Radar · 2023-11
November 2023
Optus loses its entire fixed and mobile network nationally to bad route data from a peer, DP World disconnects from the internet to contain an intrusion and stalls 40 per cent of Australian container trade for three days, Drupal 9 reaches end of life with no further releases ever, ASD revises the Essential Eight maturity model that every Australian assurance conversation is written against, and OpenAI and Anthropic move the context ceiling to 128K and 200K within a fortnight of each other.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- notable ASD
ACSC co-seals the first international AI security guidelines — cyber.gov.au
Guidelines for Secure AI System Development were published in late November 2023, co-sealed by 23 agencies — the US CISA and the UK NCSC together with 21 other agencies and ministries from around the world, including every G7 member — with the Australian Signals Directorate's ACSC among them. The document is structured around four lifecycle stages: secure design covering threat modelling and risk assessment at planning, secure development covering supply chain security and asset management, secure deployment covering infrastructure protection and responsible release, and secure operation and maintenance covering logging, monitoring, update management and information sharing.
For Australian public-sector and regulated work this is the citable AI security document — more so than the OWASP list, because ASD put its name to it. Use the two together rather than choosing: OWASP LLM Top 10 from August gives you the vulnerability taxonomy, this gives you the lifecycle controls a government buyer will actually ask about. It is the first internationally co-sealed AI security guidance carrying an Australian government seal.
- fyi OpenAI
GPT-4 Turbo brings 128K context and cuts input and output prices — openai.com
At DevDay on 6 November 2023 OpenAI released GPT-4 Turbo with a 128,000-token context window — more than 300 pages of text in a single prompt — priced three times cheaper for input and twice as cheap for output as the original GPT-4. It also launched the Assistants API, described as a first step towards helping developers build agent-like experiences, with built-in Code Interpreter and Retrieval tools. Also shipped: GPT-4 Turbo with vision, DALL-E 3 and text-to-speech through the API, multiple function calls per message, JSON mode, reproducible outputs via a seed parameter, doubled tokens-per-minute limits for paying GPT-4 customers, Copyright Shield indemnification, and fine-tuned GPT-3.5 Turbo 4K input tokens reduced by four times.
This is the month both ceilings moved enough to change architecture rather than just cost. A 128K window plus a three-times input price cut retired a lot of the chunk-and-summarise machinery built earlier in 2023, so a retrieval pipeline designed before November is worth re-costing rather than assuming still optimal. OpenAI's managed-RAG mechanism is the Assistants API's Retrieval tool.
- fyi Anthropic
Claude 2.1 takes context to 200K — anthropic.com
Claude 2.1 shipped on 21 November 2023 with a 200,000-token context window — roughly 150,000 words or more than 500 pages, which Anthropic called an industry first, and larger than GPT-4 Turbo's 128K announced fifteen days earlier. Anthropic reported a halving of false statements against Claude 2.0, a 30 per cent reduction in incorrect answers, and a three to four times lower rate of wrongly concluding that a document supports a claim. Two new capabilities arrived: a tool-use beta and system prompts. AWS made Claude 2.1 generally available in Bedrock on 29 November, in US East and US West only.
If you are choosing a long-context model for document-heavy Australian workloads, note the split: 200K context is available on Anthropic's API from 21 November 2023, and on claude.ai for Pro users, but Claude 2.1 in Bedrock launched in US East and US West only. The reduction in wrongly concluding a document supports a claim is the metric that matters most for retrieval over customer content, since that failure mode produces confident, cited and wrong answers.
Security and edge
Sections- notable Optus
Optus loses its national network to a peer's route data — itnews.com.au
At about 4.05am on 8 November 2023 Optus lost its fixed and mobile network nationally. Optus's explanation was that it received bad route data from an international peering network following a routine software upgrade; the routing information propagated through multiple layers of the network and exceeded preset safety levels on key routers, which disconnected from the Optus IP core to protect themselves. Restoration was progressive through the afternoon and required technicians to attend sites across Australia to reboot and reconnect routers. Optus said investigations took longer than it would have liked.
