Radar · 2023-05
May 2023
A SQL injection in MOVEit Transfer is mass-exploited over the US Memorial Day weekend before any patch exists, Barracuda email gateways turn out to have been compromised since October and cannot be patched back to trustworthy, WordPress needs two security releases in four days, Go patches html/template for a second consecutive month and Claude's context window jumps from 9K to 100K tokens.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- fyi Anthropic
Claude's context window goes from 9K to 100K tokens — anthropic.com
Announced 11 May 2023 and available immediately in the API, including for Claude Instant. A hundred thousand tokens is roughly 75,000 words, or about six hours of audio transcript. Anthropic's worked example loads The Great Gatsby at 72K tokens, changes a single line, and has the model identify the change in about twenty-two seconds.
Use this as the dividing line when reviewing any RAG architecture designed in 2023. Pipelines that chunk aggressively and retrieve narrowly were often working around pre-May constraints that no longer applied, so a supplier still justifying a heavy chunking layer purely on context limits is defending a decision on grounds that expired. The cost argument for chunking is separate and still stands.
- fyi OWASP
OWASP starts work on a Top 10 for LLM applications — genai.owasp.org
Announced 23 May 2023 with board approval, on the premise that organisations building on LLMs face a set of security problems distinct from traditional web application security. The announcement set a kick-off call for 31 May and recruited contributors through GitHub and OWASP Slack rather than naming a fixed team, and gave no release date for the list itself.
The useful fact here is the start date. If you are assessing whether an AI product built so far in 2023 was designed against an LLM-specific security baseline, ask what baseline a supplier used, because the OWASP list has no release date yet.
Update, August 2023: OWASP published version 1.0 of the Top 10 for LLM Applications on 1 August 2023.
Security and edge
Sections- critical MOVEit
A managed file transfer product is mass-exploited before a patch exists — bleepingcomputer.com
CVE-2023-34362 is a critical SQL injection in Progress MOVEit Transfer that chains to remote code execution. Mandiant dated the start of exploitation to 27 May 2023, timed to the US Memorial Day long weekend when monitoring is thinnest; Progress published its advisory on 31 May. Fixed builds are 2023.0.1, 2022.1.5, 2022.0.4, 2021.1.4 and 2021.0.6. The interim mitigation was to block external traffic to ports 80 and 443 on MOVEit Transfer servers and to inspect the wwwroot directory for unexpected files, because attackers were dropping webshells there and staging stolen data. Mandiant reported mass exploitation and broad data theft over the preceding few days and told organisations to prepare for possible extortion.
Two things generalise past MOVEit. Managed file transfer sits outside most asset registers because it is procured as a business tool rather than infrastructure, yet it is internet-facing and holds exactly the data an attacker wants in one place — worth confirming it appears in yours. And the long-weekend timing was deliberate, which makes public-holiday monitoring coverage a control rather than a nicety.
- critical Barracuda
Barracuda patches an exploited command injection in its email gateway — bleepingcomputer.com
CVE-2023-2868 is a remote command injection in the Barracuda Email Security Gateway, caused by incomplete validation of a user-supplied tar file and allowing command execution with the privileges of the product. Only the physical and virtual appliance is affected, not the SaaS service. Barracuda found the flaw on 19 May, patched on 20 and 21 May and began notifying affected customers on 23 May.
The durable lesson is for anyone running inline appliances at the edge. A device that has been compromised at this level is not returned to a trustworthy state by a firmware update, because the thing applying the update is the thing you no longer trust. Worth deciding in advance which appliances in your estate would have to be replaced rather than patched, since that answer determines lead time, budget and whether you have a spare — none of which are questions to start asking mid-incident.
Update, June 2023: In early June Barracuda told customers to replace compromised appliances outright rather than patch them, after exploitation was traced back to October 2022.
- notable OpenSSL
OpenSSL patches an ASN.1 denial of service — openssl-library.org
CVE-2023-2650, a possible denial of service translating ASN.1 object identifiers, was published on 30 May 2023 and rated Moderate. Processing a maliciously crafted OBJECT IDENTIFIER with very large sub-identifiers through OBJ_obj2txt, which X.509 and PKCS7 or CMS parsing can reach, can consume enough time to constitute a denial of service. Fixed in 3.0.9, 3.1.1, 1.1.1u and 1.0.2zh.
Schedule this if you terminate TLS with client certificates or parse untrusted CMS or PKCS7. Note which builds carry the fix — 3.1.1, 3.0.9, 1.1.1u and 1.0.2zh also carry March's CVE-2023-0464, 0465 and 0466; CVE-2023-1255 was only in the 3.0.9 and 3.1.1 lines.
