Radar · 2023-10
October 2023
A design flaw in HTTP/2 lets an attacker cancel streams faster than a server can free them, Citrix Bleed leaves stolen session tokens valid after the patch, WCAG 2.2 becomes a Recommendation with nine new success criteria, WordPress 6.3.2 ships eight security fixes and backports them as far as version 4.1, and Next.js 14 and Docusaurus 3.0 both land breaking changes in the same week.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- notable AWS
Bedrock reaches Tokyo and Frankfurt, but not Sydney — aws.amazon.com
On 6 October 2023 Bedrock reached Asia Pacific in Tokyo, its first region outside the United States, carrying models from AI21 Labs, Anthropic, Cohere, Meta, Stability AI and Amazon. The announcement states the footprint at that moment as US East (N. Virginia), US West (Oregon) and Asia Pacific (Tokyo). Europe in Frankfurt followed on 19 October, bringing Bedrock to four regions globally.
Tokyo is Asia Pacific, but it is Japan. None of Bedrock's four regions is in Australia, so the nearest to Australia is Tokyo, which does not satisfy an onshore-data requirement. If a proposal or contract asserts Australian residency for Bedrock inference, that is a finding in its own right rather than a wording problem.
Update, April 2024: Bedrock became available in the Asia Pacific (Sydney) Region on 9 April 2024.
Security and edge
Sections- critical HTTP/2
HTTP/2 Rapid Reset makes cancellation cheaper than service — github.com
CVE-2023-44487 is a design-level denial of service in HTTP/2 rather than a bug in any one implementation, disclosed on 10 October 2023. The technique abuses stream cancellation: a client opens many streams on one connection and immediately sends RST_STREAM for each, so the server does the expensive work of allocating stream structures, parsing headers and decompressing while the attacker spends almost nothing. Because cancelled streams stop counting toward the concurrent-stream setting, the limit meant to bound this is bypassed entirely. CISA added it to the Known Exploited Vulnerabilities catalogue the same day.
Update every HTTP/2 terminator, then do the part patching does not cover: verify the edge enforces a rate of resets per connection using a sliding-window counter, rather than only a concurrency cap, and tears down offending connections. The advisory records low availability impact, so triage by architecture rather than by score.
- critical Citrix
Citrix Bleed hands over sessions that survive the patch — bleepingcomputer.com
CVE-2023-4966, Citrix Bleed, lets attackers steal authentication session tokens from NetScaler ADC and Gateway and hijack sessions, which can bypass multi-factor authentication. Compromised sessions persist after patching. Citrix patched in early October; exploitation as a zero-day had been running since at least late August.
Patching alone does not remediate, because stolen session tokens remain valid across the upgrade. Citrix's instruction is to destroy every existing session after patching — kill icaconnection, rdp connection, pcoipConnection and aaa session, then clear persistent load-balancer sessions.
Update, November 2023: By mid-November more than 10,000 internet-exposed Citrix servers were still vulnerable. LockBit 3.0 affiliates used the flaw for initial access to Boeing Distribution, and on 21 November CISA, the FBI, MS-ISAC and ACSC issued joint advisory AA23-325A on LockBit's exploitation of it.
- notable Apache
Apache httpd 2.4.58 cleans up after Rapid Reset — httpd.apache.org
Released 19 October 2023, nine days after the Rapid Reset disclosure, and the direct follow-on for httpd operators. CVE-2023-45802, rated Moderate and affecting 2.4.17 through 2.4.57, is that HTTP/2 stream memory was not reclaimed immediately on RST_STREAM — precisely the amplification Rapid Reset depends on. CVE-2023-43622, Low, affecting 2.4.55 through 2.4.57, is a denial of service where a client sets the initial window size to zero and holds the connection open, tying up a server thread. CVE-2023-31122 is an unrelated mod_macro buffer over-read.