Not a vulnerability, and the best Australian edge case study of the year. Three failure modes compound here and each has a control: an unbounded route import from a peer, answered by maximum-prefix limits and route filters on every peering session; a blast radius amplified by uniform configuration; and a recovery time dominated by loss of out-of-band management. That last one is the question to take away — verify that your out-of-band access to edge devices does not depend on the network it manages, because Optus's did.
- notable DP World
DP World pulls the plug, stalling 40 per cent of Australia's maritime freight — itnews.com.au
DP World Australia, which handles roughly 40 per cent of goods moving through Australian ports, disconnected its systems from the internet in response to a cyber security incident that began around 10 November 2023, suspending operations at all its facilities for three days before resuming at 9am on Monday 13 November. On 28 November DP World confirmed that employee data had been stolen. Terminals across Fremantle, Melbourne, Sydney and Brisbane were reported affected.
The clearest 2023 demonstration of Australian critical-infrastructure interdependence: one logistics operator's containment decision stalled a large fraction of national freight. For an edge operator the useful exercise is the question DP World had to answer under pressure and without preparation time — if you sever external connectivity to contain an intrusion, what still functions, and how long can you run that way. Worth answering on paper before you need to answer it live.
- fyi OpenSSL
OpenSSL publishes its third Diffie-Hellman timing issue of the year — openssl-library.org
CVE-2023-5678, published 6 November 2023 and rated Low, is the third DH-parameter excessive-time issue of 2023 after CVE-2023-3446 (13 July) and CVE-2023-3817 (31 July). Generating or checking excessively long X9.42 DH keys or parameters through DH_generate_key, DH_check_pub_key and related functions can be very slow, giving a denial of service where an application accepts DH parameters from an untrusted source. Fixed in 1.0.2zj, 1.1.1x, 3.0.13 and 3.1.5. The OpenSSL TLS implementation is not affected.
Standard TLS server termination does not reach this code path, so this matters only if you accept externally supplied DH parameters.
Standards and compliance
Sections- notable ASD
The Essential Eight maturity model is revised — cyber.gov.au
ASD published a revised Essential Eight Maturity Model in November 2023, with a dedicated change document. The biggest shifts are in patching and multi-factor authentication. Vulnerabilities that vendors assess as critical must now be patched or mitigated within 48 hours at every maturity level. At Maturity Level One, internet-facing applications such as office suites, browsers, email clients, PDF software and security software move from a one-month to a two-week patch window, with weekly rather than fortnightly scanning. Maturity Level One MFA must now combine something users have with something users know, MFA becomes mandatory for web portals holding sensitive customer data, and Maturity Level Two now requires phishing-resistant MFA, including for workstation logons. Privileged-access governance extends to data repositories, break-glass accounts join the credentials that must be long, unique and managed, and centralised event logging and incident response move down to Maturity Level Two.
Essential Eight maturity is the single most-requested cyber assurance artefact in Australian government and critical-infrastructure procurement, so a revision changes what "we are at Maturity Level Two" means. Every assessment, ATO package and supplier attestation written against the previous model needs re-checking. For a hosting or platform provider the strategies that changed most are patch applications, patch operating systems, multi-factor authentication and restrict administrative privileges. Read the change document itself before quoting anyone's summary of it to a government client.
- fyi Home Affairs
The 2023-2030 Cyber Security Strategy sets the shape of everything after it — homeaffairs.gov.au
The Government released the Strategy in November 2023, closing the loop on February's discussion paper and more than 330 submissions. It is built around six cyber shields — strong businesses, communities and citizens; secure technology; world-class threat sharing and blocking; protected critical infrastructure; sovereign capabilities; and a resilient region and global leadership — delivered across three horizons: 2023 to 2025 strengthening foundations, 2026 to 2028 scaling maturity across the economy, and 2029 to 2030 advancing the global frontier. An Action Plan for the first horizon was released with it.
This is the parent document for the reforms that follow it. The Strategy commits to co-design a no-fault, no-liability ransomware reporting obligation and a mandatory cyber security standard for IoT devices, and to consult on how the SOCI Act applies to business-critical data storage systems. That makes it the right thing to cite when explaining why an obligation exists rather than merely that it does.