Standards and compliance
Sections- fyi OAIC
The OAIC is funded to enforce, and returns to three Commissioners — oaic.gov.au
On Budget night, 9 May 2023, the OAIC confirmed $17.8 million in 2023-24 and $44.3 million over four years for privacy work, framed explicitly around the increased complexity, scale and impact of notifiable data breaches, plus $9.2 million over two years to oversee the privacy aspects of the Consumer Data Right, My Health Record and Digital Identity. The same announcement confirmed a return to a three-Commissioner structure — Australian Information Commissioner, Privacy Commissioner and FOI Commissioner — reversing years of a single-Commissioner arrangement. Commissioner Angelene Falk tied the funding directly to enforcement expectations.
Regulator capacity is the leading indicator of enforcement risk, and it is easier to read than sentiment. Between this funding, December 2022's penalty increase to the greater of $50 million, three times the benefit or 30 per cent of adjusted turnover, and the major investigations into the Optus and Medibank breaches, 2023 is when OAIC action stopped being theoretical. That is the reason government and enterprise buyers began asking delivery partners for privacy evidence rather than privacy assurances.
- fyi W3C
W3C publishes the second WCAG 2.2 Candidate Recommendation Draft — w3.org
W3C published the second Candidate Recommendation Draft of WCAG 2.2 on 17 May 2023, following the first on 25 January. It removes 4.1.1 Parsing as obsolete, integrates changes made in response to comments and marks two success criteria as at risk, meaning they could revert to earlier versions if testing does not show enough implementation. Comments were requested by 16 June 2023.
Build against this draft, but track the two at-risk criteria, which could still change before Recommendation. Dropping 4.1.1 Parsing applies to WCAG 2.2 only: W3C notes it may still need testing where policy requires WCAG 2.0 or 2.1.
Update, July 2023: W3C published WCAG 2.2 as a Proposed Recommendation on 20 July 2023.
Update, October 2023: WCAG 2.2 became a W3C Recommendation on 5 October 2023.
- fyi NIST
NIST opens comment on SP 800-171 Revision 3 — csrc.nist.gov
The initial public draft opened for comment on 10 May 2023, with comments due 14 July and an explanatory webinar on 6 June. Revision 3 realigns the requirements with SP 800-53 Rev. 5 and the moderate baseline, adds organisation-defined parameters for flexibility, increases requirement specificity to remove assessment ambiguity, and introduces a prototype CUI Overlay.
Marginal for most Australian web teams, which is why it is filed as an aside rather than an action. It is load-bearing for anyone in the defence supply chain or handling US-origin controlled unclassified information under AUKUS-adjacent arrangements, where 800-171 is the contractual control set the way the ISM is domestically. If that is you, the comment period was the cheap moment to object.
CMS and platforms
Sections- notable WordPress
WordPress needs two security releases in four days — wordpress.org
WordPress 6.2.1 shipped on 16 May 2023 fixing five security issues plus 20 core and 10 block-editor bugs. The five were block themes parsing shortcodes in user-generated data, a CSRF flaw when updating attachment thumbnails, XSS through open embed auto-discovery, a KSES sanitisation bypass in block attributes exploitable by low-privileged users, and path traversal through translation files. Four days later 6.2.2 arrived to harden the shortcode-parsing vulnerability that 6.2.1 had only partly patched, and to revert a regression 6.2.1 introduced.
6.2.2 is the floor, not 6.2.1 — audit any fleet pinned to the first release, because it carries a partial patch and a regression. The shortcode-parsing and KSES bypass issues are reachable by low-privileged users, so any site that allows open registration should be treated as exposed until confirmed past 6.2.2 rather than merely past 6.2. Sites with background updates enabled took both automatically.
- notable Statamic
Statamic 4 requires PHP 8 and starts the clock on Statamic 3 — statamic.com
Released 9 May 2023 with container queries for responsive fieldtypes, tabs and sections in blueprints and publish forms, redesigned Color, List, Time, Icon and Width fieldtypes, fullscreen modes for Grid, Replicator and Table, an upgrade from Tailwind CSS 1 to 3, and a move to Vite. It supports Laravel 9 and 10 and drops PHP 7.x entirely. Statamic 3 went onto a support clock at the same time — critical bug fixes until January 2024, security fixes until January 2025.
For Statamic integrations, set the Composer constraint to ^4.0. The ordering matters if you are still on PHP 7: that is a platform upgrade which has to land first, and it is the longer piece of work. Anything left on Statamic 3 loses bug-fix support in January 2024, which is close enough to plan against rather than note.
Supply chain, CI/CD and IaC
Sections- notable PyPI
PyPI announces mandatory 2FA by the end of 2023 — blog.pypi.org
Published 25 May 2023, announcing that every account that maintains a project or organisation on PyPI must enable two-factor authentication by the end of 2023, with PyPI to begin gating some site functionality on 2FA before then.
