Radar · 2022-11
November 2022
OpenAI puts a conversational language model in front of the general public on 30 November and every acceptable-use question about staff feeding client data to a hosted model starts here, OpenSSL's pre-announced critical arrives downgraded to high and affects only the 3.0 branch most fleets were not yet running, Citrix ADC takes unauthorised access to Gateway user capabilities, the Medibank attackers publish stolen records on the dark web from 9 November while the Bill lifting privacy penalties to fifty million dollars passes both Houses, and PHP 7.4 dies two days after 8.0 drops to security fixes only.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- notable OpenAI
ChatGPT ships as a free research preview — openai.com
OpenAI released ChatGPT on 30 November 2022 at chat.openai.com, framed on its own launch post as a sibling model to InstructGPT trained with the same reinforcement learning from human feedback method that had gone into the API defaults in January. The post itself listed its limitations: plausible-sounding but incorrect answers, sensitivity to small changes in phrasing, excessive verbosity and a tendency to guess at intent rather than ask a clarifying question. It also conceded that the safety filter produced both false positives and false negatives.
This launch puts a large language model in front of consumers for free, not only developers using an API. The likely consequences for an Australian web team are traffic and governance rather than model quality: AI-generated copy arriving in CMS workflows, new bot patterns and unsanctioned staff use of a US-hosted service with client content pasted into it. If you have no written position on staff use of hosted models, this launch is the reason you need one, and the launch post's own limitations list is the most credible source to quote in it.
- fyi OpenAI
The DALL-E API opens to developers — openai.com
OpenAI put the DALL-E API into public beta on 3 November 2022, alongside GPT-3, Embeddings and Codex on the same platform. The announcement reported more than three million people using DALL-E and over four million images generated a day, roughly double the September figure five weeks earlier. Built-in moderation covered hate symbols and gore. Named launch integrations were Microsoft Designer and Image Creator in Bing and Edge, CALA for fashion ideation and Mixtiles for personalised artwork.
This is the month "add image generation to the CMS" became a normal feature request rather than a research project. If you are scoping it, plan for the gap between what the API filters block and what your client considers publishable — the filters cover hate symbols and gore, not off-brand or factually misleading imagery. Decide up front who reviews a generated image before it goes live, and whether the prompt is retained with the asset, because that record is what makes the decision auditable later.
- fyi AWS
SageMaker gets Model Cards, a model dashboard and generated IAM policies — aws.amazon.com
AWS released three governance tools for SageMaker on 30 November 2022 — the same day as ChatGPT, which is instructive on its own. Role Manager generates custom IAM policies for machine learning activities from a stated set of needs. Model Cards create centralised lifecycle documentation for a model, covering intended purpose and performance goals with training details populated automatically. Model Dashboard gives unified monitoring with deviation detection and alerts. All three shipped in every region where SageMaker runs except China.
Model Cards map onto what the NIST AI Risk Management Framework's Govern and Map functions ask you to be able to produce, so use them as the artefact rather than inventing a spreadsheet. The coincidence of dates is the part worth remembering: the managed-cloud answer to AI risk in November 2022 was documentation and IAM aimed at traditional models, published the same day the risk moved to a public chat box. Review any policy Role Manager generates against least privilege before it goes near a production account.
Security and edge
Sections- critical Citrix
Citrix ADC and Gateway take an authentication bypass rated 9.8 — nvd.nist.gov
CVE-2022-27510, published 8 November 2022, is unauthorised access to Gateway user capabilities in Citrix ADC and Citrix Gateway — an authentication bypass reachable when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN or RDP Proxy). CVSS v3.1 base 9.8, assigned by Citrix as CNA. Citrix's fixed builds are Citrix ADC and Citrix Gateway 13.1-33.47, 13.0-88.12 and 12.1-65.21, plus Citrix ADC 12.1-FIPS and 12.1-NDcPP 12.1-55.289.
Patch to the specific build number rather than the branch, because "we are on 13.0" tells you nothing here. Then check whether the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN or RDP Proxy), since that is the precondition for this one. If you inherited a Citrix estate with a client engagement, settle in writing who owns its firmware.
