Radar · 2023-01
January 2023
An info-stealer on an engineer's laptop turns into a CircleCI breach that puts every secret in every project at risk, a Linux backdoor mass-exploits thirty known WordPress plugin flaws, PHP patches a critical SQL injection in PDO::quote(), GitHub revokes code-signing certificates that permanently break already-shipped builds and NIST publishes the AI Risk Management Framework.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- notable NIST
NIST publishes the AI Risk Management Framework 1.0 — nist.gov
Released 26 January 2023 as NIST AI 100-1, the AI Risk Management Framework is voluntary guidance for organisations that develop, deploy or use AI systems, published alongside a companion Playbook and a roadmap. It was built over roughly eighteen months from about 400 sets of formal comments from more than 240 organisations. Part 1 covers risk framing and the characteristics of trustworthy AI; Part 2 defines four core functions — govern, map, measure and manage — applied across the AI lifecycle.
Map your AI controls to govern, map, measure and manage now rather than retrofitting later.
- fyi Drupal
Drupal OpenAI integration module appears in contrib — drupal.org
The
openaiproject was created on drupal.org on 15 January 2023. It describes itself as a suite of modules and an API foundation for OpenAI integration, with submodules for text generation, tone adjustment, summarisation, image creation and content moderation inside the editorial interface.If a Drupal site claims AI editorial features dating from 2023, this is the project to look for first. Confirm which model and which submodules are actually enabled.
Update, August 2026: The drupal.org project page for
openaipoints users to the Drupal AI Initiative, saying most new development now happens in the AI module.
Security and edge
Sections- critical Fortinet
FortiOS SSL-VPN zero-day exploitation targeted government networks — thehackernews.com
Analysis published in January 2023 covered in-the-wild exploitation of CVE-2022-42475, a heap-based buffer overflow in the FortiOS SSL-VPN allowing unauthenticated remote code execution through crafted requests. The campaign was described as highly targeted at government and government-related organisations, deploying a Linux implant modified for FortiOS that tampered with the intrusion prevention engine and established command and control. The operators showed deep FortiOS knowledge, including anti-forensics that located
eloglog files, deleted them and reconstructed the logs to conceal the intrusion.Confirm any Fortinet SSL-VPN at your edge is on a patched build, then hunt rather than assume: log reconstruction means a clean log is not evidence of a clean device. Windows samples were compiled in the UTC+8 band, which includes Australia.
- notable Apache
Apache httpd 2.4.55 fixes request smuggling in the AJP proxy — httpd.apache.org
Released 17 January 2023, Apache HTTP Server 2.4.55 closed three Moderate flaws. Two sit in the reverse proxy and edge path; the third is in
mod_dav. CVE-2022-36760 is a request-smuggling flaw inmod_proxy_ajpaffecting 2.4 through 2.4.54, where inconsistent interpretation of an HTTP request lets an attacker smuggle a second request to an AJP backend. CVE-2022-37436 is a response-splitting issue inmod_proxywhere a malicious backend can truncate response headers, and CVE-2006-20001 is an out-of-bounds read inmod_dav. Apache rates all three Moderate.Move to 2.4.55 or later anywhere httpd terminates or proxies traffic. The AJP and
mod_proxyissues matter most where httpd fronts an application server, because smuggling exploits the disagreement between two hops rather than a bug in either one. - fyi Chrome
Chrome 109 ships with seventeen security fixes — chromereleases.googleblog.com
Chrome 109 reached stable on 10 January 2023 as 109.0.5414.74 on Linux, .74 and .75 on Windows and .87 on Mac, carrying seventeen security fixes, fourteen of them highlighted as external-researcher reports, across high, medium and low severity. Nothing in the release is edge-infrastructure specific. Chrome 109 is commonly cited as the last version to support Windows 7 and 8.1, though that claim does not appear in the release post.
Baseline maintenance. The one thing worth checking is your analytics floor for legacy-Windows Chrome clients before dropping TLS versions or cipher suites those builds depend on.
Standards and compliance
Sections- fyi W3C
WCAG 2.2 reaches its second Candidate Recommendation — w3.org
W3C's Accessibility Guidelines Working Group published an updated WCAG 2.2 Candidate Recommendation Draft on 25 January 2023, dated CRD-WCAG22-20230125. W3C describes it as the second Candidate Recommendation of WCAG 2.2, with Focus Appearance still marked at risk. The new criteria include Focus Not Obscured, Dragging Movements, Target Size (Minimum) and Accessible Authentication.
Start auditing component libraries and login flows against the new criteria now. Target Size and Accessible Authentication tend to require design changes rather than markup fixes, and those take a release cycle to land.
Update, October 2023: WCAG 2.2 became a W3C Recommendation on 5 October 2023.
- fyi W3C
W3C becomes a public-interest non-profit — w3.org
W3C began 2023 as a new public-interest non-profit organisation, replacing the model in which it was jointly hosted by MIT CSAIL, ERCIM, Keio University and Beihang University. A Board of Directors with a W3C Member majority guides it, standards work continues under the W3C Process Document and Recommendations still require review by W3C Members. The change is to legal and governance structure only.
No compliance action. Worth knowing when a procurement or accessibility conformance statement asks who maintains the standard being referenced, because the answer changed at the start of this year.
