Radar · 2022-09
September 2022
Optus discloses a breach exposing identity document numbers for millions of Australians and becomes the reference case for an unauthenticated API reachable from the edge, a phishing campaign impersonating CircleCI relays one-time codes in real time so app-based two-factor authentication fails while hardware keys hold, Node tells developers that patching is not enough and every key generated with WebCrypto must be re-issued, two WordPress plugin zero-days are exploited millions of times before their patches land, and SvelteKit redesigns its filesystem router with no major version to announce it.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- fyi OpenAI
Whisper is open-sourced and becomes the self-hosted speech baseline — openai.com
Released 21 September 2022, Whisper is an automatic speech recognition model trained on 680,000 hours of multilingual, multitask supervised audio collected from the web, with roughly one third of the training set non-English. It handles transcription in many languages plus direct translation of non-English speech into English, and was published as open source with code and a model card — an unusual move for OpenAI even at the time, and the reason Whisper became the default self-hosted speech baseline for years afterwards.
This is the month captioning and transcription stopped requiring a vendor. For Australian government work that matters twice over: WCAG requires captions, and a self-hostable model means audio never leaves the country, which removes the residency objection that made outsourced transcription awkward for agency content. Worth knowing the non-English third of the training set too, since multilingual government audio is exactly where hosted English-first services underperform.
- fyi OpenAI
DALL-E drops its waitlist at 2 million images a day — openai.com
OpenAI removed the DALL-E beta waitlist on 28 September 2022, opening immediate signup. The post reported over 1.5 million active users creating more than 2 million images a day, up from the one million invited in July.
The volume figure is the useful part rather than the access change. Two million images a day, ten weeks after a paid beta opened, is the number to reach for when someone asks whether generated imagery is a novelty — and it is also the moment client content teams could start producing it without asking anyone. That is the point at which "who generated this asset and under what terms" becomes a question a web team needs an answer to.
- fyi AWS
Textract improves baseline text detection — aws.amazon.com
Amazon Textract improved the accuracy and latency of its DetectDocumentText operation during September 2022 — the base optical character recognition call rather than the structured extraction features.
Incremental and worth noting only as part of an arc: this is the fourth Textract improvement of 2022 after table and checkbox detection in February, natural-language Queries in April and key-value accuracy in June. Read as a set, the direction is that form digitisation moved from a bespoke machine learning project to an API call over the course of one year, which is the shift that made Australian government paper-form backlogs addressable.
Security and edge
Sections- critical Sophos
A firewall user portal takes the year's fifth appliance zero-day — nvd.nist.gov
CVE-2022-3236, published 23 September 2022, is a code injection flaw in the Sophos Firewall User Portal and Webadmin allowing a remote attacker to execute code. Affected are Sophos Firewall 19.0 MR1 and older, and 18.5 MR4 and earlier. Sophos as CNA assigned CVSS 9.8 and CISA-ADP assigned the same score and vector. It was used as a zero-day against a small set of targeted organisations, largely in South Asia, and carries a CISA federal remediation deadline of 14 October 2022.
By September the 2022 pattern is unmistakable: firewall and VPN vendors were the primary target, with F5 in May, Sophos here, Fortinet in October and December, and Citrix in November and December. One control would have blunted every one of them — no vendor management interface or user portal reachable from the public internet, and firmware kept within one release of current. That is a standing architectural decision rather than a patch cycle, and it is the cheapest thing on this list to get right.
- critical Chrome
Chrome ships a single-fix Mojo validation patch for an in-the-wild exploit — chromereleases.googleblog.com
On 2 September 2022 Google updated Chrome 105 to 105.0.5195.102 with one security fix: CVE-2022-3075, high-severity insufficient data validation in Mojo. Google said it was aware of reports that an exploit existed in the wild.
Force a restart across the fleet. A single-fix stable update with an in-the-wild notice is the urgency signal. Mojo is Chrome's inter-process communication layer, so this is a privileged-process boundary rather than a renderer-only bug.