Update, December 2022: On 13 December 2022 Citrix disclosed CVE-2022-27518, unauthenticated remote code execution on ADC and Gateway configured as a SAML SP or IdP, with exploitation reported in the wild.
- critical Chrome
The eighth exploited Chrome zero-day of the year — bleepingcomputer.com
CVE-2022-4135, a heap buffer overflow in GPU, was patched out of cycle on 25 November 2022 in 107.0.5304.121 and .122 for Windows and .122 for Mac and Linux, with Google already observing exploitation. It is the eighth actively exploited Chrome zero-day of 2022, after CVE-2022-0609 in February, CVE-2022-1096 in March, CVE-2022-1364 in April, CVE-2022-2294 in July, CVE-2022-2856 in August, CVE-2022-3075 in September and CVE-2022-3723 in October.
Use the eight-zero-day count rather than any single CVE when arguing for browser patch automation — eight since mid-February, and no manual approval process keeps pace with that. GPU-process bugs are worth flagging separately because disabling hardware acceleration is a real, if unpopular, interim mitigation on high-risk administrator workstations.
Update, December 2022: On 2 December 2022 Google patched CVE-2022-4262, the ninth Chrome zero-day exploited in the wild that year.
- critical TLS
TrustCor loses trust as e-Tugra's exposed systems come to light — bugzilla.mozilla.org
On 8 November 2022 researchers raised TrustCor's ownership and its links to a spyware operation on Mozilla's dev-security-policy list, and Mozilla set out its intended response. Bug 1803453 then set both the TLS and S/MIME distrust-after dates for the three TrustCor roots to 30 November 2022. Nine days after that thread opened, on 17 November, a separate disclosure showed e-Tugra's administrative systems were reachable with default passwords, exposing subscriber personal information and validation material.
Distrust-after is a dated cut rather than a revocation: certificates issued before 30 November 2022 keep validating and anything issued after does not, so the work is an inventory pass rather than an emergency. Find any certificate chaining to a TrustCor root, check its issuance date and treat TrustCor as unusable for new issuance from here. e-Tugra's roots remain trusted for now, so note any certificates that chain to them and watch the root-store process. The wider lesson for a hosting platform is where the decision arrived — a mailing list thread and a bug tracker, not a vendor announcement — which is why the root-store process is worth reading directly.
Update, December 2022: NSS 3.86, released 8 December 2022, shipped the TLS and S/MIME distrust-after dates for the three TrustCor roots.
Update, July 2023: On 11 July 2023 Mozilla decided to remove the e-Tugra root certificates, finding the risk of keeping them outweighed the benefits to users. NSS 3.92, released on 27 July, removed the E-Tugra Certification Authority root and the E-Tugra Global Root CA ECC v3 and RSA v3 roots.
- notable OpenSSL
The pre-announced OpenSSL critical arrives as two highs on one branch — openssl-library.org
OpenSSL pre-announced a CRITICAL fix on 25 October and the industry spent a week preparing for a Heartbleed repeat. On release on 1 November 2022 the project rated both issues HIGH. CVE-2022-3602 is a four-byte stack overflow with attacker-controlled bytes in a malicious email address during X.509 name constraint checking, with a path to code execution in principle. CVE-2022-3786 overflows an arbitrary number of bytes in the same code path, but every byte is a full stop, making it denial of service. Both affect OpenSSL 3.0.0 through 3.0.6 only — 1.1.1 and 1.0.2 are untouched — and both are fixed in 3.0.7. Exploitation needs a CA to sign a malicious certificate or a verifier that continues after path construction fails, and no working code-execution exploit was identified at release.
The useful question was never "are we patched" but "are we even on 3.0.x", and most fleets in 2022 were still on 1.1.1 and never exposed. Inventory first, then move 3.0.x to 3.0.7. Keep this one as the post-mortem exhibit for handling a vendor pre-announcement with no CVE attached: the correct response was to prepare a patch path and wait, not to declare an incident. Note also that OpenSSL's qualitative rating and the later quantitative CVSS scores do not agree, so cite the project's advisory rather than a score.