If you run httpd with mod_http2 enabled, 2.4.58 is not optional in October — it is the release that makes your server's reset handling behave, and without it the Rapid Reset mitigation guidance does not fully apply to you. Worth noting this is httpd's first advisory since 2.4.56 in March, so a fleet on a quarterly cadence may have skipped the intervening window entirely.
Standards and compliance
Sections- notable W3C
WCAG 2.2 becomes a Recommendation with nine new success criteria — w3.org
WCAG 2.2 became a W3C Recommendation on 5 October 2023, adding nine success criteria. The new criteria are Focus Not Obscured at Minimum and Enhanced, Focus Appearance, Dragging Movements, Target Size Minimum, Consistent Help, Redundant Entry, and Accessible Authentication at Minimum and Enhanced. 4.1.1 Parsing is obsolete and removed from WCAG 2.2.
The AA additions hit patterns that are everywhere. Sticky headers covering the focused element, drag-to-reorder with no single-pointer alternative, touch targets under 24 by 24 CSS pixels, help links that move between pages, and re-typing information already given earlier in a multi-step form. The one to plan around is Accessible Authentication, which rules out cognitive function tests such as transcribing a code or solving a puzzle unless an alternative or an assisting mechanism exists.
- notable ASD
Secure by Design guidance returns as an update to the April edition — cisa.gov
On 16 October 2023 CISA, the NSA, the FBI and international partners including ACSC published an update to "Shifting the Balance of Cybersecurity Risk", now titled "Principles and Approaches for Secure by Design Software". It incorporates feedback on the April 2023 edition and expands on three principles: take ownership of customer security outcomes, embrace radical transparency and accountability, and lead from the top. It adds detail on memory-safe languages and memory-safety roadmaps, secure defaults, loosening guides in place of hardening guides, and what manufacturers should publish, including SBOMs and vulnerability disclosure policies. Eight more international agencies co-sealed the update.
For an Australian platform or hosting vendor, this is a document a government buyer may hand over as a statement of what they expect from a supplier, so it is worth having answers prepared against what it says manufacturers should publish as well as against the principles.
- fyi NIST
The US executive order on AI assigns NIST concrete deliverables — nist.gov
Executive Order 14110 was signed on 30 October 2023. Commerce says NIST, BIS, NTIA and USPTO will carry out a significant portion of its objectives. The order tasks NIST with a companion resource to the AI Risk Management Framework for generative AI and guidelines for AI red-teaming, and asks Commerce to identify standards and practices for authenticating content, labelling synthetic content such as by watermarking, and detecting synthetic content.
Included as precedent rather than obligation. The generative AI, red-teaming and synthetic-content tasks are the deliverables worth tracking.
Update, January 2025: Executive Order 14148, signed on 20 January 2025, revoked Executive Order 14110.
CMS and platforms
Sections- notable WordPress
WordPress 6.3.2 ships eight security fixes and backports them to 4.1 — wordpress.org
Released 12 October 2023, fixing eight vulnerabilities — user email disclosure, an RCE POP chains issue, cross-site scripting in the post link navigation block, comment leakage on private posts, arbitrary shortcode execution by logged-in users, XSS on the application password screen, XSS in the footnotes block, and a cache poisoning denial of service. Backports were issued for WordPress 4.1 and later, so the fixes reached long-abandoned branches. The announcement told site owners to update immediately.
Every WordPress site on any branch from 4.1 up is in scope, precisely because of the 4.1 backports — an elderly site that has been quietly ignored for years is not out of scope here, it is the reason the backports exist. A site older than 4.1 has no backport and needs a full upgrade.
- notable GovCMS
GovCMS finishes the SaaS Drupal 10 upgrade and sets a CKEditor 4 deadline — govcms.gov.au
On 30 October 2023 GovCMS confirmed all SaaS websites had been migrated to Drupal 10, with PaaS sites still working through their own upgrades. GovCMS gives Drupal 9's end of life as 2 November 2023. Agencies must move from CKEditor 4 to CKEditor 5 before the December shutdown, because the CKEditor 4 module ceases security coverage at the end of 2023. Also queued were a Swift Mailer to Symfony Mailer migration, removal of deprecated modules including panels, panelizer, video embed field and the govcms8 modifiers, Google Analytics 4 support, and discovery on API, SSO and DXP capabilities.