- notable Optus
Optus breach exposes customers' identity document numbers — oaic.gov.au
Optus disclosed on 22 September 2022 that a cyberattack had exposed customer personal information, with unauthorised access occurring between 17 and 20 September per ACMA's own statement. Exposed categories included names, dates of birth, phone numbers, email addresses and, for a subset, residential addresses and identity document numbers — driver licence and passport numbers. Passwords and payment details were not exposed. Optus put its worst case at 9.8 million customers. Optus gave no attack-vector detail at disclosure.
Optus had not said how the attacker got in, but the control worth checking now is architectural. Enumerate every public route your CDN or WAF forwards and hunt specifically for endpoints never meant to be internet-reachable that are, because the edge configuration forwards a whole path prefix rather than named routes. Deny-by-default at the edge beats hoping the origin authenticates.
Update, October 2022: On 3 October Optus said more than 2.1 million customers had identity document numbers exposed, about 1.2 million of them current.
Update, June 2024: ACMA alleged in Federal Court filings that a coding error left access controls on Optus's internet-facing API domain ineffective, letting the attacker bypass them and query customer data.
Update, August 2025: The Information Commissioner began civil penalty proceedings, alleging Optus interfered with the privacy of approximately 9.5 million Australians. Exposed data included Medicare card numbers and birth and marriage certificate information.
Standards and compliance
Sections- notable ASD
The September ISM update ships a machine-readable OSCAL edition — cyber.gov.au
ACSC published an Information Security Manual update on 15 September 2022 and, with that release, provided the ISM in NIST's OSCAL machine-readable format for the first time: ASD's list of ISM OSCAL releases starts that month, with editions built from the June and September 2022 manuals. The OSCAL edition is intended for governance, risk and compliance tools.
The release itself is routine. For anyone reconciling ISM deltas into a system security plan, the OSCAL profiles are more useful than the PDF, because they are diffable. The release notes still need a human read.
- fyi W3C
WCAG 2.2 reaches Candidate Recommendation Snapshot — w3.org
W3C published the WCAG 2.2 Candidate Recommendation Snapshot on 6 September 2022 and invited implementations. The W3C's own publication history lists this as the sole 2022 milestone for the specification — the next are the two Candidate Recommendation Drafts of January and May 2023, Proposed Recommendation in July 2023 and Recommendation in October 2023.
Useful mainly as a date anchor, because the practical question in 2022 was how long to wait. This is the point at which W3C considered the criteria implementable and asked for implementations, thirteen months before the standard became final — so a team that started design-system remediation here rather than in late 2023 was working against text that changed only marginally. Worth knowing when auditing when accessibility work should reasonably have begun.
CMS and platforms
Sections- critical WordPress
A backup plugin's file read is exploited five million times — thehackernews.com
CVE-2022-31474 in BackupBuddy, on roughly 140,000 active installations, is an arbitrary file read in its Local Directory Copy function that unauthenticated attackers could use to download any file the web server could reach. Exploitation began 26 August 2022, the fix shipped on 2 September and it was publicly reported on 9 September, with telemetry putting attempts at roughly five million.
Treat any affected site as having had its files read, not merely as unpatched — an arbitrary file read against a WordPress install means wp-config.php, which means database credentials and authentication salts. Rotate both. Note the shape this shares with July's UpdraftPlus flaw: backup plugins hold the most concentrated secrets on a site and are precisely the category least likely to be included in a security review, because they are treated as operational tooling rather than as attack surface.
- critical WordPress
A plugin zero-day inserts administrator accounts without credentials — thehackernews.com
CVE-2022-3180 in the WPGateway plugin, disclosed by Wordfence on 13 September 2022 and scored 9.8, lets an unauthenticated attacker insert a malicious administrator account — complete site takeover with no credentials required. Wordfence blocked more than 4.6 million attacks against more than 280,000 sites in the thirty days to mid-September.