Standards and compliance
Sections- notable Privacy
The Medibank records are published on the dark web from 9 November — oaic.gov.au
The OAIC's pleaded timeline for the proceedings records the threat actor publishing stolen data on the dark web from 9 November 2022 through to 1 December 2022. That was the same fortnight the penalty Bill was before the Senate.
The OAIC timeline is the concrete case for treating bulk-export paths as a different engineering problem from authentication alone: the credentials in use were a synced admin login, and the later signal was volume. For a vendor serving health, community services or education clients that means segregation and encryption of sensitive collections, tight control of bulk export, and alerting on volume anomalies rather than only on authentication anomalies.
- notable Privacy Act
The privacy penalties Bill clears both Houses in five weeks — aph.gov.au
The Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 passed both Houses on 28 November 2022 after Senate third reading, having been introduced on 26 October and passed by the House on 9 November. Five weeks from introduction to passage, part-way through the Medibank publication window. It lifts the maximum penalty for serious or repeated interference with privacy from $2.22 million to the greater of fifty million dollars, three times the benefit obtained or, where a court cannot determine that benefit, thirty per cent of adjusted turnover in the relevant period, and expands the Information Commissioner's information-gathering and enforcement powers.
A turnover-based penalty changes who has to care. $2.22 million was a cost of doing business for a large entity and thirty per cent of adjusted turnover is not, so expect the security schedule in your client contracts to be renegotiated in 2023 with liability caps that no longer look adequate. For a platform supplier the practical preparation is evidence: be able to show what a given collection holds, who could reach it and what was actually accessed, because that is what your client will need to produce and they will need it from you.
- fyi ASD
Two annual reports say fewer incidents, much larger ones and hours to exploit — cyber.gov.au
ASD launched the ACSC Annual Cyber Threat Report for July 2021 to June 2022 on 4 November 2022. ReportCyber took over 76,000 cybercrime reports, up nearly 13 per cent, more than 24,000 new CVEs were identified, up 25 per cent, and the report records scanning within hours of public disclosure of critical vulnerabilities and exploits that can be deployed within hours of a patch release or technical write-up, calling the rapid use of new critical vulnerabilities standard tradecraft. Six days later the OAIC published its Notifiable Data Breaches Report for January to June 2022: 396 notifications, down 14 per cent, of which 250 were malicious or criminal attack and 131 human error. The count fell but the scale rose — 24 breaches affected 5,000 or more people against 18 in the prior half and four affected 100,000 or more against one — and only 71 per cent of entities notified within 30 days.
Read together, these two are the argument for pre-agreed emergency patch windows in managed service contracts instead of monthly maintenance cycles, because hours-to-exploit is a service level question and not a security awareness one. Where the vendor holds the logs, the 30-day assessment clock under section 26WH runs on your evidence, so your ability to produce a scoped, evidenced account of what was accessed is part of your client's statutory compliance rather than a courtesy.
CMS and platforms
Sections- notable WordPress
WordPress 6.1 consolidates the site editor, then 6.1.1 fixes fifty things — wordpress.org
WordPress 6.1 "Misha" shipped on 1 November 2022, the third major release of the year, credited to over 800 contributors from more than 60 countries with nearly 60 accessibility updates and more than 25 performance tickets. It is a consolidation release rather than a feature landgrab: the new default theme Twenty Twenty-Three ships ten style variations and is tagged Accessibility Ready, site editor settings persist across browsers and devices, fluid typography arrives for responsive text scaling, and container blocks gain content-only editing plus one-click inner-block locking. WordPress 6.1.1 followed on 15 November with 29 Core and 21 block-editor fixes.
The accessibility work is the part that matters for Australian government sites under the Digital Service Standard, but "core is accessible" does not carry through to a bespoke block theme — plan 6.1 adoption with a re-test rather than an assumption. Check custom blocks against content-only editing and inner-block locking before you enable either for editors. For an estate that holds majors back a fortnight, 6.1.1 is the defensible adoption point.
