Radar · 2022-12
December 2022
Drupal 10 ships with hard floors on PHP, a database version and a CKEditor migration that has to be done by hand, starting an eleven-month clock on Drupal 9, the privacy penalty rises from two million dollars to the greater of fifty million or thirty per cent of turnover and applies to investigations already open, Fortinet takes a second emergency in three months where the implanted libraries survive the patch, an attacker claims a name PyTorch's own nightly builds resolve ahead of their private index, and PHP 8.2 arrives ten days after 7.4 dies with the deprecation that decides whether legacy code can move at all.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- fyi Anthropic
Constitutional AI sets out training a harmless assistant without human harm labels — arxiv.org
Anthropic published the Constitutional AI paper on 15 December 2022, a 51-author work describing how to train a harmless assistant with no human labels identifying harmful outputs. The method runs in two phases: a supervised stage in which the model samples its own outputs, critiques them against a written set of principles and revises them, then trains on the revisions; and a reinforcement learning stage the authors call RLAIF, where a model evaluates response pairs to train the preference model used as the reward signal. The claimed result is an assistant that is harmless without being evasive, engaging with a harmful query by explaining its objection rather than refusing flatly.
Two uses. If a client is evaluating model suppliers, this is the readable primary source for why two vendors' models refuse differently, which is more useful than arguing about which one is "too restrictive". More practically, the self-critique-and-revise loop is a pattern you can apply directly in application code to lift output quality without a second model licence — generate, critique against written criteria, revise, then return the revision.
- fyi OpenAI
Embeddings get 99.8 per cent cheaper and retrieval becomes the obvious pattern — openai.com
OpenAI consolidated five embedding models into one on 15 December 2022, reporting that text-embedding-ada-002 achieves better or similar performance to the old Davinci embedding models at a price 99.8 per cent lower than davinci-001. Context length went from 2,048 to 8,192 tokens and the embedding dimension dropped to 1,536, one eighth of the model it replaced, which cuts vector storage and search cost in proportion. Named users included one matching pitches across 340 million profiles and another improving search beyond keyword matching.
For any Australian client weighing semantic search across their own content, this is the release that changed the business case, because a full re-index stopped being a capital decision. The trap to design around now rather than later is that embeddings from different models are not comparable, so a model change means re-embedding the entire corpus — store the model name and version alongside every vector so that a future migration is mechanical rather than archaeological.
- fyi AWS
Custom language models reach German and Japanese in Transcribe — aws.amazon.com
Amazon Transcribe extended Custom Language Models to German and Japanese on 7 December 2022, across both batch and streaming transcription and in every region where Transcribe runs. The feature trains a domain-adapted speech model on the customer's own text, aimed at legal, financial and scientific vocabularies where generic speech recognition mishandles specialist terms.
The transferable point for Australian work is the mechanism rather than the languages: a custom language model is the supported way to fix domain vocabulary — place names, statute references, drug names, agency acronyms — instead of running find-and-replace over the transcript afterwards. If a client rejected transcription on accuracy grounds, check whether anyone tried a custom language model before the approach was written off.
Security and edge
Sections- critical Fortinet
Pre-authentication code execution on the SSL-VPN, with implants that survive the patch — bleepingcomputer.com
CVE-2022-42475 is a heap-based buffer overflow in the FortiOS and FortiProxy SSL-VPN implementation allowing an unauthenticated remote attacker to execute code via crafted requests — CVSS 9.8, assigned by Fortinet, reported as exploited when disclosed on 12 December 2022. Fixed in FortiOS 7.2.3, 7.0.9, 6.4.11 and 6.2.12 and the corresponding 6K7K builds. Fortinet published concrete indicators with it: sslvpnd crash logs reading "Signal 11 received", a set of implanted shared objects under /data/lib including libips.bak and libgif.so, a modified /data/etc/wxd.conf and four attacker addresses. Note the NVD record for it was not published until 2 January 2023, so a January-dated vulnerability feed misdates this by three weeks.
Patch on the emergency path, then actually run the indicator hunt, because a backdoored shared object means patching alone does not evict the attacker — this is the second Fortinet edge emergency in three months and the implant list points to a capable actor rather than opportunistic scanning. The structural lesson for 2023 planning is that the VPN concentrator is a single point of total compromise: pair it with multi-factor authentication, restrict the portal by source address where the client's workforce allows it, and keep firmware within one release of current so an emergency change is small.