For anyone serving Australian government sites on GovCMS, the CKEditor 4 to 5 cutover became the live deadline from this date, with two months to run. The deprecated-module list is the more useful artefact for custom PaaS builds — it is effectively a checklist of what will stop being supported, and panels and panelizer in particular tend to be load-bearing in older site architectures rather than incidental.
Supply chain, CI/CD and IaC
Sections- notable Terraform
Terraform 1.6 adds a test framework and changes the S3 backend — hashicorp.com
Released 4 October 2023. The headline is a built-in testing framework — tests written in HCL, run with terraform test, with test infrastructure destroyed automatically afterwards. Also in 1.6: config-driven import blocks now accept expressions in the id attribute rather than only literal strings, the cloud block accepts project names, saved plans allow splitting plan and apply across machines, and the S3 backend configuration format changed to align with AWS SDK conventions.
The S3 backend change is the one to check before bumping CI images. HashiCorp says existing configurations will continue to work but may emit warnings about deprecated attributes after the upgrade. If you maintain modules, terraform test is now a way to get assertion coverage without introducing a Go toolchain into a repository that otherwise has no reason for one.
- notable curl
curl's SOCKS5 hostname overflow is narrower than a High score suggests — curl.se
CVE-2023-38545 was announced on 11 October 2023 with project severity High. During SOCKS5 negotiation, when a hostname exceeds 255 bytes curl should fall back to local resolution and send only the IP; a bug in the non-blocking state machine instead copies the long hostname straight into the target buffer. Affected are libcurl 7.69.0 through 8.3.0, fixed in 8.4.0. Exploitation requires SOCKS5 with remote hostname resolution, a hostname longer than the download buffer, and a handshake slow enough to reach the state-machine path.
Most deployments were never exploitable. Anything with a libcurl layer in that range needed a base-image bump. Disabling socks5h proxying removes the precondition entirely.
- fyi OpenTofu
OpenTofu ships its first alpha release on the same day as Terraform 1.6 — github.com
OpenTofu 1.6.0-alpha1 landed on 4 October 2023, the same day as Terraform 1.6.0. The release notes describe it as a drop-in replacement requiring no project changes, shipping a new registry for resolving providers and modules, testing at feature parity with Terraform's own 1.6 testing, and removal of the Checkpoint telemetry present in Terraform. The maintainers warned that the registry was not yet stable and availability might be spotty, explicitly discouraging production use.
This is the month the two tools become separately installable artefacts rather than a licence dispute. If you publish a Terraform provider, a second registry target becomes a real if not yet urgent consideration from here. The telemetry removal is worth noting separately — it is a genuine differentiator in regulated environments where outbound calls from build tooling have to be justified.
Languages, runtimes and frameworks
Sections- critical Node.js
Node patches Rapid Reset for HTTP/2 servers on 18.x and 20.x — nodejs.org
Released 13 October 2023 as v20.8.1 and v18.18.2, with no Node 16 release because Node 16 had reached end of life a month earlier. CVE-2023-44487, the nghttp2 Rapid Reset flaw, is High and affects all HTTP/2 servers on the active 18.x and 20.x lines. CVE-2023-39331 and CVE-2023-39332 are High only for users of the experimental permission model on Node.js 20.x. CVE-2023-38552 is Medium and affects the experimental policy mechanism. CVE-2023-45143 is Low: undici does not clear Cookie headers across cross-domain redirects.
Treat Rapid Reset as patch-everywhere for anything that terminates HTTP/2. The permission-model and policy items are opt-in experimental surfaces. The undici cookie leak is Low on this bulletin, but cookies surviving a cross-domain redirect still means credentials can reach a third party with no error.
