Radar · 2024-03
March 2024
A backdoor in xz and liblzma 5.6.0 and 5.6.1 is disclosed before those versions were widely integrated, an unauthenticated SQL injection in FortiClientEMS is rated CVSS 9.8, a critical Drupal contrib bypass hands every role to new registrants, PyPI suspends new registrations against an automated malware campaign and the Digital ID Bill passes the Senate.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- fyi Anthropic
The Claude 3 family launches with day-one Bedrock availability — anthropic.com
Announced 4 March 2024, Opus, Sonnet and Haiku all carry a 200K context window and vision input. Claude 3 Sonnet was available on Amazon Bedrock on day one and in private preview on Vertex AI Model Garden, with Opus and Haiku listed as coming soon to both. The API was generally available in 159 countries.
Teams already on Bedrock should check regional availability before assuming an in-country inference path — the announcement names no Sydney region.
- fyi AI governance
US federal agencies get binding AI governance requirements — bidenwhitehouse.archives.gov
OMB memorandum M-24-10, signed 28 March 2024, requires each federal agency to designate a Chief AI Officer within 60 days, publish annual AI use case inventories flagging safety-impacting and rights-impacting systems, and implement minimum practices — impact assessment, real-world testing, independent evaluation, ongoing monitoring, staff training and an appeal process — by 1 December 2024, or stop using the system.
Read the minimum-practices section as a checklist against any AI feature proposed for a government site. The discontinue-if-non-compliant clause is the part procurement teams tend to miss.
- fyi OpenAI
OpenAI previews a voice-cloning model but declines to release it — openai.com
Described on 29 March 2024, Voice Engine generates speech resembling a speaker from a single fifteen-second sample. OpenAI said it was choosing to preview but not widely release the technology at that time, and named its controls: usage policies barring impersonation without consent, a requirement for explicit informed consent from the original speaker, mandatory disclosure to end users that audio is AI-generated, watermarking to trace origin, proactive monitoring, and no self-serve voice creation.
Worth citing when drafting synthetic-media and deepfake policy: the watermark-plus-consent-plus-disclosure triad is a reusable control set, and a frontier lab publicly withholding a working capability on election-year grounds is a useful precedent.
Security and edge
Sections- critical xz
A backdoor in xz is disclosed before 5.6.x is widely integrated — openwall.com
Disclosed to the oss-security mailing list on 29 March 2024, CVE-2024-3094 is a backdoor in xz and liblzma 5.6.0 and 5.6.1 that can lead to SSH server compromise, scored CVSS 10.0. One portion of the backdoor — the configure/build injection — shipped only in the release tarballs; the obfuscated payload files were also committed upstream. Andres Freund's report says 5.6.0 and 5.6.1 had not yet been widely integrated by Linux distributions, and where they had, mostly in pre-release versions.
Confirm no build or base image pulled xz 5.6.0 or 5.6.1 during March, and specifically audit anything that built from release tarballs rather than from git. Re-check container images rebuilt in the last week of March.
- critical Fortinet
Unauthenticated SQL injection in FortiClientEMS rated CVSS 9.8 — nvd.nist.gov
Published 12 March 2024, CVE-2023-48788 is an improper neutralisation of special elements in an SQL command in FortiClientEMS 7.0.1 through 7.0.10 and 7.2.0 through 7.2.2, allowing an unauthenticated attacker to execute code via crafted packets. CVSS 9.8, network-reachable, no privileges required.
Patch to the fixed release named in Fortinet's own advisory and treat any unpatched internet-exposed management server as potentially compromised rather than merely vulnerable. This is pre-authentication code execution on a management server — the same class of exposure that drove the Ivanti incidents earlier in the year.
- notable Chrome
Three Chrome stable updates in a month, two closing Pwn2Own renderer escapes — chromereleases.googleblog.com
Chrome 123.0.6312.86 and .87, released 26 March 2024, carried seven security fixes including CVE-2024-2883, a critical use-after-free in ANGLE, plus use-after-free flaws in Dawn and WebCodecs and a type confusion in WebAssembly, two of them credited to Pwn2Own 2024. Chrome 123 had been promoted to stable a week earlier on 19 March with twelve security fixes, and 122.0.6261.128/.129 shipped on 12 March with three.
Confirm managed fleets are at 123.0.6312.86 or later. If your standard operating environment pins Chrome versions, check that the 26 March build has landed and not just the 19 March release of 123.