- notable Drupal
Drupal 10 and 9.5 reach release candidate, the last cheap month to find a blocker — drupal.org
The release candidate phase for Drupal 10.0.x and 9.5.x opened in the week of 14 November 2022, with 10.0.0-rc1 and 9.5.0-rc1 both created on 16 November, the last gate before a release targeted for 14 or 15 December. By November the Drupal 10 dependency set was final and testable — PHP 8.1, Symfony 6.2, Twig 3 and CKEditor 5, with Claro as the core admin theme and Bartik, Seven, Classy and Stable removed from core.
This was the last month an Australian government estate could discover a Drupal 10 blocker cheaply. The release candidate is the right artefact to test against because the API surface is frozen: a contributed module or custom theme that fails against 10.0.0-rc will fail against 10.0.0. Agencies that waited for the December stable release gave up that month for nothing, and with Drupal 9 end of life set for November 2023 the schedule had no slack left to return.
Supply chain, CI/CD and IaC
Sections- critical PyPI
A PyPI package hides its payload in the pixels of an image — thehackernews.com
A package called
apicolor, presented as a core library for REST API work and reported on 10 November 2022, declared a dependency onjudyb, a legitimate steganography library. At install time it downloaded a PNG hosted on a mainstream image host and usedjudybto extract obfuscated Python concealed in the pixel data, which then retrieved and executed a binary from a remote server. The package had been uploaded on 31 October. The technique matters because every component looks innocuous in isolation: the dependency is a real library, the network call fetches an image, and there is no suspicious string in the package source.Treat static review of package source as insufficient. For anything installed into a build, the signals worth watching are outbound network calls at install and import time, and a utility package pulling in a steganography or image-processing dependency it has no reason to need. On a practical level this is the argument for building in a network-restricted step and for pinning with hashes, because a dependency that only misbehaves at install time never shows up in a code review.
- notable CISA
The Enduring Security Framework finishes its series with the customer's guide — cisa.gov
CISA, the NSA and ODNI published the third and final part of the Enduring Security Framework's "Securing the Software Supply Chain" series on 17 November 2022, this one aimed at the organisations buying and running software rather than writing it. It covers procurement, acceptance testing, deployment and patching, and puts concrete expectations on software bills of materials: asking for one, validating it and acting on what it shows. The series ran developers in August, suppliers in October and customers in November, so by year end there was a single branded reference covering all three sides of the chain.
If you supply software to Australian government or critical infrastructure buyers, read the customer's guide as a preview of your future procurement questionnaire and start producing an SBOM per release now rather than when it is asked for. If you are on the consuming side, the guidance is only useful once something enforces it — turn on dependency review in pull requests before you argue about SBOM formats.
- notable GitHub
Dependency review goes generally available with scope-aware enforcement — github.blog
The dependency review API reached general availability on 14 November 2022, exposing the dependency diff of a pull request programmatically so a merge can be gated on what a change actually adds rather than on a periodic scan. The enforcement changes shipped alongside are the practically useful part. The action gained support for local or external configuration files so policy lives in one place instead of being duplicated across workflows. The
fail-on-scopesoption fails on runtime dependencies while tolerating development and unknown ones. Theallow-ghsasoption skips specific advisory IDs with an audit trail, and licence and vulnerability checks can now be toggled independently.Turn dependency review on with
fail-on-scopesset to runtime, keep the configuration in a shared external file and useallow-ghsasfor advisories you have consciously accepted. The distinction between a gate teams keep and a gate teams quietly disable is almost always noise on development-only dependencies and licence findings, which is exactly what these three options separate — never switch the whole check off to get a release out.
Languages, runtimes and frameworks
Sections- critical PHP
PHP 7.4 reaches end of life two days after 8.0 goes security-only — php.net
PHP 8.0.26 on 26 November 2022 is the final bug-fix release on the 8.0 line, which from that date gets security fixes only for one further year. Two days later, on 28 November 2022, PHP 7.4 reached end of life with 7.4.33 as its last release, taking the entire PHP 7 series out of support — 7.3 ended in December 2021, 7.2 in November 2020, 7.1 in December 2019 and 7.0 in January 2019. Both dates come from php.net's own lifecycle pages.
