Radar · 2023-12
December 2023
The Australian hosting code becomes a live enforceable obligation for anyone hosting Australian end-user content, a phished former employee's npm account is used to publish a wallet drainer that every consuming site serves without redeploying anything, WordPress patches a remote code execution that core alone cannot trigger but a plugin can complete, Home Affairs opens a summer consultation on cyber legislative reforms, and Bedrock closes the year in five regions, none of them Australian.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- fyi AWS
Bedrock ends 2023 in five regions, none of them Australian — aws.amazon.com
On 21 December 2023 Bedrock became available in AWS GovCloud (US-West). The announcement states the resulting footprint as five regions: US East (N. Virginia), US West (Oregon), Asia Pacific (Tokyo), Europe (Frankfurt) and AWS GovCloud (US-West). None of those named regions is Australian.
Use AWS's 21 December announcement when auditing residency claims made about 2023 Bedrock workloads: its five-region list includes no Australian region. If a 2023 contract asserts Australian residency for Bedrock inference, that is a finding in its own right.
Update, April 2024: Bedrock became available in the Asia Pacific (Sydney) Region on 9 April 2024.
Security and edge
Sections- notable curl
curl accepts a super cookie and can silently wipe its HSTS cache — curl.se
Two flaws announced 6 December 2023 and fixed in curl 8.5.0. CVE-2023-46218, rated Medium and affecting 7.46.0 through 8.4.0, is that curl's Public Suffix List check compared cookie domains case-sensitively, so a malicious server could set a cookie for a domain written in mixed case and have it accepted against a host under that public suffix — producing a super cookie sent to unintended origins. It only manifests in builds compiled with PSL support. CVE-2023-46219, rated Low and affecting 7.84.0 through 8.4.0, is that when the HSTS cache filename approached the filesystem's maximum path length the save routine could remove all contents, leaving an empty cache.
Upgrade libcurl to 8.5.0 for both. The cookie flaw matters for Australian work because com.au is itself a public suffix, so the protection being bypassed is the one stopping a cookie being scoped across every unrelated site under it. Check server-side fetching that uses a shared cookie jar. The HSTS failure is the quieter one: losing the cache means requests that should have been forced to HTTPS are not. Enforce HTTPS at the call site rather than relying on curl's cache as a control.
- notable TLS
The TrustCor roots finally leave the store — mozilla.org
Bug 1851049 removed the three TrustCor roots from NSS entirely, shipping in NSS 3.95 on 16 November 2023 and reaching users in Firefox 121 on 19 December 2023 — a year after the distrust-after date of 30 November 2022 stopped them signing anything new. The bug's own whiteboard says the change landed in NSS 3.94, which is wrong: 3.94 carries no root-store change and it is 3.95's release notes that name this bug.
If anything in your estate still chains to a TrustCor root, Firefox 121 is where it stops working altogether rather than merely stopping new issuance, so this is one inventory pass before that build reaches your users. The pattern is the part to carry forward: root programs now retire a CA in two moves, a dated distrust and then a removal a year later, and the operationally important date is the first one.
Standards and compliance
Sections- critical eSafety
The hosting code becomes a live enforceable obligation — esafety.gov.au
Six months after their June 2023 registration, the five Phase 1 industry codes under the Online Safety Act 2021 became mandatory and enforceable in December — covering social media services, app distribution services, internet carriage services, equipment, and hosting services. Covered services must provide safety information and reporting tools, act on complaints about the worst-of-the-worst content including child sexual abuse material and pro-terror material, and comply with the eSafety Commissioner's directions where non-compliance is found. The separately registered search engine code commenced later on its own six-month clock.
The Hosting Services code is a live Australian obligation on anyone hosting Australian end-user content, which reaches agencies and their web platform partners running user-generated content, file upload, media libraries or comment functionality. It needs three things that are documents rather than technology: a working reporting path, a documented complaints response, and the ability to act on an eSafety direction. This is the single 2023 item most likely to have been missed by teams who assumed online safety codes were a big tech problem. Confirm the commencement date against the eSafety register before quoting a day.
- notable ASD
ASD publishes the December 2023 Information Security Manual — cyber.gov.au
ASD published the December 2023 Information Security Manual on 1 December 2023.
The December 2023 ISM is the version an early-2024 IRAP assessment or authorisation to operate should name, if that is the edition the assessment used.
- fyi Home Affairs
Home Affairs opens a summer consultation on cyber legislative reforms — homeaffairs.gov.au
Home Affairs opened consultation on the legislative reforms needed to deliver the 2023-2030 Australian Cyber Security Strategy, running 18 December 2023 to 1 March 2024. The paper has two parts. Part 1 proposes four new cyber security measures — mandatory ransomware and cyber extortion payment reporting, minimum security standards for smart devices, a limited-use obligation to encourage incident reporting, and a Cyber Incident Review Board. Part 2 proposes amendments to the Security of Critical Infrastructure Act 2018, including bringing business-critical data storage systems within the definition of a critical infrastructure asset.
