Radar · 2022-10
October 2022
An authentication bypass hands an unauthenticated attacker the Fortinet management interface that terminates the VPN, Medibank confirms attackers hold 200 gigabytes including diagnosis codes that cannot be reissued the way a licence number can, the Commonwealth legislates in a hurry with emergency telecommunications regulations registered and a privacy penalties Bill introduced inside a fortnight, WordPress ships fifteen vulnerabilities in a single security-only release, and Next.js 13 renames the image component so an unmodified upgrade changes the HTML of every image on the site.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- fyi AWS
Inference gets eight Graviton instance types — aws.amazon.com
Amazon SageMaker added eight Graviton instance types for inference during October 2022, extending ARM-based instances from general compute into hosted model serving.
A cost story rather than a capability one, and the reason it is worth a line: inference on ARM changes the arithmetic for a low-traffic model endpoint, which is the shape most web-adjacent AI features actually have. If you priced a hosted inference endpoint earlier in 2022 and concluded it was not viable, the instance options changed underneath that conclusion.
Security and edge
Sections- critical Fortinet
An authentication bypass hands over the FortiOS management interface — nvd.nist.gov
CVE-2022-40684, published 18 October 2022, is an authentication bypass by alternate path in Fortinet's management interface, letting an unauthenticated attacker perform operations on the administrative interface via crafted HTTP or HTTPS requests. CVSS 9.8, assigned by Fortinet as CNA. Affected are FortiOS 7.0.0 to 7.0.6 and 7.2.0 to 7.2.1, FortiProxy 7.0.0 to 7.0.6 and 7.2.0, and FortiSwitchManager 7.0.0 and 7.2.0. Note the date spread: Fortinet notified customers and exploitation was reported from around 7 to 10 October while NVD publication is the 18th — both are real and describe different events.
A full admin-interface bypass on a device that terminates your VPN and sits at the network edge is the worst class of 2022 bug for a hosting operator. Patch, then assume compromise for any device internet-exposed before patching: review admin accounts, SSH keys, local users and any automation added during the window. The durable control is simple and unpopular — management interfaces must not be reachable from the internet, which would have blunted F5 in May, Sophos in September, this, and Citrix twice before year end.
- notable Medibank
Medibank confirms 200GB including diagnosis codes — itnews.com.au
On 20 October 2022 Medibank confirmed attackers held customer data — roughly 200GB including names, addresses, dates of birth, Medicare numbers, policy numbers and phone numbers, plus medical claims data carrying codes relating to diagnosis and procedures and information about where customers received medical services. It spanned the Medibank brand, ahm and international student systems, and the company had been shown a sample of 100 policies. Medibank said it expected the number of affected customers to grow and gave no attack-vector detail.
Coming four weeks after Optus, this is the pair that reset Australian board-level expectations, and the health-claims content made it materially worse than an identity-document breach — a diagnosis code cannot be reissued the way a licence number can. If you host anything holding health, financial or identity data for Australian clients, this is the argument for data minimisation over perimeter spend: the damage scaled with what was retained and reachable, not with how the attacker got in. Review retention on claims-like data and segment it away from anything a single compromised credential can reach.
- notable Apache
Text4Shell is the well-marketed CVE that did not warrant a weekend — nvd.nist.gov
CVE-2022-42889, published 13 October 2022, is in Apache Commons Text: variable interpolation shipped with three dangerous default lookup handlers — script for arbitrary code execution through the JVM scripting engine, dns for resolution, and url for loading remote values — so an application interpolating untrusted input could be driven to remote code execution. CVSS 9.8, assigned by NIST. Affected are Commons Text 1.5 through 1.9, fixed in 1.10.0 which disables the problematic interpolators by default. The name invited a Log4Shell comparison that did not hold up: the vulnerable method is not commonly called with untrusted input.
Check whether anything in your stack calls StringSubstitutor on user-controlled strings before spending a weekend on this, because for most estates the honest answer was no. Bump Commons Text to 1.10.0 on the normal cycle. Keep this one as the reference example of a well-marketed CVE that did not warrant emergency change control — being able to make that judgement quickly is worth as much as the patch, and October gave you two genuine emergencies to spend the effort on instead.
Standards and compliance
Sections- fyi OAIC
The Commonwealth legislates in a hurry on 11 October — legislation.gov.au
Two things happened on or around 11 October 2022. Emergency Telecommunications Amendment (Disclosure of Information for the Purpose of Cyber Security) Regulations 2022 were registered, permitting telcos to disclose information to banks and other bodies so breached identity documents could be checked and blocked. And the OAIC opened its investigation into Optus the same day.
The emergency regulations are the part worth understanding, because they are the mechanism that made breached identity documents actionable: without a lawful disclosure path, a leaked licence number cannot be flagged to the institutions that would otherwise accept it. For a vendor holding identity documents the lesson is that reissue and revocation paths are a design consideration, not an incident-response one — and the Commonwealth had to legislate one in a fortnight because none existed.