- critical Citrix
Unauthenticated code execution on Citrix ADC when it is a SAML provider — nvd.nist.gov
CVE-2022-27518, published 13 December 2022, is unauthenticated remote code execution in Citrix ADC and Citrix Gateway — CVSS 9.8, assigned by Citrix, recorded as exploited and listed in the US known exploited vulnerabilities catalogue. It affects the 12.1 and 13.0 lines with fixes at 12.1-65.25 and 13.0-58.32. Citrix's bulletin and 13 December blog state the precondition: the appliance must be configured as a SAML service provider or identity provider. Version 13.1 is not affected.
Check the SAML configuration, not just the version, because an appliance that is not acting as a SAML service provider or identity provider was not exposed to this one and knowing which category you are in is the difference between an emergency and a scheduled change. Then note that this is the same product line as November's CVE-2022-27510 and the December fix builds are different — patching last month does not cover you. Public attribution to a state-aligned actor came from the vendor and government reporting rather than the vulnerability record, so cite it carefully in client briefings.
- critical Chrome
The ninth exploited Chrome zero-day closes the year, and four of them were V8 — bleepingcomputer.com
CVE-2022-4262, a type confusion in V8 reported by Google's Threat Analysis Group, was patched out of cycle on 2 December 2022 in 108.0.5359.94 and .95 for Windows, Mac and Linux, with an exploit already in the wild. It is the ninth actively exploited Chrome zero-day of 2022 and it arrived one week after the eighth. It is also the fourth in-the-wild V8 type confusion of the year, which makes V8 the most attacked component in the browser across 2022, and Threat Analysis Group involvement again points at targeted or commercial-spyware use rather than mass exploitation.
Close the year by measuring rather than patching. Take the nine dates and work out, for each, how long your fleet took to reach the fixed build — that distribution is your real browser exposure window and it is a far better input to 2023 planning than a count of vulnerabilities. If the answer is longer than a week anywhere, the finding is about your update mechanism and not about Chrome.
Standards and compliance
Sections- critical Privacy Act
Fifty million dollars or thirty per cent of turnover, in force from 13 December — legislation.gov.au
The Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022, Act 83 of 2022, received assent on 12 December 2022 and commenced the following day, closing the arc that began with Optus on 22 September. Section 13G now exposes a body corporate committing a serious or repeated interference with privacy to the greater of fifty million dollars, three times the benefit obtained or, where the court cannot determine that benefit, thirty per cent of adjusted turnover during the breach turnover period, against a previous cap of 2.2 million dollars per contravention. The maximum for an individual rose to 2.5 million dollars. A new section 33A lets the Commissioner share information with enforcement bodies and other privacy authorities, the Commissioner's assessment and infringement notice powers were strengthened, and the requirement that a foreign organisation collect or hold information in Australia was removed. The new powers reach matters already on foot — amended section 33C applies to assessments started before commencement and not yet concluded, and section 33A covers information the Commissioner already held — but the raised penalties do not: Schedule 1 item 45(3) provides that amended section 13G does not apply to an act done or practice engaged in before commencement. The OAIC opened its Medibank investigation on 1 December, twelve days before commencement, and that matter stayed under the old cap.
A turnover-based penalty changes the shape of the risk your clients carry, and therefore every indemnity, liability cap and security warranty conversation from here. Expect regulated and government clients to push security schedules, breach-notification timeframes, subprocessor disclosure and audit rights into agreements that previously said little more than industry standard practice, and expect your caps to be tested against a percentage of their revenue. The extraterritorial change matters if you serve Australian users from offshore infrastructure or use offshore subprocessors, because a carve-out based on where data is held no longer helps. The defensible position is documented data minimisation, documented retention and deletion, multi-factor authentication on all privileged access and an incident timeline you can produce quickly — those are the four things both flagship investigations turned on.
- notable ISM
The December 2022 Information Security Manual is the 2023 assessment baseline — cyber.gov.au
ASD published the December 2022 release of the Information Security Manual, which it also issues in machine-readable form as ISM OSCAL v2022.12.1, based on the December 2022 ISM and OSCAL 1.0.4. It is the version in force at the point the new privacy penalties commenced and the point the CIRMP Rules were being finalised, which makes it the natural baseline for assessments and IRAP scoping through the first half of 2023.
If you hold or are pursuing IRAP-assessed status or hosting certification, this is the version your 2023 evidence is expected to be current against. The practical discipline is to pin the version string in every security artefact you hand a client and re-baseline once per release, because "assessed against the ISM" with no date is not an answer a Commonwealth assessor accepts. Diarise the re-baseline against the quarterly cadence rather than waiting for an assessor to ask.