Update, November 2024: The Cyber Security Act 2024 received Royal Assent on 29 November 2024, implementing four Strategy initiatives including smart-device security standards and mandatory ransomware payment reporting.
- fyi Digital ID
The Digital ID Bill reaches Parliament — finance.gov.au
The Digital ID Bill 2023 and the Digital ID (Transitional and Consequential Provisions) Bill 2023 were introduced in the Senate on 30 November 2023. The Bills establish a voluntary Accreditation Scheme for digital ID providers across the public and private sectors, create the Australian Government Digital ID System allowing people to verify identity online using existing government documents, appoint the ACCC as Digital ID Regulator, and give the Information Commissioner an expanded privacy oversight role. Finance framed the case around identity crime costing Australia over $3 billion a year on Australian Institute of Criminology estimates.
For teams building identity-dependent services this is where accredited Digital ID stopped being a DTA framework and became a statutory scheme with a named regulator. It is also the structural answer to the retention problem exposed by the Optus and Medibank breaches in 2022 and Latitude's in 2023 — the fix is to stop collecting and storing identity documents in your own system rather than to protect them better, which is a design decision rather than a security control.
Update, May 2024: The Digital ID Bill (retitled Digital ID Bill 2024) and the transitional Bill finally passed both Houses on 16 May 2024 and received Royal Assent on 30 May 2024.
CMS and platforms
Sections- critical Drupal
Drupal 9 reaches end of life — drupal.org
PSA-2023-11-01 confirmed Drupal 9 reached end of life on 1 November 2023, with no further releases. The date was tied to upstream dependencies — Symfony, CKEditor and Twig — reaching their own end of life. The announcement flagged two follow-on changes before the end of January 2024: DrupalCI would stop supporting Drupal 9, and contributed project release branches supporting only Drupal 9 would be marked unsupported. Contrib maintainers were asked to tag a minor release supporting both 9 and 10 where possible, for a smooth upgrade path.
From this date a Drupal 9 site receives no further releases, security fixes included. Because the date was tied to the end of life of upstream dependencies rather than set on its own, treat it as fixed when planning Drupal 10 upgrades.
- fyi WordPress
WordPress 6.4 adds Block Hooks and a new default theme — wordpress.org
Released 7 November 2023 and named for Shirley Horn. It shipped the Twenty Twenty-Four default theme with more than 35 templates and patterns, keyboard shortcuts and smarter list merging in List View, a refreshed Command Palette with block-specific commands, custom pattern categories with inserter filtering, background images in Group blocks, an image lightbox, buttons in Navigation blocks, more than 100 performance updates, and Block Hooks for automatically inserting dynamic blocks at defined locations. Over 600 contributors from at least 56 countries delivered more than 1,150 enhancements and fixes.
Block Hooks is the change that matters if you ship a WordPress plugin — it is the supported mechanism for injecting blocks into block themes, which previously required approaches that broke whenever a theme changed.
Supply chain, CI/CD and IaC
Sections- fyi PyPI
PyPI publishes its first security audit — blog.pypi.org
On 14 November 2023 PyPI published the results of its first-ever security audit, conducted by Trail of Bits, funded by the Open Technology Fund and running to ten engineer-weeks. Scope covered Warehouse, the codebase running pypi.org, and cabotage, PyPI's custom container orchestration framework, including both code review and CI/CD configuration. Trail of Bits reported 29 advisories, of which 14 were rated informational, six low, eight medium and zero high. PyPI states it remediated all advisories posing significant risk in both codebases where possible, with companion posts detailing the remediation per codebase.
Low operational impact and high assurance value: zero high-severity findings on the index you publish to is a useful data point for a supply-chain risk register, and it is rare to be able to cite one at all. The transferable part is the audit's CI/CD scope — it is a published worked example of what auditing a publishing pipeline looks like, which is a harder thing to specify than auditing application code.
- fyi OpenTofu
The OpenTofu registry is ready enough for a beta — opentofu.org
OpenTofu's beta, v1.6.0-beta1, landed on 29 November 2023, eight weeks after the 4 October alpha. The significance of the beta is the registry, OpenTofu's resolution service for providers and modules, which debuted with this release.
