Security advisory: critical PHP and Node.js vulnerabilities are being exploited in the wild. What you need to do →
All months

Radar · 2023-02

February 2023

The Privacy Act Review Report lands with 116 proposals, new SOCI rules make Essential Eight Maturity Level One a legal floor for critical infrastructure, ESXiArgs ransomware encrypts thousands of exposed hypervisors through a two-year-old flaw, OpenSSL patches eight CVEs led by a type confusion in certificate validation and Node.js, PHP and Go all ship security releases in the same week.

What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.

AI platform and models

Sections
  • fyi OpenAI

    ChatGPT gets a paid tier — openai.com

    OpenAI launched ChatGPT Plus on 1 February 2023 at US$20 a month, initially in the United States, with a worldwide rollout from 10 February. Subscribers got access during peak times, faster responses and priority access to new features, and the free tier stayed. There is no ChatGPT-family API yet, so this is a consumer product change, not a platform one.

    Little to do, but worth noting for an AI usage history: ChatGPT use, free or Plus, sits under consumer product terms, and OpenAI is still only exploring business plans.

    Update, March 2023: OpenAI made the ChatGPT and Whisper APIs available on 1 March 2023.

Security and edge

Sections
  • critical VMware

    ESXiArgs ransomware encrypts thousands of exposed hypervisors — bleepingcomputer.com

    From 3 February 2023 a mass ransomware campaign encrypted internet-exposed VMware ESXi hypervisors by exploiting CVE-2021-21974, a heap overflow in the OpenSLP service allowing unauthenticated remote code execution. Roughly 120 servers were encrypted on the first day, rising to about 2,400 hosts worldwide within the weekend. Every affected build had been patched by VMware in February 2021, making this a two-year-old bug. CISA released a recovery script for victims on 7 February.

    The lesson is exposure surface rather than novelty: a hypervisor management plane should never be reachable from the public internet, and a CDN or WAF in front of your web properties does nothing for a directly exposed OpenSLP port. Hunt for a Python backdoor at /store/packages/vmtools.py on anything that was exposed.

  • notable OpenSSL

    OpenSSL patches eight CVEs, led by a type confusion in certificate validation — openssl-library.org

    A combined advisory on 7 February 2023 covered eight CVEs across OpenSSL 3.0, 1.1.1 and 1.0.2. The headline, rated High by the project, is CVE-2023-0286: a type confusion in GENERAL_NAME_cmp when handling the X.400 address field of an X.509 GeneralName. It is in play when CRL checking is enabled (X509_V_FLAG_CRL_CHECK). The other seven are Moderate and include a timing oracle in RSA decryption, a use-after-free following BIO_new_NDEF and a double free after PEM_read_bio_ex. Fixed in 3.0.8, 1.1.1t and 1.0.2zg.

    Patch TLS terminators on 3.0.0 to 3.0.7, 1.1.1 through 1.1.1s, or 1.0.2, and treat it as urgent if CRL checking is enabled, since that is what the project says makes the High-rated flaw reachable.

  • notable curl

    curl fixes a decompression bomb and two HSTS bypasses — curl.se

    curl 7.88.0, released 15 February 2023, fixed three flaws. CVE-2023-23916 lets a malicious server bypass curl's cap on chained content decompression by spreading the steps across multiple Content-Encoding or Transfer-Encoding headers rather than one, producing a malloc bomb that drives curl into excessive heap allocation. It applies to all HTTP versions and to the built-in gzip, brotli and zstd handlers, affecting 7.57.0 through 7.87.0; the fix caps chained algorithms at five regardless of header count. CVE-2023-23914 and CVE-2023-23915 both cause HSTS to be ignored, silently downgrading a request to cleartext.

    Move to 7.88.0 or later wherever libcurl fetches untrusted upstreams — origin shields, image proxies and webhook fetchers are the exposed cases for the decompression bomb. The two HSTS CVEs are curl command-line only and do not affect libcurl.