- fyi Cyber strategy
An expert board is appointed and the 2020 strategy is superseded two years in — minister.homeaffairs.gov.au
On 8 December 2022 the Minister for Home Affairs and Cyber Security appointed three expert leads to guide development of the 2023 to 2030 Australian Cyber Security Strategy — Andrew Penn as chair, Air Marshal Mel Hupfeld and Rachael Falk of the Cyber Security Cooperative Research Centre. Five priorities were named: a whole-of-nation effort, resilient critical infrastructure and government systems, sovereign capability, international engagement and capacity building, and growth of the cyber workforce, under a stated goal of Australia becoming the most cyber secure nation by 2030. The 2020 strategy was superseded barely two years into a notionally ten-year life.
Treat 8 December 2022 as the opening date of a new strategy process, so whatever it produces can be read against these five priorities rather than as a surprise. Two priorities carry commercial signal for a platform supplier: resilient critical infrastructure and government systems pointed to further SOCI expansion, and sovereign capability pointed to continued preference for Australian-owned and Australian-operated hosting in Commonwealth procurement.
CMS and platforms
Sections- critical WordPress
A Linux trojan chains thirty known plugin exploits until one works — bleepingcomputer.com
Reported on 30 December 2022, the trojan carries hardcoded exploits for 30 known vulnerabilities in outdated WordPress plugins and themes and runs them in succession against a target until one succeeds. On success it injects JavaScript pulled from command-and-control servers, turning the site into a redirect page feeding phishing, malware distribution and malvertising. Dormant brute-force functionality against administrator credentials was present in the code but not active. No zero-day is involved anywhere in the chain.
This is the closing argument for the year's plugin story — a supply-chain backdoor in January, UpdraftPlus in February, BackupBuddy and WPGateway in September, then commodity tooling in December that industrialises whatever was left unpatched. The control that addresses all of them is the same: an enforced plugin inventory with a maximum patch age and automatic removal of abandoned plugins. Faster incident response does not help against something automated and indiscriminate, and neither does choosing better plugins if nothing enforces the patch age afterwards.
- notable Drupal
Drupal 10.0.0 ships as a hard-requirements release — drupal.org
Drupal 10.0.0 released on 14 December 2022, and the requirements are the story. It needs PHP 8.1 or higher, with 8.1.6 recommended to avoid OPcache defects, and floors of MySQL 5.7.8, MariaDB 10.3.7, PostgreSQL 12 or SQLite 3.26, plus Composer 2.3.6 for PHP 8.2 compatibility. CKEditor moves to 5, and the release notes are explicit that the CKEditor 4 to 5 conversion is a manual process needing human supervision, to be completed on 9.4 or 9.5 before the jump. Symfony goes to 6.2, Twig to 3.4.3, Bartik, Seven, Classy and Stable leave core for contrib, Claro and Olivero become the defaults and Internet Explorer 11 is dropped. Sites on 9.3 or older must step through 9.4.4 first, because the earlier update paths were deleted from the codebase.
For a government or enterprise Drupal estate this is a scheduling artefact rather than a news item, so work backwards from Drupal 9's November 2023 end of life. The binding constraints are PHP 8.1 on the hosting platform, the manual CKEditor content and configuration migration, and any site still depending on a theme that has left core and now needs a contrib project pulled in explicitly. Sites on 9.3 or earlier need the 9.4.4 stepping stone before anything else. Note that Drupal 7's end of life then sat in the same window, so agencies running both faced two migrations converging on one deadline.
- notable Drupal
Drupal 9.5.0 is the last Drupal 9 minor and the designated stepping stone — drupal.org
Drupal 9.5.0 shipped alongside Drupal 10 as the final minor feature release of Drupal 9, supported until November 2023. Its release notes make the migration role plain: 9.5 provides almost the same public API as 10.0 apart from deprecated code and dependency changes, so an existing site should reach 9.5 before attempting 10. It recommends PHP 8.1.6 as the minimum for sites already on 8.1, keeps PHP 8.0 fully supported and notes 7.4 is end of life — but it is not fully compatible with PHP 8.2, so a site needing 8.2 has to go to Drupal 10. It repeats the advice to complete the manual CKEditor 4 to 5 upgrade while still on 9.5.x. No new Drupal-10-targeted deprecations were added in 9.5, so contributed modules could reach 10 compatibility using only 9.4 APIs.