The indicator of compromise is specific and worth checking directly: look for an unexpected administrator account rather than for a plugin version. That check is also the right one for the general case, because an unauthenticated-admin-creation flaw leaves a persistent artefact that survives patching, uninstalling the plugin and even a core upgrade. Two WordPress plugin zero-days in the same month is the argument for treating the plugin inventory as part of the security boundary rather than as configuration.
- notable Drupal
A Twig pass-through is Drupal core's second critical since July — drupal.org
SA-CORE-2022-016, published 28 September 2022 and rated Critical at 18 out of 25, is Drupal core's second advisory rated Critical since the start of July, after SA-CORE-2022-014 on 20 July (Critical, 15 out of 25). It is a pass-through of an upstream Twig security update that Twig itself rated high severity, tracked as CVE-2022-39261. Where an untrusted user can get Twig code to execute, the flaw can expose private files, arbitrary server file contents or database credentials.
Patch promptly — this is the latest advisory of 2022 that reaches Drupal through a bundled dependency rather than Drupal's own code, after jQuery UI in January, CKEditor in March and three Guzzle advisories between March and June, and it is the most serious of them. The exposure condition is the part to reason about: it needs an untrusted user able to influence Twig execution, which is uncommon by default and not uncommon in a site with custom template logic driven by content. Check where template names or paths are derived from user-supplied values.
Supply chain, CI/CD and IaC
Sections- critical GitHub
A phishing page relays one-time codes and app-based 2FA fails — github.blog
Disclosed 21 September 2022 with an update on the 29th: a campaign impersonating CircleCI phished GitHub credentials, and the mechanism is what matters. The fake login page relayed time-based one-time passwords to the threat actor and to GitHub in real time, so accounts protected by app-based two-factor authentication were compromised anyway. Accounts using WebAuthn hardware keys were not. On success the attacker immediately created personal access tokens and authorised OAuth applications to establish persistence beyond the stolen session.
This is the incident that separates TOTP from phishing-resistant authentication in practice rather than in theory, and the conclusion is unambiguous: hardware keys held, authenticator apps did not. If you have been treating an authenticator app as sufficient for accounts that can publish or deploy, this is the evidence that it is not. Note the persistence step too — a compromised session immediately becomes tokens and OAuth grants, so incident response has to enumerate those rather than just reset the password.
- notable PyPI
pip download runs the package you asked not to install — thehackernews.com
Published 2 September 2022: researchers showed that pip download executes a package's setup.py even though the user asked only to fetch and not install, so the act of retrieving a package for inspection can run attacker code. Roughly one third of PyPI packages trigger code execution on download. The condition is distribution format — it happens when pip falls back to a source distribution rather than a wheel, so an attacker simply publishes without a wheel.
This breaks the workflow most people assume is safe: downloading a suspicious package to look at it before installing. Use the no-build flags or fetch the artefact directly from the registry over HTTP if you need to inspect something, and do it in a container you throw away. The general lesson is that "download" and "execute" are not separate operations in a packaging ecosystem that allows arbitrary code in its build step, which is also why wheels matter for reasons beyond speed.
- notable Terraform
Terraform 1.3 brings optional object attributes with defaults and wider moved blocks — hashicorp.com
Released 21 September 2022. The headline is optional object type attributes with defaults, which graduate from experimental status. It also extends the moved block, introduced in Terraform 1.1, to resources refactored into third-party and separately sourced modules, so Terraform updates state rather than destroying and recreating infrastructure — the previous route being manual state surgery. It also continued the precondition and postcondition work from 1.2.
Moved blocks change what refactoring costs, and 1.3 extends them across module packages. Without them, renaming a resource or restructuring modules meant either a destroy-and-recreate or hand-editing state, which is why so much Terraform carries names nobody likes — and a declarative move that survives code review is a materially safer operation than terraform state mv run by whoever is on call. Worth adopting as the standard route for any structural change to a live estate.