CMS and platforms
Sections- critical WordPress
A Linux backdoor mass-exploits thirty known WordPress plugin and theme flaws — thehackernews.com
Documented 2 January 2023, a previously unknown Linux backdoor compromises WordPress sites by exploiting thirty known vulnerabilities across plugins and themes — nineteen in the first observed variant and eleven more in a second — then injects JavaScript that redirects visitors to attacker-controlled sites. Named components include WooCommerce, Brizy, Yellow Pencil Visual CSS Style Editor, Easy WP SMTP, WordPress Ultimate FAQ and Smart Google Code Inserter. The sample also carried an unimplemented administrator brute-force capability.
Every flaw it exploits was already patched, so this is an argument for enforced automatic plugin and theme updates and for deleting unused plugins, not for any single fix. Audit theme files and database options for injected JavaScript on any site that ran unpatched versions.
- notable Drupal
Drupal core patches a Media Library information disclosure — drupal.org
SA-CORE-2023-001, published 18 January 2023, is rated Moderately critical at 12 out of 25. The Media Library module does not properly check entity access in some circumstances, so content editors can see metadata about media items they are not authorised to access. Affected versions are 8.0.0 through 9.4.9, 9.5.0 through 9.5.1 and 10.0.0 through 10.0.1, fixed in 9.4.10, 9.5.2 and 10.0.2. No CVE is cited on the advisory.
Update to 9.4.10, 9.5.2 or 10.0.2. Exploitation requires an account that can already edit content with media reference fields, so urgency scales with how deliberately your editorial roles are partitioned — low for a brochure site, higher for a multi-tenant or federated setup.
Supply chain, CI/CD and IaC
Sections- critical CircleCI
Every secret in every CircleCI project treated as compromised — bleepingcomputer.com
An engineer's laptop was infected with info-stealing malware on 16 December 2022, and the attacker exfiltrated data from CircleCI on 22 December. CircleCI sent disclosure emails on 4 January 2023 and published its incident report on 12 January. The vector was session-cookie theft, so the stolen session impersonated the employee with two-factor authentication already satisfied. The attacker also extracted encryption keys from running processes, so the encrypted data could potentially be decrypted. Customers who logged in between 21 December and 4 January were told to rotate their secrets; CircleCI rotated project and personal API tokens and GitHub OAuth tokens, and worked with AWS and Atlassian on AWS and Bitbucket tokens.
The transferable lesson is that long-lived static cloud credentials stored in a CI provider are a single point of catastrophic failure. CircleCI's own report recommends OIDC tokens wherever possible — a workflow assuming a cloud role directly, with no stored keys — and that applies to any pipeline pushing images to a container registry.
- notable GitHub
Revoked code-signing certificates permanently break already-shipped builds — github.blog
Published 30 January 2023, GitHub disclosed that a compromised personal access token had given unauthorised access on 6 December 2022 to repositories containing encrypted code-signing certificates. Three valid certificates were exposed: two DigiCert Windows certificates and one Apple Developer ID certificate valid until 2027. GitHub found no evidence any were decrypted or used, and said it would revoke all three on 2 February 2023. Once revoked, every build signed with them stops working, so GitHub Desktop for Mac 3.0.2 through 3.1.2 had to be updated and Atom 1.63.0 and 1.63.1 had to be replaced with an earlier release such as 1.60.0.
Two checks. Confirm no repository in your organisation stores certificates or keys, even encrypted — a leaked token reached signing material here. Then consider the blast radius: if your release signing certificate were revoked tomorrow, every artefact you have ever shipped would stop validating.
- notable GitHub
Secret scanning starts reporting whether a leaked token still works — github.blog
From 19 January 2023, secret scanning alerts show whether a detected GitHub token is still valid, removing the guesswork over whether a historical leak is still live. The same day crates.io became a secret scanning integrator in collaboration with the Rust Foundation and the Rust Project, so crates.io keys leaked in public repositories are forwarded to the registry, which disables them. Twilio Segment became a secret scanning partner the following day.
Turn on secret scanning and push protection for every public repository you publish packages from, and use the validity flag on existing GitHub-token alerts before treating a historical leak as dead.
Languages, runtimes and frameworks
Sections- notable PHP
PHP patches SQL injection through PDO::quote() on SQLite — php.net
Released 5 January 2023, PHP 8.0.27, 8.1.14 and 8.2.1 are security releases. The 8.2.1 changelog records CVE-2022-31631:
PDO::quote()may return an unquoted string on the SQLite driver, opening a path to SQL injection. The PHP Group rates it CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).Patch to at least 8.0.27, 8.1.14 or 8.2.1 anywhere PDO SQLite handles user-supplied strings.
Static site and web tooling
Sections- notable Astro
Astro 2.0 brings type-safe content collections and hybrid rendering — astro.build
Released 24 January 2023, Astro 2.0 introduced content collections with automatic schema validation and generated TypeScript types, described in the announcement as the first major web framework to deliver complete type safety for Markdown and MDX. It also added hybrid rendering, allowing per-page prerendering alongside a deployed server, redesigned error overlays with editor integration, and upgraded the underlying build engine to Vite 4.0.
Read the v2 upgrade guide before bumping. The Vite 4.0 bump and the per-page
prerenderflag are the two changes most likely to alter build output, and content living outsidesrc/content/needs re-verifying after the move to collections.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more