The sequencing is the whole point and it is easy to get wrong: reach 9.5.0, complete CKEditor 4 to 5 on 9.5, resolve contributed module compatibility, then upgrade to 10. The PHP 8.2 gap is the detail to watch, because a hosting platform that moved to 8.2 ahead of the CMS would have stranded its 9.5 sites — which is the argument for planning platform PHP upgrades and CMS upgrades on one schedule rather than by two teams working independently.
Supply chain, CI/CD and IaC
Sections- critical PyPI
An attacker claims the name PyTorch's nightly builds resolve first — bleepingcomputer.com
Between 25 and 30 December 2022 an attacker registered torchtriton on the public index, shadowing a dependency that PyTorch nightly builds fetched from their own package index. Because pip resolves the public index ahead of an extra index URL, anyone installing a nightly in that window got the attacker's package. The payload exfiltrated the IP address, username, working directory, /etc/resolv.conf, /etc/hosts, /etc/passwd, SSH keys, git configuration, bash history and the first 1,000 files in the user's home directory to a domain registered on 21 December. PyTorch renamed the real dependency, registered a dummy package to burn the name and published a detection script keyed to the malicious binary's hash.
Two changes, both cheap. Never use an extra index URL for private or side-channel packages — use an explicit index URL pointing at a proxy that controls resolution order, because the default order is the entire vulnerability here. Then defensively register your internal package names on the public registry so nobody else can claim them. The textbook part of this is that it worked against one of the most widely used projects in the world, which tells you the practice rather than the project was at fault.
- critical PyPI
Twenty-five typosquats across both registries deliver ransomware, not credential theft — thehackernews.com
Reported on 13 December 2022, a coordinated campaign hit both major registries at once. On the Python side, 20 typosquats of requests — dequests, fequests, gequests, reqhests, requesta and the rest — and on the JavaScript side five modules with names imitating chat-bot libraries. The packages fetched a ransomware binary matched to the victim's operating system and architecture, encrypted files, changed the desktop background to an image making a false claim of intelligence-agency involvement and demanded 100 dollars in cryptocurrency. The low ransom points to volume rather than targeted extortion. This is a separate campaign from the dependency confusion two weeks later.
Pin dependencies by exact name and version in a lockfile, and audit existing manifests for near-miss names — a single transposed character in a requirements file on a developer workstation is the whole attack path. Typosquatting the most-installed package on a registry is the highest-yield option available, so treat the exact spelling of your top-level dependencies as something worth checking once, deliberately, rather than assuming it was right when it was written.
- notable npm
npm granular tokens make a leaked publish credential survivable — github.blog
On 6 December 2022 npm shipped granular access tokens. Before this a publish token was effectively an account credential: it could publish anything the account owned, and it never expired. A granular token can be scoped to a specific set of packages or scopes, restricted to an IP range, and must expire, with a maximum lifetime of one year — so a token created years ago and never rotated becomes impossible. The same release made the code explorer free, so anyone can read a package's actual contents in the web interface before installing.
Replace every classic automation token with a granular token scoped to the single package it publishes, set the shortest workable expiry and restrict it to your build provider's address range if that is stable — then diarise the rotation, because these tokens now stop working on purpose. Read against the year's incidents, a token that publishes one package from one address range for at most a year is a materially smaller exposure than an account-wide token with no expiry, and the migration is a configuration change rather than a project.
Languages, runtimes and frameworks
Sections- notable PHP
PHP 8.2 deprecates dynamic properties ten days after 7.4 dies — php.net
PHP 8.2.0 released on 8 December 2022 after a seven-release-candidate train, bringing readonly classes, disjunctive normal form types, a new Random extension, constants in traits and the upgrade hazard: the deprecation of dynamic property creation. Any class that assigns to an undeclared property now emits a deprecation notice, and older CMS and ORM code does this constantly. It is a deprecation rather than an error in 8.2, so the immediate symptom is log volume rather than fatal errors, but it is the change that decides whether a legacy codebase can move. The timing is the other half of the story — 8.2 arrived ten days after PHP 7.4 reached end of life.
Before moving a legacy codebase to 8.2, grep for assignment to undeclared properties and plan to apply the AllowDynamicProperties attribute to the classes you cannot fix quickly. For anything stranded on 7.4, the correct target is 8.1, which was still in full support, rather than the release that shipped last week — the pressure to skip to the newest version is exactly how a migration acquires two problems instead of one. Check the log volume in a staging environment before you agree a deprecation cleanup estimate.