Standards and compliance

Sections
  • notable Home Affairs

    New SOCI rules make Essential Eight Maturity Level One a legal floor — legislation.gov.au

    The Security of Critical Infrastructure (Critical infrastructure risk management program) Rules 2023 were made on 31 January 2023 and registered on 16 February 2023, switching on the Part 2A obligation for specified asset classes. Responsible entities must adopt a written program addressing cyber, physical, personnel and supply chain hazards. For the cyber component the Rules name five acceptable frameworks, three of them with a required level, including the ASD Essential Eight Maturity Model at Maturity Level One; AS ISO/IEC 27001:2015 is listed with no level attached. The explanatory statement sets a six-month grace before Part 2A applies and a further twelve months for the cyber framework element, with a board-approved annual report thereafter.

    This turns Essential Eight Maturity Level One from an aspiration into a hard legal floor for a defined set of operators, and it flows straight down supply chains. If a client's asset is captured, expect to be asked to evidence patching, multi-factor authentication, application control and backups against a named framework, on the record, in a report their board signs.

  • fyi Attorney-General

    The Privacy Act Review Report lands with 116 proposals — oaic.gov.au

    Published 16 February 2023, the Privacy Act Review Report closed a review begun in late 2020 and made 116 proposals. They include narrowing the small business exemption, a new "fair and reasonable" positive obligation on all personal information handling, tighter rules on targeting and direct marketing, mandatory privacy impact assessments for high-risk activities, and a statutory tort for serious invasions of privacy. The Commissioner singled out the fair-and-reasonable test as the keystone, describing it as shifting the burden from individuals reading privacy policies to entities designing practices. Consultation ran to 31 March and fed the Government Response of 28 September.

    This is the document that set the shape of Australian privacy law for the rest of the decade, and the build work it foreshadows is concrete: consent and collection-notice redesign, a defensible retention and deletion position, impact assessments as a gate on new features, and treating analytics and personalisation as regulated targeting.

  • fyi Home Affairs

    Consultation opens on the 2023-2030 Cyber Security Strategy — homeaffairs.gov.au

    Home Affairs opened public consultation on the 2023-2030 Australian Cyber Security Strategy discussion paper on 27 February 2023, running to 15 April. Written by the Expert Advisory Board appointed after the Strategy was announced in December 2022, it canvassed a standalone Cyber Security Act, ransomware payment reporting, expanding critical infrastructure regulation to cover customer data and systems, mandatory operational cyber security standards, and clearer post-incident support.

    Read the options, not the rhetoric: they set out where Australian cyber compliance could head next. For a hosting provider, the signal is the proposal to bring customer data and systems into the definition of critical assets.

    Update, April 2023: Consultation closed on 15 April; Home Affairs received over 330 submissions and hosted over 50 consultation events.

CMS and platforms

Sections
  • notable GovCMS

    GovCMS sets the clock on moving the whole fleet to Drupal 10 — govcms.gov.au

    Published 27 February 2023, the Path to Drupal 10 update set out the schedule for moving the entire GovCMS platform off Drupal 9, saying it was "aiming for all D9 sites to be upgraded to D10 between July-September 2023". The post describes automated smoke tests and GitLab branches used to surface compatibility problems in agency sites before the Drupal 10 distribution shipped.

    If you build or maintain a GovCMS site, this is the start of the clock rather than an announcement to file: module and theme audits needed to land before the July window, and the post does not distinguish SaaS from PaaS treatment — that split arrives in the April and October updates.

  • fyi WordPress

    WordPress 6.2 enters beta — wordpress.org

    Beta 1 shipped on 7 February 2023, opening the test cycle for WordPress 6.2, with the final release targeted for 28 March. It is the first public 6.2 build carrying the Site Editor out of beta, along with the Style Book and distraction-free writing. There was no WordPress core security release in February.

    Low urgency. The useful signal is that the Site Editor leaving beta is the point at which theme and plugin compatibility testing stops being optional for anyone shipping block themes.

    Update, March 2023: WordPress 6.2 "Dolphy" was released on 29 March 2023.

Supply chain, CI/CD and IaC

Sections
  • critical GitHub

    GitHub Actions brownouts start failing jobs on the retiring Ubuntu 18.04 runner — github.com

    The ubuntu-18.04 runner image entered its terminal phase with two February brownout windows — six hours on 7 February and twelve hours on 21 February. During a brownout, jobs requesting the label fail rather than warn, and the windows lengthen through the schedule, reaching full 24-hour windows every week in March. Deprecation began on 8 August 2022 and the image will be fully unsupported by 3 April 2023. The migration path is ubuntu-latest, ubuntu-20.04 or ubuntu-22.04.

