Radar · 2024-05
May 2024
Four exploited Chrome zero-days land in fifteen days, a SAML authentication bypass in GitHub Enterprise Server is rated CVSS 10.0, a critical Drupal 7 advisory discloses user data to anonymous requests, the Digital ID Act receives royal assent and Drupal announces the Starshot initiative that became Drupal CMS.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- fyi OpenAI
GPT-4o resets the price and latency baseline — openai.com
Announced 13 May 2024, GPT-4o accepts any combination of text, audio, image and video input. OpenAI states it matches GPT-4 Turbo on English text and code while being faster and 50 per cent cheaper via the API, with average audio response latency of 320 milliseconds.
Re-cost any business case written against GPT-4 Turbo pricing.
- fyi Anthropic
Millions of interpretable features extracted from a production model — anthropic.com
Published 21 May 2024, Anthropic's interpretability work mapped millions of features in a middle layer of Claude 3 Sonnet, including safety-relevant ones covering scam email generation, code backdoors, sycophancy, power-seeking and secrecy. Amplifying or suppressing a feature causally changed model behaviour.
Worth citing where AI risk documentation asserts "black box, cannot be audited" as a blanket fact — that claim is weaker after this. It is the first credible evidence that a deployed frontier model's internals can be inspected and steered, which is the technical substrate for the assurance claims government AI policy is starting to require.
- fyi AI policy
Australia signs the Seoul Declaration on AI safety — gov.uk
At the AI Seoul Summit on 21 May 2024, Australia joined Canada, the EU, France, Germany, Italy, Japan, Korea, Singapore, the UK and the US in the Seoul Declaration for safe, innovative and inclusive AI. The declaration supports creating or expanding AI safety institutes, cooperation on safety research and sharing best practice, and advocates risk-based approaches to AI governance. An annexed Statement of Intent sets out a shared ambition to develop an international network among key partners, including AI safety institutes, with cooperation that can include exchanging or jointly creating evaluations.
Australia is a named signatory, so treat "risk-based approach" and safety-institute alignment as framing the Commonwealth has endorsed, and check internal AI policy language against it.
Security and edge
Sections- critical Chrome
Four exploited Chrome zero-days in fifteen days — chromereleases.googleblog.com
Google shipped fixes for four distinct in-the-wild Chrome exploits in fifteen days in May 2024, three of them in out-of-band emergency updates: CVE-2024-4671, a use-after-free in Visuals, on 9 May; CVE-2024-4761, an out-of-bounds write in V8, on 13 May; CVE-2024-4947, a type confusion in V8, carried in the scheduled Chrome 125 stable promotion on 15 May; and CVE-2024-5274, another V8 type confusion, on 23 May. Every release note states that an exploit exists in the wild.
Confirm your managed browser fleet patch SLA is measured in days rather than weeks, and that Chromium-based kiosk and embedded browsers in agency environments sit in the same update stream. Three V8 exploits in two weeks makes a multi-week patch window demonstrably too slow.
- critical Check Point
ASD advises on an exploited Check Point gateway information disclosure — cyber.gov.au
Published 31 May 2024, ASD's advisory covers CVE-2024-24919, an information disclosure vulnerability in Check Point Quantum Security Gateway devices allowing an unauthenticated actor to read sensitive information. ASD stated exploitation had already been observed and advised auditing networks for vulnerable instances and applying the vendor hotfix as a matter of high priority.
Audit for Check Point Quantum gateways, apply the hotfix, and treat any pre-patch exposure as a credential-compromise event rather than a patching task.
- notable nginx
nginx patches four HTTP/3 flaws including worker memory disclosure — nginx.org
nginx 1.27.0 and 1.26.1, released 29 May 2024, fix four medium-severity HTTP/3 defects: CVE-2024-32760 buffer overwrite, CVE-2024-31079 stack overflow and use-after-free, CVE-2024-35200 NULL pointer dereference and CVE-2024-34161 memory disclosure. All affect 1.25.0 to 1.25.5 and 1.26.0. A specially crafted QUIC session can crash a worker or, on systems with an MTU larger than 4096 bytes, disclose worker memory, and two of the flaws may have other impact.