- notable Ruby
Ruby 3.2 lands on Christmas Day with a WebAssembly target and YJIT declared ready — ruby-lang.org
Ruby 3.2.0 released on 25 December 2022, keeping the project's Christmas tradition. It added a WASI-based WebAssembly build target, letting CRuby run in a browser or a WASI runtime, and declared YJIT production-ready after its rewrite in Rust. It also added Data as an immutable value object class and regular expression timeouts, the latter a direct answer to denial of service through catastrophic backtracking.
Set a global regular expression timeout as cheap insurance — it converts a class of denial-of-service defect into an error you can log, and it costs one line. If you have CPU-bound Ruby workloads, YJIT in 3.2 is worth measuring rather than assuming. The WASI target is the item with strategic weight for an edge or CDN platform, because it puts Ruby on the same substrate as edge function runtimes.
- notable Python
Five Python branches ship on one day with shared security content — blog.python.org
On 6 December 2022 the Python Insider blog announced 3.11.1, 3.10.9, 3.9.16, 3.8.16 and 3.7.16 together, "updating is recommended due to security content" (libexpat CVE-2022-43680, IDNA CVE-2022-45061, and others). The three older lines were security-only releases with no binaries.
Patch every Python branch you run. Python's release announcement points to PEP 537 for 3.7 reaching end of life in June 2023, so an old branch here is not automatically an unsupported one.
Static site and web tooling
Sections- notable Vite
Vite 4 changes CSS imports, environment parsing and the build target at once — vite.dev
Vite 4.0 released on 9 December 2022, under five months after Vite 3, which is itself a point about cadence. It moves to Rollup 3, so generated chunk and asset handling can differ even where your configuration does not change. The documented breaking change is that the CSS default export is deprecated: importing CSS as a string now needs the inline query suffix, and without it you get a double load. Underneath, dotenv went from 14 to 16 and dotenv-expand from 5 to 9, so environment values containing a hash or a backtick now need quoting — a silent break that surfaces as a wrong value rather than an error. The default modern build target became safari14, which enables ES2020 features without transpilation and therefore changes emitted bundles.
Three checks before upgrading, in this order. Quote any environment value containing a hash or a backtick, because that failure is silent and looks like an application bug. Grep for CSS imports used as strings and add the inline suffix. Then re-baseline bundle sizes, since the build target change is the kind of thing that alters output without appearing in a diff of your own code.
- notable SvelteKit
SvelteKit 1.0 makes hosting support a question of adapters — svelte.dev
SvelteKit reached 1.0 on 14 December 2022 after what the announcement calls two years in development — and, through 2022, a year of monthly breaking changes with no major releases to announce them. The framework has no dependency on any particular platform: an automatic adapter gives zero-configuration support for a fixed list of hosting providers, with community adapters for other runtimes and a static adapter for static sites and single-page applications. The migration advice is specific — move to the final pre-release, 1.0.0-next.588, before going to 1.0, and read the migration guide if you are on anything older.
The adapter model is the part that matters to a hosting platform: supporting SvelteKit means shipping an adapter rather than supporting a build command, and whichever providers sit in the automatic adapter's default list get chosen without the customer thinking about it. If you host static or hybrid sites, that makes writing or adopting an adapter a commercial decision rather than a developer-experience one. For existing projects, upgrade via 1.0.0-next.588 rather than jumping straight to 1.0.
- notable Next.js
Next.js 13.1 removes the wrapper divs the app directory had been injecting — nextjs.org
Next.js 13.1 released on 22 December 2022, and the item that belongs on a build-output radar is the removal of layout divs: the app directory had been injecting extra div elements to scroll layouts into view on navigation, and 13.1 stops emitting them while keeping the scrolling behaviour. Any CSS rule or test selector written against that structure between 25 October and 22 December breaks. The release also brought transpilePackages into core, replacing a widely used community module, made the edge runtime stable for API routes, added modularizeImports to rewrite barrel-file imports into direct ones, and let middleware return responses without an experimental flag. Next reports the app directory now ships 9.3kB less client-side JavaScript than pages.
If you built against the 13.0 app directory in that eight-week window, re-check every selector and snapshot test that depended on the wrapper divs, because this is exactly the class of silent markup change that passes a build and fails a visual diff. The transpilePackages move is worth doing at the same time — a core option replacing a community module removes a dependency from the critical path of your build.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more