If you publish Python packages this is the year's actual compliance deadline, and it is the kind that breaks a release pipeline rather than generating a warning. Pair it with Trusted Publishing from April, because the two solve different halves of the problem — 2FA stops a stolen password being enough, Trusted Publishing removes the long-lived token that a stolen password would otherwise protect.
- notable PyPI
PyPI stops accepting PGP signatures — blog.pypi.org
On 23 May 2023 PyPI stopped accepting PGP signatures uploaded alongside releases, concluding that the existing support was not proving useful. The audit behind the decision is the striking part: across roughly three years about 50,000 signatures were uploaded by 1,069 unique keys, but only 36 per cent of those keys could be meaningfully verified and about 30 per cent were not discoverable on major public keyservers. Existing signatures remained temporarily available, but the JSON API field has_sig now always returns false.
If any verification tooling checks has_sig or fetches .asc files from PyPI, it is now checking nothing and will keep reporting success — the worst failure mode a control can have. The replacement direction is attestation rather than detached developer signatures: Trusted Publishing from April, and later PEP 740 attestations.
- fyi GitHub Actions
Actions Runner Controller reaches public beta — github.blog
Announced 10 May 2023. Actions Runner Controller, the Kubernetes operator for autoscaling self-hosted runners, moved to public beta. It is relevant to anyone running self-hosted runners for builds needing VPC access or larger machines, which is the usual pattern for pushing container images to a private registry.
If you run self-hosted runners, this is the autoscaling path GitHub has put into public beta. Adopting it means owning a fleet you have to keep current yourself. Put runner-version currency on a schedule when you adopt, not when it breaks.
Languages, runtimes and frameworks
Sections- notable Go
Go patches html/template for a second consecutive month — go.dev
Go 1.19.9 and 1.20.4 shipped on 2 May 2023 with three more security fixes in html/template, following html/template fixes in April's 1.19.8 and 1.20.3. They are CVE-2023-24539, improper sanitisation of CSS values; CVE-2023-24540, improper handling of JavaScript whitespace; and CVE-2023-29400, improper handling of empty HTML attributes, which may allow injection of arbitrary attributes into tags.
Upgrade to 1.20.4 or 1.19.9. Taken together with April, any Go service rendering user-influenced data through html/template into CSS, JavaScript or attribute contexts should be treated as having had an XSS exposure until patched. The pattern across two consecutive months is the more useful signal: contextual auto-escaping is difficult enough that a template engine getting it right is a claim worth re-checking, not assuming.
- notable Symfony
Symfony 6.3 is a stepping stone, not a landing point — symfony.com
Released 30 May 2023, the first of the year's two Symfony feature releases. As a standard rather than LTS release it carries an eight-month support window instead of the three-year LTS window. Symfony ships minor versions every May and November and the last minor of each branch is LTS, so 6.4 LTS is due in November 2023.
Worth being explicit about with any integration targeting Symfony, because the version number gives no hint: 6.3 is not a place to stop. The 2023 long-term target is 6.4 LTS in November. Landing a project on 6.3 and treating it as done buys eight months of support and an unplanned upgrade in someone else's budget year.
Static site and web tooling
Sections- notable Core Web Vitals
INP is announced as the replacement for FID — web.dev
Announced 10 May 2023 on a phased timeline — May 2023 moved Interaction to Next Paint from experimental to pending Core Web Vital status, and March 2024 made it a stable Core Web Vital replacing First Input Delay. The rationale is that FID measures only the input delay of the first interaction, whereas INP measures every interaction across its full duration, from the start of the interaction through the event handler until the browser can paint the next frame.
This is ten months of warning, and it is worth acting on early precisely because a comfortable FID score tells you almost nothing about INP. Sites that hydrate heavily typically regress badly on the switch, while static-first architectures are advantaged — so if you are weighing a rendering strategy this year, the metric that will be graded from March 2024 favours shipping less JavaScript.
- fyi Next.js
The Next.js App Router is marked stable — nextjs.org
Released 4 May 2023, the most consequential Next.js release of the year. App Router moved to stable and became the recommended default for new applications, bringing React Server Components, nested routes and layouts, streaming and Suspense, and built-in SEO support. Turbopack moved to beta behind next dev --turbo, and Server Actions shipped in alpha behind experimental.serverActions. The announcement commits to supporting pages/ for multiple major versions including bug fixes and security patches, and supports running pages/ and app/ together in production.
The migration commitment is the part worth reading closely, because it means App Router adoption can be per-route rather than a rewrite — the cheapest way to evaluate it is one low-risk route, not a branch. Treat Server Actions differently: alpha here means production use pulls in a React canary build, which is a supply-chain decision rather than a feature flag.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more