Languages, runtimes and frameworks
Sections- notable Node.js
Node says patching is not enough and every WebCrypto key must be re-issued — nodejs.org
Node shipped v14.20.1, v16.17.1 and v18.9.1 on 23 September 2022, postponed one day from the 22nd. The standout is CVE-2022-35255, weak randomness in WebCrypto key generation, rated High and affecting 16.x and 18.x. Node's follow-up on 26 September went further than a patch note: it recommended that every key generated with the affected WebCrypto implementation be regenerated, because the keys themselves are weak regardless of the version that now generates them.
This is the rare runtime advisory where upgrading does not remediate. Any key material produced by WebCrypto on an affected Node version has to be re-issued — and that is an inventory problem before it is a rotation problem, because most teams do not track which keys were generated where or when. Start with anything long-lived: signing keys, tokens with distant expiry, keys embedded in client software. A weak key generated in 2022 stays weak for as long as it is trusted.
- notable Go
Go patches an HTTP/2 denial of service — pkg.go.dev
go1.18.6 and go1.19.1 shipped on 6 September 2022. GO-2022-0969 / CVE-2022-27664 is an HTTP/2 denial of service: a server connection can hang forever waiting for a clean shutdown that was preempted by a fatal error, which a malicious client can use to exhaust the server. The same fix is in golang.org/x/net/http2. The release-history page only names security fixes to net/http (and net/url on 1.19.1); the HTTP/2 hang is on the vulnerability record.
Patch on the normal cycle, and use it to list which of your services terminate HTTP/2 in Go and which import golang.org/x/net separately, because the fix has to land in both places.
- notable PHP
PHP ships two separate security batches in one month — php.net
PHP published security releases in two batches during September 2022 rather than the usual single coordinated day, across its supported branches.
Two batches in a month is the signal worth reading: it means something arrived after the first release was cut, which is a different situation from a single planned security day and warrants checking that your patching picked up both. A pipeline that applies "this month's PHP security release" as a single event will have taken the first and missed the second.
Static site and web tooling
Sections- notable SvelteKit
SvelteKit redesigns its filesystem router with no major to announce it — svelte.dev
Announced 1 September 2022 and the largest breaking change of SvelteKit's pre-1.0 life: a wholesale redesign of how routes are declared on disk, requiring a migration guide before upgrading. Bundled with it, the session object was removed from load along with the session store and its getter, replaced by event.locals; named layouts were deprecated in favour of route groups in parentheses notation; and further load changes followed.
This is a migration with a guide, not an upgrade — every route on disk moves and every load function that touched session has to be rewritten against a different object. Do it deliberately with a branch and a diff of generated routes. The structural lesson for 2022 SvelteKit is now complete: three breaking changes across April, August and September, none of them signalled by a version number, all of them documented only in the project's monthly posts.
- notable Next.js
Next.js 12.3 stabilises the new image component and drops a noscript fallback — nextjs.org
Released 8 September 2022. The future image component went stable, with a fill layout mode added, the blur-up placeholder no longer requiring a noscript element, alt text now required, and alt hidden while loading to prevent layout shift in non-Chrome browsers. Remote patterns and the unoptimised images option both went stable, the latter being what makes static export viable without a third-party image provider. The SWC minifier went stable as an opt-in.
Removing the noscript fallback is a generated-markup change, so anything asserting on image markup — snapshot tests, CSS selectors, HTML post-processing — needs rechecking. The unoptimised images option going stable is the more strategically useful item: it is what lets a fully static Next.js export ship without wiring in an external image service, which is a real deployment simplification for a CDN-fronted site.
- notable Hugo
Hugo ships a performance regression that the next minor does not fix — discourse.gohugo.io
Hugo 0.103.0 on 15 September 2022 brought proper 404 support to the development server and introduced a static-directory performance regression. Hugo 0.104.0 on 23 September did not fix it. Hugo 0.104.1 on 26 September did, and its release note names the regression and its origin release explicitly.
The sequence is the finding: 0.103.0 is effectively unpinnable, because there is no patch within that minor and the next minor does not carry the fix either — the only route out is 0.104.1. That matters if your policy is to pin a minor and take patches within it, because here that policy leaves you stuck.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more