- fyi Privacy Act
The privacy penalties Bill is introduced five weeks after Optus — aph.gov.au
The Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 was introduced with first reading on 26 October 2022, with the second reading moved the same day. It would substantially increase the maximum penalty for serious or repeated interferences with privacy and expand the Information Commissioner's enforcement powers.
The proposed maximum is the greater of $50 million, three times the benefit obtained, or 30 per cent of adjusted turnover. Introduced weeks after the Optus and Medibank breaches, it shows how fast the Commonwealth is moving on privacy penalties, which is the context for how seriously clients will treat supplier privacy evidence.
- fyi SOCI
The CIRMP Rules go out for a 45-day consultation — homeaffairs.gov.au
Home Affairs opened consultation on the exposure draft Critical Infrastructure Risk Management Program Rules, LIN 22/018, on Wednesday 5 October 2022, closing Friday 18 November, with town hall sessions on 10 and 12 October. These are the rules that give operative effect to the risk management program obligations inserted into the SOCI Act by the SLACIP Act in April — naming the asset classes captured and the cyber security frameworks a responsible entity may nominate.
This is the consultation that sets the detail of the obligation: the exposure draft carries the framework menu — ISO 27001, Essential Eight Maturity Level One, NIST CSF and the rest — and the asset classes that pull hosting and data-processing vendors into scope. Forty-five days over October and November is the window to respond.
CMS and platforms
Sections- notable WordPress
WordPress ships fifteen vulnerabilities in one security-only release — wordpress.org
WordPress 6.0.3, released 17 October 2022, fixed 15 distinct security issues, making it one of the heaviest single security releases of the 6.x era. The list spans multiple stored cross-site scripting vectors — wp-mail.php, the Customizer, comments, the RSS widget, the search block and the featured image block — plus a reflected cross-site scripting issue in the Media Library, along with data exposure and other defects.
Update immediately and note what the shape of the release tells you: fifteen issues in one security-only drop is not fifteen independent discoveries, it is the result of a concentrated review of one area, and the area here is block and widget output escaping. That means custom blocks in your own codebase are worth reviewing on the same basis rather than assuming core was the only place the pattern occurred. Any site with contributor-level accounts should treat the stored vectors as the priority.
- fyi Drupal
Drupal 9.4.8 carries over thirty fixes and three known issues — drupal.org
Released 6 October 2022, a production-ready patch release with more than 30 fixes spanning database drivers, Layout Builder, Views, media handling and accessibility, and moving CKEditor 5 to 35.1.0 — continuing the monthly library churn that also produced 35.0.1 in August. The release notes flag three known issues, two of them labelled regressions, including database driver namespace compatibility when Drupal 8 overrides are present during installation.
Routine, and worth reading the release notes rather than the version number, because a patch release that lists three known issues, two of them labelled regressions, is telling you something useful about upgrade risk. This is the October bugfix release after the 9.4.7 security release of 28 September.
Update, December 2022: Drupal 9.4.9, a further 9.4.x bugfix release, followed on 7 December 2022.
Supply chain, CI/CD and IaC
Sections- critical npm
A campaign runs 199 malicious npm packages for over a year — thehackernews.com
Reported 7 October 2022: a group tracked as LofyGang distributed roughly 199 malicious npm packages over more than a year, accumulating thousands of installations, to steal credit card data, Discord credentials and gaming and streaming account details. The tradecraft is what makes it notable rather than the payload: packages were spread across sock-puppet accounts so no single profile revealed the campaign's scope.
The account-spreading is the part that defeats the obvious defence. Checking a publisher's other packages is a reasonable heuristic and it fails completely against a campaign that never puts two packages on one account — so typosquat detection has to work on names and content rather than on publisher reputation. For a practical control, this is an argument for an allow-list or a vetted internal mirror on anything that reaches a build, rather than reviewing packages individually at install time.
- fyi Sigstore
Sigstore reaches general availability with an uptime commitment — openssf.org
Sigstore declared general availability at SigstoreCon on 25 October 2022, putting the keyless signing stack under a production commitment rather than best-effort — Fulcio issuing short-lived certificates tied to OIDC identity, and Rekor providing the append-only transparency log. The community committed to a 99.5 per cent uptime service level objective with round-the-clock pager duty, backed by Google, Red Hat, GitHub and others. GitHub published its own post the same day.
The uptime commitment is what makes this adoptable rather than interesting. Keyless signing depends on a live service at publish time, so "best effort" was a real objection for anyone putting it in a release pipeline — and a stated SLO with paged support answers it. It is also the infrastructure the npm provenance RFC, opened in August 2022, proposes to build on.
- fyi GitHub
Secret scanning custom-pattern dry runs leave preview — github.blog
On 5 October 2022 GitHub Advanced Security made dry runs generally available for secret-scanning custom patterns. The post says secret scanning can already detect more than 180 secret types, and that dry runs let an organisation test a custom pattern across repositories before publishing alerts.
