Radar 2023

December 2023

The Australian hosting code becomes a live enforceable obligation for anyone hosting Australian end-user content, a phished former employee's npm account is used to publish a wallet drainer that every consuming site serves without redeploying anything, WordPress patches a remote code execution that core alone cannot trigger but a plugin can complete, Home Affairs opens a summer consultation on cyber legislative reforms, and Bedrock closes the year in five regions, none of them Australian.

November 2023

Optus loses its entire fixed and mobile network nationally to bad route data from a peer, DP World disconnects from the internet to contain an intrusion and stalls 40 per cent of Australian container trade for three days, Drupal 9 reaches end of life with no further releases ever, ASD revises the Essential Eight maturity model that every Australian assurance conversation is written against, and OpenAI and Anthropic move the context ceiling to 128K and 200K within a fortnight of each other.

October 2023

A design flaw in HTTP/2 lets an attacker cancel streams faster than a server can free them, Citrix Bleed leaves stolen session tokens valid after the patch, WCAG 2.2 becomes a Recommendation with nine new success criteria, WordPress 6.3.2 ships eight security fixes and backports them as far as version 4.1, and Next.js 14 and Docusaurus 3.0 both land breaking changes in the same week.

September 2023

Chrome ships an in-the-wild heap overflow in WebP, an unauthenticated remote code execution in Craft CMS scores a straight 10.0, Drupal's JSON:API module can cache error backtraces for anonymous users, Node 16 reaches end of life on 11 September 2023, and Amazon Bedrock reaches general availability in two US regions and no others.

August 2023

The FBI tells Barracuda customers the patches did not work and the appliances should be replaced, four medium-severity Juniper flaws compose into an unauthenticated 9.8 on SRX firewalls and EX switches, HashiCorp relicenses Terraform under BUSL and is forked within a fortnight, the SOCI risk management obligation switches on so a CIRMP must consider listing major suppliers, and PHP's August security releases include a PHAR buffer bug and an XXE that another library in the same process can switch on.

July 2023

Citrix NetScaler appliances are compromised through an unauthenticated flaw before the patch exists and stay compromised after it, Ivanti's mobile management zero-days are chained against a dozen Norwegian government ministries, a WordPress payments plugin patched in March is mass-exploited in July at 1.3 million attacks against 157,000 sites, OpenAI sets a retirement date for the model string half the early CMS integrations hardcoded and APRA finalises the standard that turns hosting vendors into material service providers.

June 2023

Cl0p turns MOVEit into the year's defining data-theft campaign while Progress discloses two more SQL injections, a pre-authentication overflow reaches every FortiGate SSL-VPN appliance even with multi-factor authentication enabled, a double slash walks past Vite's dev-server file restriction and reads .env, Drupal 7 finally gets an end-of-life date and eSafety accepts an industry code that reaches Australian hosting providers directly.

May 2023

A SQL injection in MOVEit Transfer is mass-exploited over the US Memorial Day weekend before any patch exists, Barracuda email gateways turn out to have been compromised since October and cannot be patched back to trustworthy, WordPress needs two security releases in four days, Go patches html/template for a second consecutive month and Claude's context window jumps from 9K to 100K tokens.

April 2023

A Chrome V8 type confusion is exploited in the wild, PaperCut print servers are hijacked through an authentication bypass, Go's html/template starts refusing actions inside JavaScript template literals, SvelteKit's CSRF protection is bypassed twice in three days, the first PSPF Direction restricts TikTok on government devices and npm packages gain cryptographic proof of where they were built.

March 2023

A signed 3CX desktop client is trojanised in a supply-chain attack and reaches hundreds of thousands of organisations, an unauthenticated flaw in WooCommerce Payments hands over administrator access on 500,000 sites, Apache httpd patches request splitting through mod_rewrite, GPT-4 ships and the OAIC opens inquiries into the Latitude Financial breach.

February 2023

The Privacy Act Review Report lands with 116 proposals, new SOCI rules make Essential Eight Maturity Level One a legal floor for critical infrastructure, ESXiArgs ransomware encrypts thousands of exposed hypervisors through a two-year-old flaw, OpenSSL patches eight CVEs led by a type confusion in certificate validation and Node.js, PHP and Go all ship security releases in the same week.

January 2023

An info-stealer on an engineer's laptop turns into a CircleCI breach that puts every secret in every project at risk, a Linux backdoor mass-exploits thirty known WordPress plugin flaws, PHP patches a critical SQL injection in PDO::quote(), GitHub revokes code-signing certificates that permanently break already-shipped builds and NIST publishes the AI Risk Management Framework.