Radar
Radar 2024
Every month we round up the releases, advisories and standards worth your attention across the stack we run and the platforms we integrate with. Seven buckets: AI, security and edge, Australian compliance, CMS platforms, supply chain and CI/CD, languages and frameworks, and static site tooling.
2024
236 items · 42 critical
The year the supply chain attack moved upstream of the package. A backdoor was planted in xz release tarballs and caught days from stable distributions. Five plugins were backdoored inside the WordPress.org repository itself, and a polyfill script began serving redirects to over 110,000 sites. Edge devices were the other front, with Ivanti, PAN-OS and FortiManager each exploited before or barely after a patch existed. In Australia the Digital ID Act received assent, the first tranche of Privacy Act reform became law and the OAIC found Bunnings had breached the Act with facial recognition.
December 2024
Drupal 7 support ends on 5 January, the Ultralytics package is compromised in a PyPI supply chain attack, an exploited WordPress plugin is used to install further vulnerable plugins, the first tranche of Privacy Act reform becomes law and Astro 5.0 ships with the Content Layer and Server Islands.
November 2024
The OAIC finds Bunnings breached the Privacy Act with facial recognition across 63 stores, Drupal 7 Overlay gets a critical reflected-XSS fix, an authentication bypass in a WordPress security plugin hands over administrator access, an exploited PAN-OS chain reaches CISA's catalogue, and the Cyber Security Act 2024 receives assent.
October 2024
A FortiManager missing-authentication flaw is exploited as a zero-day, a default OWASP Core Rule Set configuration skips request-body inspection on some platforms, Drupal marks wkhtmltopdf unsupported, WordPress.org forks Advanced Custom Fields and auto-updates swap it out beneath live sites, and malicious lottie-player builds reach sites pinned to @latest.
September 2024
Chained CUPS flaws give remote code execution on Linux print systems, a signature-verification flaw in ruby-saml allows full authentication bypass, WordPress.org cuts a major host off from the update servers, Australia publishes its Voluntary AI Safety Standard alongside consultation on mandatory guardrails and the whole-of-government AI policy takes effect.
August 2024
A zero-click remote code execution lands in the Windows TCP/IP stack, a guessable seed hands administrator access on five million WordPress sites, a Jenkins controller file read is rated Critical, Chrome 128 patches two V8 flaws already exploited in the wild and Drupal 11 is released.
July 2024
A pre-authentication root hole in OpenSSH opens the month, a zero-length request body bypasses Docker authorisation plugins, Apache httpd needs three security releases in seventeen days to fix its own regressions, a faulty endpoint-security update takes out Windows fleets worldwide and Digital Service Standard 2.0 becomes mandatory for new Commonwealth services.
June 2024
A PHP-CGI argument injection is exploited within days of disclosure, a third-party polyfill script serves redirects to over 110,000 sites, five plugins are backdoored inside the WordPress.org repository, Chrome moves to distrust Entrust and the June ISM brings large language models into the accreditation baseline.
May 2024
Four exploited Chrome zero-days land in fifteen days, a SAML authentication bypass in GitHub Enterprise Server is rated CVSS 10.0, a critical Drupal 7 advisory discloses user data to anonymous requests, the Digital ID Act receives royal assent and Drupal announces the Starshot initiative that became Drupal CMS.
April 2024
ACSC warns that a PAN-OS GlobalProtect command injection is being exploited, a command injection in Rust's standard library on Windows is rated critical, CONTINUATION frames break many HTTP/2 implementations, Amazon Bedrock reaches the Sydney region and WordPress 6.5 ships with the Font Library and plugin dependencies.
March 2024
A backdoor in xz and liblzma 5.6.0 and 5.6.1 is disclosed before those versions were widely integrated, an unauthenticated SQL injection in FortiClientEMS is rated CVSS 9.8, a critical Drupal contrib bypass hands every role to new registrants, PyPI suspends new registrations against an automated malware campaign and the Digital ID Bill passes the Senate.
February 2024
ASD warns that Ivanti implants survive factory resets, a ScreenConnect authentication bypass rated CVSS 10.0 reaches CISA's exploited catalogue, an unauthenticated RCE in the Bricks Builder theme is exploited a day after patching, nginx patches two HTTP/3 flaws as its lead maintainer forks the project and OAIC reports a fourfold rise in supply-chain breach notifications.
January 2024
Ivanti Connect Secure and Policy Secure are under active exploitation for an authentication bypass and a command injection, a runc escape reaches the host filesystem, a Jenkins CLI file read opens a path to remote code execution, Confluence template injection gives unauthenticated RCE, and ASD publishes guidance on engaging with AI.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more