This is worth noting as a cumulative trend rather than an event: across 2022 secret scanning went from detection to push prevention in April, extended to public issues for PyPI tokens in August, and kept widening its pattern coverage. The useful question is not whether GitHub scans for your provider's tokens but whether anyone acts on an alert — a detection nobody triages is the same failure mode Medibank's alert pipeline demonstrated this month.
Languages, runtimes and frameworks
Sections- notable Python
Python 3.11 makes a runtime upgrade a performance intervention — python.org
Released 24 October 2022. Python 3.11 is between 10 and 60 per cent faster than 3.10, averaging 1.22 times on the standard benchmark suite, from the Faster CPython work — a rare case where a runtime upgrade is itself a performance intervention rather than a prerequisite for one. It also added exception groups and the except-star syntax, tomllib for TOML parsing in the standard library, and fine-grained error locations in tracebacks. Its end of life is October 2027.
This is the upgrade to argue for on cost rather than on support, which is an unusual position: a 1.22x average speedup on the same hardware is a capacity argument a finance conversation understands, where "the old version goes out of support in 2027" is not. The fine-grained tracebacks are the quieter win — pointing at the exact expression rather than the line materially shortens debugging on generated or chained code.
- notable Node.js
Three Node lifecycle events land in eight days — nodejs.org
Node 19 was released on 18 October 2022 on V8 10.7, with KeepAlive enabled by default for HTTP and HTTPS, experimental watch mode and a stable WebCrypto API except for the Ed and X curve algorithms. Node 16 entered maintenance the same day. Node 18 became LTS on 25 October. Three lifecycle transitions inside eight days.
Node 18 becoming LTS is the one to act on: that is the version to standardise on, and Node 19 is an odd-numbered line whose end of life the project's schedule sets for 1 June 2023 — the same trap as Node 17. The quieter change is KeepAlive on by default in 19, which alters connection reuse behaviour between your application and anything it calls, so a service that relied on connections closing will behave differently. Note also that WebCrypto going stable arrives one month after September's weak-randomness advisory in the same API.
- notable PHP
PHP ships October security releases across supported branches — php.net
PHP published security releases during October 2022 across its supported branches, on its usual monthly cadence.
Routine patching. Worth noting the year's shape while you are here: PHP had coordinated all-branch security days in February and June, an 8.1-only release in July, two separate batches in September, and this. A process that assumes one security release per month, applied uniformly across branches, has been wrong in at least three different ways during 2022 — read which branches moved rather than assuming.
Static site and web tooling
Sections- notable Next.js
Next.js 13 renames the image component and changes every image's HTML — nextjs.org
Released 25 October 2022 at Next.js Conf. The headline is the app directory in beta with layouts, React Server Components and streaming, plus Turbopack in alpha as a Rust Webpack replacement. The breaking list is where the value sits: the old image component was renamed to a legacy path and the previously experimental one took the primary name, so an unmodified upgrade changes the HTML every image emits, with a codemod provided. The link component now always renders an anchor element and its child can no longer be one. Internet Explorer support was dropped.
Run the codemod rather than upgrading and hoping — the image rename means markup changes site-wide, so any CSS selector, snapshot test or HTML post-processing step keyed on the old structure breaks. The link change is the one that surprises people, because the previous idiom of wrapping an anchor in a link component is now wrong rather than merely unnecessary. Treat the app directory as beta and unrelated to the upgrade decision.
- notable Jekyll
Jekyll 4.3 finally bundles webrick and pulls in a Sass major — jekyllrb.com
Released 20 October 2022. It lists webrick as a dependency for Ruby 3.0 and later, removing the manual step that had annoyed every Ruby 3 Jekyll user since early 2022. It gained Rouge v4 compatibility while keeping v3.x support, tzinfo v2 with non-half-hour offset support, and jekyll-sass-converter v3 compatibility. It also raised the kramdown minimum to v2.3.1 for security.
The Sass converter major is the output change to check: a new Sass implementation usually alters generated CSS, so diff your compiled stylesheets rather than trusting the build. The webrick fix is the one that makes this worth taking promptly — it removes a setup step that every new developer on a Ruby 3 machine hit and nobody documented, which is a small but real onboarding cost.
- notable Hugo
A Hugo defect from June is fixed sixteen weeks and four minors later — discourse.gohugo.io
Hugo 0.104.3, released 4 October 2022, has an announcement that is unusually careful about provenance: it states that none of its fixes are regressions from the 0.104 line, and that the animated GIF fix comes from 0.101 — where support for processing animated GIFs was first added on 16 June 2022. So the defect ran for roughly sixteen weeks across four minor versions before being fixed here.
A longer tail than the more visible static-directory regression from September, and a harder one to notice because the symptom was in processed image output rather than in build time. If you process animated GIFs through Hugo, anything generated between mid-June and early October is suspect and worth regenerating. The transferable point is that a project which states the origin release of each fix is giving you something valuable — most do not, and without it you cannot tell how long you were exposed.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more