Check whether the HTTP/3 module is compiled in and QUIC listeners enabled anywhere in the stack, then upgrade or disable HTTP/3. Worker memory disclosure at the edge means potential leakage of other users' request data, which is a different class of problem from a crash.
Standards and compliance
Sections- notable Digital ID
The Digital ID Act receives royal assent — legislation.gov.au
The Digital ID Act 2024 (No. 25 of 2024) received assent on 30 May 2024. It commences on a day fixed by proclamation or, failing that, the day after six months from assent. The ACCC is the Digital ID Regulator, and the Information Commissioner holds privacy functions under the Act. Accredited private-sector entities and Australian relying parties may apply to join more than two years after commencement, or earlier if a section 60 determination covers them.
If you operate or plan a service that will rely on Digital ID, start reading against the Act now. Section 74 requires a participating relying party to provide another means of accessing the service that does not involve creating or using a digital ID through AGDIS.
- fyi Budget
Budget moves the National AI Centre into the industry department — industry.gov.au
The 2024-25 Budget, handed down 14 May 2024, provides $39.9 million over five years for safe and responsible AI, including $21.6 million over four years from 2024-25 to establish a reshaped National AI Centre and an AI advisory body within the Department of Industry, Science and Resources, which takes the centre over from CSIRO.
Note the industry department as the AI policy contact point rather than CSIRO. Do not plan on large Commonwealth AI programme funding on these figures — the modest quantum is itself a signal about the pace to expect.
- fyi WCAG
W3C publishes updated WCAG 3 outcomes for public review — w3.org
Published 16 May 2024, the updated WCAG 3 Working Draft contains exploratory outcomes, with W3C's Web Accessibility Initiative asking reviewers to help scope user needs, find gaps in the drafted outcomes and surface research that validates or refutes them.
Nothing to comply with. If you hold an accessibility remit, read the outcomes.
CMS and platforms
Sections- notable Drupal
Critical Drupal 7 advisory discloses user data to anonymous requests — drupal.org
Published 15 May 2024 and rated critical (16/25), CVE-2024-13255 affects the RESTful Web Services module for Drupal 7, which does not sufficiently restrict access to user resources and so discloses non-public user information. No authentication is required and the advisory states it applies across all module configurations. Fixed in 7.x-2.10.
Inventory Drupal 7 sites for the restws module and upgrade to 7.x-2.10, or disable the user resource. Treat pre-patch exposure as potential personal-information disclosure, which makes it a notifiable-breach assessment rather than just a patch.
- notable Statamic
Statamic 5 released, dropping Laravel 9 and PHP 8.0 — statamic.com
Released 9 May 2024, Statamic 5 claims 50 to 600 per cent speed increases on complex sites through smarter caching and flat-file query-builder improvements, adds multi-site management in the control panel, Laravel Prompts in the CLI and Laravel Reverb support. It supports Laravel 10 and 11 only. The release post also notes that Statamic 3 receives security fixes only until July 2024.
If you run Statamic 3, its security support ends in July 2024, two months away. Check PHP 8.1 or later and Laravel 10 or later before upgrading to 5.
- fyi Drupal
Drupal announces the Starshot initiative — drupal.org
Announced at DrupalCon Portland on 6 May 2024, Starshot packages Drupal core with curated contributed modules and aims squarely at non-developers, including a next-generation page builder, automatic updates and simplified configuration. It was framed explicitly as built on top of core rather than a fork, with an eight-month delivery ambition targeting the end of 2024.
If you advise on CMS selection, factor Starshot into roadmap conversations rather than treating Drupal 10 as the endpoint — the "Drupal needs developers" objection is exactly what this targets.
Supply chain, CI/CD and IaC
Sections- notable GitHub
SAML authentication bypass in GitHub Enterprise Server — github.com
Published 21 May 2024, CVE-2024-4985 is an authentication bypass in GitHub Enterprise Server when using SAML single sign-on with the optional encrypted assertions feature. An unauthenticated attacker could forge a SAML response to gain administrative access. All versions before 3.13.0 are affected; patched in 3.9.15, 3.10.12, 3.11.10 and 3.12.4. GitHub rates it critical at CVSS v4.0 10.0; NIST's NVD scores it 9.8 under CVSS v3.1.