If you publish a Terraform provider, the beta is the point at which testing your provider against tofu became a reasonable ask rather than a research project. That is a lower bar than it sounds: the whole question through October was whether a fork could resolve providers at all, and this is the release where the answer became yes.
Update, December 2023: OpenTofu v1.6.0-rc1 shipped on 19 December 2023, with general availability set for 10 January 2024.
Languages, runtimes and frameworks
Sections- notable PHP
PHP 8.3 arrives and PHP 8.0 dies three days later — php.net
PHP 8.3.0 was released on 23 November 2023, bringing typed class constants, dynamic class constant fetch syntax, readonly amendments, the Override attribute, a randomiser method for drawing bytes from a string, and json_validate. Three days later, on 26 November, the PHP 8.0 branch reached end of life, with 8.0.30 from 4 August as its final release.
The two dates compound for anyone on 8.0: from 26 November that branch receives no further security fixes, so any flaw found from here on stays open. Its final release, 8.0.30, was itself a security release, so an 8.0 site should be on it while it migrates. The migration target is 8.2 or the freshly released 8.3. Take these dates from php.net rather than an end-of-life tracking vendor.
Update, March 2024: PHP's accepted release-cycle RFC gives each branch two years of bug fixes and two years of security fixes ending on 31 December, applying from PHP 8.2, with 8.1 getting an extra year of security fixes.
Update, April 2024: PHP's accepted release-cycle RFC gives each branch two years of bug fixes and two years of security fixes ending on 31 December, applying from PHP 8.2, with 8.1 getting an extra year of security fixes.
- notable Symfony
Symfony 6.4 LTS and 7.0 ship the same day — symfony.com
Symfony 6.4.0 and 7.0.0 were both released on 29 November 2023. 6.4 is a long-term support version, with bug fixes to November 2026 and security fixes to November 2027, and requires PHP 8.1 or higher. 7.0 requires PHP 8.2 or higher and reaches end of support in July 2024, a short window typical of a non-LTS point-zero release.
Target 6.4 LTS, not 7.0, for anything in the integrations catalogue — the higher version number is the wrong signal here, and 7.0 goes out of support eight months after release.
- notable Go
Go mishandles Windows device paths — pkg.go.dev
Go 1.20.11 and 1.21.4 shipped on 7 November 2023 with a path/filepath fix. CVE-2023-45283 (GO-2023-2185), CVSS 7.5, is that the filepath package did not treat Windows paths beginning with \??\, a root local device prefix, as special, so Clean and Join could silently convert an innocuous-looking sequence into one — a path traversal reaching arbitrary system locations. It affects Go before 1.20.11 and 1.21.0 through 1.21.3. The fix converts such paths to relative form, treats them as absolute and reports volume names correctly.
Windows-hosted Go services doing any path handling on user input are the real exposure, and Linux-only deployments are unaffected in practice — but rebuild on 1.20.11 or 1.21.4 anyway, because the cost is nil and the assumption that a service will only ever run on Linux tends to outlive the decision that made it true.
Update, December 2023: Go 1.20.11 and 1.21.4 inadvertently changed how Windows volume names in \\?\ paths are handled; Go 1.20.12 and 1.21.5 restored the previous behaviour, so take those or later.
Static site and web tooling
Sections- notable Vite
Vite 5 moves the manifest and breaks deploys quietly — vite.dev
Released 16 November 2023 with real build-output and deploy consequences. Node 14, 16, 17 and 19 support was dropped, requiring Node 18 or 20 and later. The CJS Node API is deprecated, breaking programmatic consumers that require Vite rather than importing it. Manifest files moved: they are now generated into a .vite directory by default. Also shipped: Rollup 4, define reworked to use AST replacements instead of regular expressions, changed SSR externalised-module behaviour, and removal of the https flag.
The manifest move is the sharpest edge, because it breaks silently rather than loudly — any deploy pipeline, asset-mapping backend such as the Laravel Vite plugin or Symfony AssetMapper, or CDN configuration that reads manifest.json from the old location simply stops finding it. Check that before upgrading, not after.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more