Two proposals matter most to web and hosting teams: extending SOCI to data storage systems holding business-critical data, which pulls more platforms into CIRMP scope, and minimum standards for connected devices. Note the timing as much as the content — opening on 18 December with a 1 March close runs straight through the Australian summer, so any submission needs planning before the break.
Update, November 2024: The Cyber Security Act 2024 received Royal Assent on 29 November 2024, legislating the four Part 1 measures; ransomware payment reporting starts on 30 May 2025.
CMS and platforms
Sections- notable WordPress
WordPress patches an RCE that only plugins can complete — wordpress.org
Released 6 December 2023, fixing seven Core bugs and one security issue described as a remote code execution vulnerability that is not directly exploitable in core, but which the security team judged had potential for high severity when combined with some plugins, especially in multisite installations. Site owners were told to update immediately, and background updates delivered it automatically.
Prioritise multisite estates and any site with a large plugin surface. The important consequence is about how you reason rather than what you patch: because the risk only becomes serious in combination with some plugins, "we audited core and found nothing exploitable" is not a valid reason to defer, and neither is a clean scan of core files. The exploitability lives in a combination that no single component's audit would surface.
- notable Drupal
Drupal 10.2 arrives as 10.0 leaves support — drupal.org
Drupal 10.2.0 was released on 15 December 2023, the second Drupal 10 minor. The filter system now outputs HTML5 with minor changes to rendered markup; Views require labels when created programmatically or imported from configuration; Action and Block plugins can move from annotations to PHP attributes; filename sanitisation became configurable in the UI; and a new VariationCache API landed. It supports PHP 8.3, requires Symfony 6.4 components and Drush 12.4.3 or greater. Security support for Drupal 10.0.x ended with this release, leaving 10.1 (supported until June 2024) and 10.2 as the supported Drupal 10 branches.
The two facts compound for anyone who upgraded from Drupal 9 straight onto 10.0 during the mid-2023 rush — that gave roughly six months before another minor upgrade was required, which is not what most teams thought they were buying. The target is 10.1.x, supported to June 2024, or 10.2.x. When upgrading, the HTML5 filter change and the Views label requirement are the two most likely regression sources, so test config imports and rendered output rather than just the build.
- notable GovCMS
CKEditor 4 security coverage ends — govcms.gov.au
GovCMS told agencies on 30 October 2023 that they must complete the CKEditor 4 to CKEditor 5 migration before the end of 2023, because CKEditor 4 ceases security coverage at that point. This was the immediate post-Drupal-10 task for the Australian government fleet, alongside the Swift Mailer to Symfony Mailer move and removal of the deprecated panels, panelizer, video embed field and govcms8 modifiers modules.
For GovCMS PaaS builds, any custom text format still bound to CKEditor 4 became an unsupported dependency at the end of 2023.
Supply chain, CI/CD and IaC
Sections- critical npm
A phished former employee's npm account drains wallets through Connect Kit — bleepingcomputer.com
On 14 December 2023 attackers published malicious versions 1.1.5, 1.1.6 and 1.1.7 of a widely used Ledger npm package after phishing a former employee whose npm account still had publish rights. Version 1.1.5 carried a test message; the next two carried heavily obfuscated wallet-drainer JavaScript. Because the package is loaded at runtime by many third-party applications, every consuming site served the malicious code without redeploying anything. Ledger puts about five hours between the npm compromise and full resolution, with active draining confined to under two hours and a clean 1.1.8 published about forty minutes after Ledger became aware. Ledger has not published a loss total; BleepingComputer reported about US$600,000 stolen and noted other reports of about US$680,000.
Two concrete controls, and neither is about code. First, audit npm organisation membership for departed staff and stale publish tokens — this attack needed no vulnerability at all, only an account that outlived an employment. Second, note the delivery model: consumers pulling a floating version were compromised automatically with no action on their part. If your own SDKs are loaded at runtime by customers, version pinning and Subresource Integrity are the only defences your customers have, which makes documenting them part of shipping the SDK.
- notable PyPI
A PyPI account takeover moves four projects in eight minutes — blog.pypi.org
Published 4 December 2023, PyPI's report covers a 22 November incident in which an account was taken over and used to seize four projects. The whole takeover took eight minutes: the attacker created a second account, was invited as collaborator on all four projects, accepted, removed the original owner, then deleted the compromised account. PyPI froze the attacker account about six hours later and closed the incident with ownership restored. Existing package files were not modified, and the victim's password had not appeared in any known breach. PyPI then announced on 13 December that 2FA would be required for all accounts from 1 January 2024, having enforced it on TestPyPI from the 6th.
