
Go 1.17 gets its final release on the way out — go.dev
A final go1.17 release shipped alongside a go1.18 security release during August 2022, closing out the 1.17 line as Go 1.19's arrival pushed it out of support under the two-majors policy.
If you were holding on 1.17, this is the last patch that branch will ever receive — so the decision is no longer whether to upgrade but when, and the upgrade now spans two majors rather than one. Worth knowing that Go's support window is defined by releases rather than by time, so a fast release cadence shortens your support window without any announcement.
Static site and web tooling
Sections- notable Astro
Astro 1.0 ships, and quietly changes how CSS specificity and Markdown JSX behave — astro.build
Astro 1.0 shipped on 9 August 2022. Two changes in the 0.x to 1.0 upgrade path reach existing code rather than adding features. Scoped CSS specificity is now preserved rather than boosted — Astro emits div:where(.astro-XXXX) instead of div.astro-XXXX, so styles that previously won on specificity can now lose. And components and JSX expressions in Markdown pages are no longer supported by default, superseded by the @astrojs/mdx integration, with a temporary legacy.astroFlavoredMarkdown escape hatch. Anyone coming from before 0.26 also inherits that release's switch to bundling script tags by default, with is:inline as the opt-out.
The CSS specificity change is the one to test for, because it produces different rendering with no error — a style that used to apply may now be overridden, and nothing tells you except the page looking wrong. Stable SSR is the strategic change: Astro is no longer purely a static generator, so an Astro deployment may now need a server runtime rather than a bucket of files, which is a deployment-shape decision. And because 1.0 carries Vite 3 internally, July's port and file-extension changes arrive with it.
- notable Docusaurus
Docusaurus 2.0 is a rebuild, four years and 97 pre-releases later — docusaurus.io
Released 1 August 2022 after 75 alphas and 22 betas. The changes are architectural rather than incremental: React moved from server-side templating to client-side single-page-application navigation, the theming system was redesigned around swizzling, versioning changed from a diff algorithm to snapshot copies, and the monolith became a plugin architecture.
The single-page-application navigation is the change that matters at the edge: v2 sites hydrate and navigate client-side, so cache behaviour, prefetching and what a crawler or a synthetic monitor actually sees all differ from v1. Test your caching rules and any uptime checks against a v2 site rather than assuming they carry over. Versioning moving from diffs to snapshot copies also means a documentation repository gets substantially larger, which is a repository-size and build-time consideration rather than a correctness one.
- notable SvelteKit
SvelteKit reworks load and picks up Vite 3 before 1.0 — svelte.dev
The August update covers a rework of the load function and the addition of Vite 3 support. This is one of the three significant pre-1.0 breaking changes of the year, alongside April's removal of fallthrough routes and September's filesystem router rework.
A load rework touches every route that fetches data, so this is a migration rather than a bump — and picking up Vite 3 brings July's dev server port change and output file extension changes along with it, so two sets of breakage arrive together. If you ran SvelteKit through 2022 the monthly posts remain the only changelog of record, because there were no majors to signal any of this.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more