Standards and compliance
Sections- notable ISM
ASD publishes the March 2024 Information Security Manual — cyber.gov.au
ASD published the March 2024 Information Security Manual on 1 March, with a two-page changes document. It adds five controls. Four of them, ISM-1913 to ISM-1916, call for approved configurations to be developed, implemented and maintained for ICT equipment, operating systems, user applications and server applications, as steps towards zero trust. The fifth, ISM-1917, asks organisations to consider future cryptographic requirements and dependencies during the move to post-quantum standards. DSA loses its status as an ASD-approved cryptographic algorithm after NIST withdrew FIPS 186-4, and elliptic-curve selection now points to NIST SP 800-186.
Diff the changes document against your current control mapping, and if you hold an ISM-aligned assessment, confirm which ISM version it cites. The quarterly cadence means a March release resets the goalposts for any assessment or authorisation in progress.
- notable EU AI Act
European Parliament adopts the AI Act, 523 to 46 — europarl.europa.eu
Adopted in plenary on 13 March 2024 with 49 abstentions, the regulation bans biometric categorisation on sensitive characteristics, untargeted facial-image scraping, emotion recognition in workplaces and schools, social scoring, profiling-only predictive policing and manipulative AI. General-purpose models face transparency, copyright-compliance and training-content-summary duties. The staged timeline runs from entry into force twenty days after publication, to prohibitions at six months, codes of practice at nine, general-purpose rules at twelve, full applicability at twenty-four and high-risk obligations at thirty-six.
Map the staged milestones against any AI feature roadmap touching EU users. The prohibitions bite first and hardest, and those staged dates became the de facto planning calendar for anyone with EU-facing digital services.
- fyi Digital ID
The Digital ID Bill passes the Senate — ministers.finance.gov.au
On 27 March 2024 the Senate passed the Digital ID Bill 2023, establishing an economy-wide Digital ID system and providing for the phased expansion of the Australian Government's Digital ID system to state and territory government services and the private sector. A Senate Economics Legislation Committee inquiry had recommended the Bill be passed.
Note the requirement that Australian Government agencies must have an alternative way for individuals to access government services. That is a service-design constraint on agency websites and forms, not just a policy commitment.
CMS and platforms
Sections- notable Drupal
Critical access bypass hands every role to new registrants (SA-CONTRIB-2024-015) — drupal.org
Published 6 March 2024 and rated critical (18/25), CVE-2024-13251 affects the Registration role module before 2.0.1. On sites where new module code was deployed without running Drupal's update process, non-selected roles remained in configuration and newly registering users received every role rather than only the intended ones. Fixed in 2.0.1.
Upgrade and run update hooks, or immediately resave configuration at /admin/people/registration-role. Then do the part that patching does not cover: the advisory tells you to audit every account registered since 11 July 2023 for unintended role assignments.
- notable WordPress
The 6.5 field guide lands, with a MySQL floor and plugin dependencies — make.wordpress.org
Published 15 March 2024, the Make WordPress Core field guide for 6.5 documents the Interactivity API for front-end interactivity without third-party libraries, the Font Library, the Block Bindings API for binding block attributes to custom field values, Plugin Dependencies via a new Requires Plugins header, AVIF image support, a Script Modules API and a substantial HTML Tag Processor overhaul. The minimum MySQL version rises from 5.0 to 5.5.5.
Check MySQL versions across environments against the 5.5.5 floor and review custom plugins for the new Requires Plugins header before upgrading. The field guide is the authoritative breaking-change and deprecation reference for the release.
- notable Craft CMS
Craft CMS 5 ships as a major version — craftcms.com
Released 26 March 2024, Craft 5 brings a modernised control panel, expanded content modelling and a CKEditor plugin supporting nested entries for longform content. A new Team edition sits between Solo and Pro, covering up to five users with multi-site, GraphQL and advanced content previewing.
If you run Craft 4, scope the major-version upgrade now.
Supply chain, CI/CD and IaC
Sections- critical PyPI
A typosquatted package index host slips past name-based allowlists — thehackernews.com
Reported 25 March 2024, attackers hijacked a legitimate maintainer's GitHub account using stolen session cookies — bypassing password authentication — then modified requirements.txt files to pull trojanised dependencies from files.pypihosted.org, a typosquat of files.pythonhosted.org. The campaign published at least fourteen malicious PyPI packages including a fake colorama, and the payload established Windows registry persistence and stole browser credentials, cookies and session tokens.
Pin your package index host explicitly and alert on any index-url, extra-index-url or requirements-file host that is not files.pythonhosted.org. Shorten GitHub session lifetimes and review maintainer session hygiene, not just MFA enrolment.