The failure mode is ownership transfer rather than malicious code, which most supply-chain thinking does not cover — nothing was published, so nothing would have been detected by scanning artefacts. Check that every PyPI project you own lists more than one maintainer, and that collaborator-invite emails go somewhere a human actually reads. 2FA on all PyPI accounts becomes mandatory from 1 January 2024, closing the staircase this radar has followed since June.
- notable GitHub Actions
Actions Artifacts v4 makes artifacts immutable — github.blog
The v4 upload and download actions went generally available on 14 December 2023, with GitHub citing up to 10x performance improvements. v4 is not backward compatible with previous versions: artifacts become immutable once uploaded, so you cannot append to an existing artifact name from parallel jobs, and a v3 artifact cannot be used with download-artifact@v4. Uploads are faster and artifacts become downloadable immediately rather than at job end.
The immutability change is the migration trap: matrix builds that all uploaded to a single shared artifact name under v3 fail outright under v4 and need unique names plus a merge step using pattern and merge-multiple. Check any matrix job that shares an artifact name before migrating.
Update, April 2024: GitHub deprecated v3 of the artifact actions: from 30 January 2025 GitHub.com workflows can no longer use them, so the v4 migration has a hard deadline.
Languages, runtimes and frameworks
Sections- notable Go
Go's December net/http fix is a chunked-encoding read amplification — pkg.go.dev
CVE-2023-39326: a malicious HTTP sender can use chunk extensions so a receiver reads far more bytes from the network than are in the body — up to about 1GiB when a handler does not fully consume a request. The chunked reader discarded that metadata; the fix errors if the ratio of real body to encoded bytes grows too small. Affected are net/http before 1.20.12 and from 1.21.0 before 1.21.5. The same releases also fix CVE-2023-45285 in cmd/go, where go get of a module ending in .git could fall back to git:// when HTTPS and git+ssh failed (GOPROXY=off only). Go's release history dates both 1.20.12 and 1.21.5 to 5 December 2023.
The exposed pattern is common: any handler that returns early without draining the request body. Worth grepping for rather than assuming, because the code looks correct.
Static site and web tooling
Sections- notable Astro
Astro 4.0 is a gentle major built on Vite 5 — astro.build
Released 5 December 2023, it upgrades Astro from Vite 4 to Vite 5. It brings the Dev Toolbar with inspect, audit and third-party app capabilities, browser-only during development and never included in a production build; built-in i18n routing with automatic locale routing, fallbacks and prefixing; experimental incremental content caching, which the announcement reports cut the Astro Docs build time by 80 per cent; and an expanded View Transitions API covering forms, prefetching, route announcements and a navigate function for manual control. Unusually for a major, the announcement states most existing codebases will experience zero issues upgrading.
Target this version going into 2024 — the incremental content cache is the material build-performance win and the i18n routing removes a common reason to fork routing behaviour.
- fyi Nuxt
Nuxt 2 support runs to 30 June 2024, past Vue 2's end of life — v2.nuxt.com
Nuxt's "A vision for 2023" post of 17 January 2023 said that on 31 December 2023 Vue 2 would reach end of life and Nuxt 2 with it, while committing to backport key bug and security fixes during the transition. Nuxt's LTS page now gives a later date for Nuxt 2: Vue 2 still reaches end of life on 31 December 2023, but Nuxt 2 will follow on 30 June 2024, after which it stays on npm without updates.
Check any migration plan built on the January 2023 post. Its 31 December 2023 cutover now applies to Vue 2 only, and Nuxt gives Nuxt 2 until 30 June 2024. Take the date from Nuxt's own LTS page rather than secondary sources.
Update, June 2024: Nuxt's 14 June 2024 announcement confirmed Nuxt 2 end of life on 30 June 2024, with a final 2.18.0 release planned for the end of June.
- fyi Jekyll
Jekyll 4.3.3 ships a Ruby 3.3 and logger fix — jekyllrb.com
Jekyll 4.3.3 shipped on 27 December 2023 and 3.9.4 the following day. The announcement calls 4.3.3 a very small release containing a fix for using Jekyll with Ruby 3.3 and the new logger gem included with it, plus a test-suite fix for newer Rubies to help downstream packagers. Jekyll's only other releases in 2023 were 4.3.2 and 3.9.3 in January.
Ruby 3.3 landed on 25 December, two days before this fix. If CI tracks the current Ruby, pin the language version rather than latest.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more