- critical Go
Go patches HTTP/2 Rapid Reset on 10 October, five days after a cmd/go fix — pkg.go.dev
Two security releases five days apart. On 5 October, 1.20.9 and 1.21.2 include a cmd/go security fix. On 10 October, 1.20.10 and 1.21.3 include a net/http security fix for HTTP/2 Rapid Reset, tracked for Go as CVE-2023-39325 and for the protocol as CVE-2023-44487. Go's vulnerability database lists net/http before 1.20.10 and 1.21.x before 1.21.3 as affected, and golang.org/x/net/http2 before v0.17.0 as affected separately.
Anyone serving HTTP/2 from Go needs 1.21.3 or 1.20.10 at minimum, then a second step: bump golang.org/x/net separately to 0.17.0 or later. A service that upgrades Go and considers itself done is still running the vulnerable HTTP/2 implementation if it imports x/net.
- notable Node.js
Node 20 becomes Active LTS and Node 18 drops to maintenance — github.com
Per the release team's schedule data, Node 20 entered Active LTS on 24 October 2023 shipping as v20.9.0, with maintenance from 22 October 2024 and end of life on 30 April 2026. Node 18 moved from Active LTS to Maintenance on 18 October 2023, with end of life on 30 April 2025.
Move the primary target in any SDK support matrix to Node 20 from this point. The six-day gap between the two dates follows from the schedule: Node 18 dropped to maintenance before Node 20 became Active LTS.
Static site and web tooling
Sections- notable Next.js
Next.js 14 removes next export and raises the Node floor — nextjs.org
Announced 26 October 2023 at Next.js Conf with five breaking changes that directly affect build and deploy. Minimum Node.js is now 18.17. The next export command is removed entirely in favour of the output export config, making mandatory the migration path opened in 13.3. ImageResponse moves from next/server to next/og. Support for @next/font is dropped in favour of next/font. The WASM target for next-swc builds is removed. Server Actions reached stable, Turbopack passed 5,000 integration tests with up to 53 per cent faster local startup though still not stable, and Partial Prerendering shipped as a preview.
Any CI pipeline still calling next export breaks on upgrade, as does any build image on Node 16 or early 18 — and the Node floor is the one that catches people, because a build image is rarely versioned in the same place as the application. Codemods exist for the next/og and next/font moves, so those are mechanical. Also note viewport, colorScheme and themeColor are deprecated in metadata in favour of a separate viewport export.
- notable Docusaurus
Docusaurus 3.0 can change your rendered output without failing — docusaurus.io
Released 31 October 2023, a hard-breaking major. The MDX v1 to v3 jump is called out by the project as the main challenge to adoption: existing markdown and MDX content can fail to compile or render differently, with most fixes being escaping of curly braces and angle brackets. Also breaking are Node 16 to 18 minimum, aligning with Node 16's September end of life, React 17 to 18, TypeScript 4 to 5, prism-react-renderer 1 to 2, and Mermaid 9 to 10. Docusaurus v2 entered maintenance mode on the same date, receiving only critical security fixes through 31 January 2024.
This is the most content-invasive upgrade in the 2023 tooling set, and the reason is in the title — MDX v3 can silently change rendered output rather than failing loudly, so a green build is not evidence the migration worked. Budget for content review, not just a version bump. Any documentation site still on v2 had a three-month window before security coverage ended, which is short for a migration that needs someone to read pages.
- fyi Interop
The Interop 2023 checkpoint shows what actually converged — web.dev
The mid-project update on the 26 Interop 2023 focus areas, published on web.dev during October. It reports progress per focus area across the participating engines rather than announcing any single feature.
Useful as an evidence base rather than a release — it is the document to check when deciding which of container queries, color spaces, subgrid and inert had genuinely moved across engines by late 2023. Experimental browsers scored 89 and the stable view 75 across the 26 focus areas.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more