- critical PyPI
PyPI suspends new registrations against an automated malware campaign — bleepingcomputer.com
On 28 March 2024 PyPI temporarily halted both new user registrations and new project creation in response to an automated malicious-upload campaign. The packages used typosquatted names and executed encrypted code at install time, fetching further payloads and acting as an infostealer targeting browser passwords and cookies. Each maintainer account uploaded exactly one package, indicating automation; reported counts range from 365 to more than 500 packages.
Review builds from late March for newly introduced Python dependencies, and move to a vetted internal index or hash-pinned lockfiles rather than relying on the public index's own hygiene.
- notable Dependabot
Dependabot grouped security updates reach general availability — github.blog
Announced 28 March 2024, grouped security updates consolidate all available security updates per repository ecosystem into a single pull request across directories. Configuration can group by package name, dependency type or semver level. It requires the dependency graph, Dependabot alerts and Dependabot security updates to already be enabled.
If Dependabot is enabled but its pull requests are being ignored, turn on grouping and set a semver-level policy so patch updates batch while majors stay separate. Pull-request volume is the main reason Dependabot gets muted on large estates, and a muted Dependabot is why a genuine critical gets missed.
Languages, runtimes and frameworks
Sections- notable Go
Go patches certificate verification, HTTP parsing and template escaping — pkg.go.dev
Published 5 March 2024 as GO-2024-2598 (CVE-2024-24783):
Certificate.Verifypanics on a certificate with an unknown public key algorithm. Go 1.22.1 and 1.21.8, released the same day, carry five security fixes: CVE-2024-24783 (crypto/x509), CVE-2023-45290 (net/http multipart), CVE-2023-45289 (net/http and cookiejar redirects), CVE-2024-24785 (html/template) and CVE-2024-24784 (net/mail).Rebuild Go binaries on 1.22.1 or 1.21.8 or later, and separately bump google.golang.org/protobuf to v1.33.0 or later for CVE-2024-24786, published the same day.
- notable Python
Security releases for Python 3.10, 3.9 and 3.8 — python.org
Python 3.10.14, 3.9.19 and 3.8.19 shipped 19 March 2024 as security releases. They bundle libexpat 2.6.0 for CVE-2023-52425, fix CVE-2024-0450 — a quoted-overlap zipbomb in zipfile, which now raises BadZipFile when entries overlap — and fix CVE-2023-6597, where tempfile.TemporaryDirectory cleanup dereferenced symlinks during permission-error handling. The 3.10 branch is security-only and source-only, with no binary installers.
Patch anything still on 3.8, 3.9 or 3.10. With no binary installers for 3.10, container base images and source builds are the upgrade path.
- notable Laravel
Laravel 11 slims the application skeleton and adds a first-party WebSocket server — laravel.com
Released 12 March 2024, Laravel 11 moved the HTTP and console kernels, the exception handler and nine rarely customised middlewares into the framework, consolidated providers to one, and relocated routing, middleware and exception configuration into bootstrap/app.php. New applications default to SQLite for database, sessions, cache and queue. Also added: a /up health-check endpoint dispatching a DiagnosingHealth event, per-second rate limiting, graceful encryption key rotation via APP_PREVIOUS_KEYS, and Laravel Reverb, a first-party WebSocket server scaling over Redis pub/sub.
For new projects, adopt the slim skeleton deliberately rather than porting Laravel 10 structure. For existing applications, APP_PREVIOUS_KEYS is worth backporting into your key-rotation runbook — it makes rotation possible without downtime, which is an ISM-relevant control.
Static site and web tooling
Sections- notable Astro
Astro 4.5 adds a dev audit panel and per-file-type CDN prefixes — astro.build
Released 11 March 2024, Astro 4.5 shipped a browser-based Dev Audit panel surfacing performance and accessibility issues during development, view-transition improvements including islands with transition:persist re-rendering with new props, migration back to official Shiki 1.0 for syntax highlighting, and build.assetsPrefix accepting different CDN prefixes per file type.
If you set build.assetsPrefix as a single string, review whether per-type prefixes now serve you better. Try the Dev Audit panel against your accessibility acceptance criteria — surfacing those checks at development time rather than at audit time is a genuine WCAG workflow improvement.
- notable Nuxt
Nuxt 3.11 adds preview mode and automatic payload cache-busting — nuxt.com
Released 16 March 2024, Nuxt 3.11 added a usePreviewMode composable so data fetching bypasses cached payloads in preview, automatic payload cache-busting when the app manifest is enabled, middleware defined via routeRules for specific paths, a clear() function to reset useAsyncData and useFetch state, .server.vue and .client.vue page suffixes for selective rendering, and layered prerender caching.
If you have hand-rolled cache-busting for Nuxt payloads, check whether the automatic behaviour supersedes it, and adopt usePreviewMode for editorial preview flows.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more