    Grep your published workflows and documentation for hard-pinned runner labels, not just your own CI. If you publish Actions, the example workflows in your README get copied into consumers' repositories, so a label you pinned once breaks on someone else's schedule.

Languages, runtimes and frameworks

Sections
  • notable Node.js

    Node.js patches a permissions bypass and tracks the OpenSSL advisory — nodejs.org

    Released 16 February 2023 as 14.21.3, 16.19.1, 18.14.1 and 19.6.1. CVE-2023-23918 is High: the permissions policy can be bypassed via process.mainModule.require(), affecting users of --experimental-policy. The release also carries a High-rated OpenSSL update tracking the 7 February advisory, which affects every version regardless of experimental features. Medium issues include CVE-2023-23936, missing CRLF protection on host headers in the Fetch API enabling HTTP response splitting, and an OpenSSL error stack not being cleared after crypto operations.

    Patch every line, not just those using experimental policies — the bundled OpenSSL component is what makes this a patch-everywhere release. The Fetch API CRLF issue matters separately for anything forwarding user-influenced values into outbound request headers.

  • notable PHP

    PHP fixes password verification accepting invalid hashes — php.net

    Released 14 February 2023, PHP 8.0.28, 8.1.16 and 8.2.3 fix three CVEs. CVE-2023-0567 is the authentication flaw: password_verify() may accept some invalid Blowfish hashes as valid, so if such a hash ends up in the password database, any password is accepted for that entry. CVE-2023-0568 is a one-byte array overrun in common path-resolution code, and CVE-2023-0662 is a denial of service when parsing a multipart request body with an excessive number of parts.

    Patch immediately if you store BCrypt hashes or accept uploads, then audit your password table for malformed hashes — the flaw makes a corrupted row into an authentication bypass rather than a login failure, so it fails open and silently.

  • notable Go

    Go 1.20 ships, and a HPACK denial of service lands two weeks later — go.dev

    Go 1.20 was released 1 February 2023 with a preview of profile-guided optimisation, a new crypto/ecdh package, errors.Join and direct slice-to-array conversion. Under Go's policy of supporting each major release until two newer ones ship, its arrival ended support for Go 1.18. On 14 February, Go 1.19.6 and 1.20.1 fixed CVE-2022-41723: a maliciously crafted HTTP/2 stream can cause excessive CPU consumption in the HPACK decoder, enough for a denial of service from a small number of small requests. The same point releases also patched crypto/tls, mime/multipart, net/http and path/filepath.

    Upgrade the toolchain and separately bump golang.org/x/net to v0.7.0. The module fix is not delivered by the toolchain update, so a service that only bumps Go remains exposed.

Static site and web tooling

Sections
  • fyi Gatsby

    Gatsby is acquired — gatsbyjs.com

    Gatsby announced on 1 February 2023 that it had been acquired, with many core contributors moving across and the open-source framework said to continue evolving. Gatsby Cloud capabilities and the Valhalla Content Hub data layer were to be folded into the acquirer's platform and offered across frameworks rather than Gatsby alone. The announcement cited over 4,000 contributors, 3,000 plugins and 85 million npm downloads.

    Nothing to do immediately, but start tracking Gatsby's commit velocity as a migration signal rather than waiting for an end-of-life announcement.

  • fyi Interop

    Interop 2023 sets twenty-six cross-browser focus areas — web.dev

    Launched with this 1 February 2023 post, Interop 2023 committed the major browser vendors and other stakeholders to a shared list of 26 browser compatibility focus areas spanning CSS — container queries, :has(), custom properties, masking, grid and flexbox — web APIs including OffscreenCanvas, web components and pointer events, forms, and a catchall for small bugs affecting real sites.

    Read it as a forward signal for CSS refactors: container queries and :has() were about to become broadly safe, which is the point at which planning to use them beats shipping polyfills for them.

Build on what the radar tracks

Integrations

How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.

Learn more

AI applications

Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.

Learn more

For developers

REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.

Learn more