This is the largest lifecycle event of 2022 for anyone hosting PHP, and the exposure is not the language but the CMS estate: large WordPress, Drupal 7 and legacy Laravel installations sat on 7.4 well past this date, and any PHP-level vulnerability disclosed after 28 November has no upstream fix for them. Audit for 7.4 workloads now. If you deferred the migration, note that 8.0 was already security-only by the time 7.4 died, so 8.1 is the correct target and 8.0 is a wasted step. Treat any vendor extended-support offering as a commercial arrangement rather than an upstream fix.
- notable Node.js
Node patches the OpenSSL pair on two lines and a rebinding bypass on all four — nodejs.org
Node released v14.21.1, v16.18.1, v18.12.1 and v19.0.1 on 4 November 2022, announced the day before. CVE-2022-3602 and CVE-2022-3786, the OpenSSL X.509 overruns, are High in Node's own rating and affect only 18.x and 19.x, because those are the lines carrying OpenSSL 3.0 — 14.x and 16.x on 1.1.1 are untouched. CVE-2022-43548, rated medium, affects all four lines: the
--inspectDNS rebinding protection accepted invalid octal addresses such as 1.09.0.0 that browsers still resolve, giving a path to arbitrary code execution against an active inspector session.Do not let the industry-wide OpenSSL alarm drive an emergency change on 14.x or 16.x, because they were never exposed to that pair — this is the clearest case all year for inventorying before scheduling. Do patch every line for the rebinding issue, and check that
--inspectis not reachable in any deployed environment, since an exposed inspector is remote code execution regardless of this particular bypass. - notable Ruby
Response splitting in the cgi gem, and Symfony 6.2 sets Drupal 10's support floor — ruby-lang.org
Ruby disclosed CVE-2021-33621 on 22 November 2022: HTTP response splitting in the cgi gem, with fixed gem versions 0.3.5, 0.2.2 and 0.1.0.2. Ruby 3.1.3, 3.0.5 and 2.7.7 followed on 24 November. Symfony 6.2.0 shipped on 30 November with support running only to July 2023, and it is the Symfony version Drupal 10 is built on ahead of its December release. Go 1.18.8 and 1.19.3 on 1 November are security releases covering
os/execandsyscall, and Rust 1.65.0 on 3 November added generic associated types andlet-else.Response splitting is reachable through any CGI-derived header handling that takes untrusted input, so patch the cgi gem rather than defer it to a quarterly window. The Symfony date is the one worth writing down: a site going live on Drupal 10 in early 2023 is running a Symfony minor whose support ends in July 2023, so budget Drupal 10 minor updates as routine maintenance rather than occasional projects.
Static site and web tooling
Sections- notable Nuxt
Nuxt 3.0.0 stable, with compatibility guarantees that finally make it supportable — nuxt.com
Nuxt 3.0.0 shipped on 16 November 2022, the first stable release of the rewrite, built on Vite, Vue 3 and Nitro with first-class TypeScript support and more than 50 supported modules on Nuxt Kit. The announcement makes explicit backward-compatibility guarantees for composables, filesystem conventions and configuration, which is the commitment that matters. The post stays high-level and defers migration detail to the documentation, so do not expect a breaking-change list in it.
November 2022 is the earliest defensible date for supporting Nuxt 3 in production, and quoting the compatibility guarantee is how you justify that to a client who was told to wait. For existing Nuxt 2 projects the path is Nuxt Bridge first, and there is no forced migration here.
- notable Hugo
Hugo's docs site builds about 20 per cent faster, alongside a Chroma minor — github.com
Hugo 0.107.0 landed on 24 November 2022. It is a performance release — it removed a bottleneck in code highlighting by caching lexer retrieval, making Hugo's own documentation site build around 20 per cent faster — and, separately in the same release, upgrades Chroma, the syntax highlighting library, to v2.4.0. It also fixed shortcode boolean parameter parsing and made
hugo new sitegenerate an assets directory.A highlighting library emits the class names your stylesheet targets, so a Chroma minor is a plausible source of visual change in code blocks even though the release documents no breaking change. After 0.107.0, eyeball a highlighted code block against your theme's CSS before you ship. The general lesson is worth keeping: a performance win delivered by a dependency bump is a visual regression risk, and the release notes will not say so.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more