If you run self-hosted Enterprise Server with SAML encrypted assertions, patch and then audit for unexpected admin accounts, new SSH keys, personal access tokens and Actions secrets access across the exposure window.
- fyi GitHub
Artifact Attestations enter public beta — github.blog
Launched 2 May 2024 in public beta, Artifact Attestations let a workflow sign builds in GitHub Actions and capture provenance about the artifact, verifiable with the GitHub CLI. It is built on Sigstore, so the consumer has no keys or PKI to manage.
Add an attestation step to one non-critical release pipeline and practise verification in a deployment gate before making it mandatory. Build provenance without running your own signing infrastructure removes the main practical objection to attestation in a government pipeline.
- fyi OpenSSF
OpenSSF launches Siren for post-disclosure exploitation intelligence — openssf.org
Launched 20 May 2024, Siren is a public mailing-list channel sharing tactics, techniques and indicators of compromise for attacks against open source projects after vulnerability disclosure, under TLP:CLEAR. It addresses the gap that existing channels carry vulnerability data but not exploitation intelligence.
Subscribe someone on the platform or security team and route it into existing vulnerability triage. For teams that consume open source rather than maintain it, this is a free feed of "is this being exploited right now" — the signal that otherwise arrives only via paid vendor feeds.
Languages, runtimes and frameworks
Sections- notable Go
Go patches a DNS infinite loop and build-time code execution on macOS — groups.google.com
Go 1.22.3 and 1.21.10, released 7 May 2024, fix two issues. CVE-2024-24788 in the net package lets a malformed DNS message send Lookup functions into an infinite loop, a remote denial of service against anything resolving names. CVE-2024-24787 in cmd/go allows arbitrary code execution at build time on macOS, where the Apple linker could be driven via a cgo LDFLAGS directive.
Rebuild Go services on 1.22.3 or 1.21.10. Bump the toolchain on macOS developer machines and darwin CI runners too — the cgo issue triggers during build, so it belongs in your CI threat model rather than your runtime one.
- fyi Symfony
Symfony 7.1 released — symfony.com
Symfony 7.1.0 shipped on 31 May 2024, closing the 7.1 cycle with fixes across the Doctrine bridge, Mailer, Mime, Config, Notifier, Serializer, Cache, Validator, dependency injection and VarExporter.
Nothing urgent. Note that 7.1 is a standard-support release rather than an LTS — if you need long support, 6.4 LTS is the line to stay on. Symfony sits under Drupal, so its support windows set the floor for Drupal upgrade planning.
Static site and web tooling
Sections- notable Next.js
Server-side request forgery in Next.js Server Actions, self-hosted only — github.com
Published 9 May 2024 at CVSS 7.5, CVE-2024-34351 affects Next.js 13.4 through 14.1.0. If the Host header is modified and the application redirects to a relative path beginning with a slash, an attacker can cause requests that appear to originate from the application server. Fixed in 14.1.1, with no workaround. The advisory notes it only affects self-hosted deployments, because most hosting providers route on the Host header.
If you self-host Next.js 13.4 to 14.1.0 with Server Actions, upgrade to 14.1.1. Separately, validate that your edge tier normalises or pins the Host header to expected values — that control would have contained this independently.
- notable Astro
Astro stabilises CSRF protection and adds Actions — astro.build
Astro 4.8 on 9 May 2024 introduced experimental Astro Actions — type-safe backend functions callable from client code with Zod-based form parsing — plus experimental request rewriting and build times up to 20 per cent faster in specific cases with no configuration change. Astro 4.9 on 23 May added an experimental Container API for rendering components outside the app, React 19 form-action support, and stabilised CSRF protection as security.checkOrigin.
If you pinned CSRF protection behind an experimental flag in April, move to security.checkOrigin. Treat Actions, rewriting and the Container API as experimental.
- notable Remix
Remix announces it is merging into React Router — remix.run
On 15 May 2024 the Remix team said what it had planned as Remix v3 would ship as React Router v7, and that the Remix packages would take a little nap. The post says the team bet on Vite the previous autumn and started deprecating the classic compiler. Current Remix users are told to keep using Remix. No Remix v2 end-of-life date is given.
If you run Remix v2, plan for React Router v7 rather than waiting for a published end-of-life date.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more