Radar · 2024-08
August 2024
A zero-click remote code execution lands in the Windows TCP/IP stack, a guessable seed hands administrator access on five million WordPress sites, a Jenkins controller file read is rated Critical, Chrome 128 patches two V8 flaws already exploited in the wild and Drupal 11 is released.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- notable Anthropic
Prompt caching cuts the cost of resending a large fixed context — anthropic.com
Entering public beta on 14 August 2024 for Claude 3.5 Sonnet and Claude 3 Haiku, with Claude 3 Opus to follow, prompt caching is quoted at up to 90 per cent cost reduction and up to 85 per cent latency reduction for long prompts. Cache writes bill at 125 per cent of base input price and cache reads at 10 per cent.
Audit any Claude-backed retrieval or document-QA workload for a stable prefix and move it behind a cache breakpoint, then re-run cost models. For anything that resends a large fixed context — corpus chunks, system prompts, retrieval scaffolding — on every request, this changes unit economics more than any model release this month.
- notable Bedrock
Bedrock adds cross-Region inference for burst traffic — aws.amazon.com
Announced 27 August 2024, cross-Region inference lets on-demand Bedrock requests spill over to compute in other AWS Regions, giving up to twice the normal in-Region quota. AWS states there is no additional routing cost and that billing follows the source Region's rate.
Before enabling it, confirm which geography's inference profile a Sydney workload would use and whether cross-border inference is acceptable under the agency's data-residency terms. Burst capacity and quota headroom are the practical limits on AI features under load, but overflow routing is exactly the kind of detail a government tenant will ask about.
- fyi NIST
Pre-deployment model access agreements signed with two frontier labs — nist.gov
Announced 29 August 2024, NIST's memoranda of understanding give the US AI Safety Institute access to major new models from Anthropic and OpenAI before and after public release, for collaborative capability and safety-risk evaluation, with findings fed back in close collaboration with the UK AI Safety Institute.
Context for procurement and assurance conversations. This is the template government AI assurance is converging on — third-party pre-deployment evaluation rather than vendor self-attestation — and it is the reference point when an agency asks what independent testing sits behind a model.
Security and edge
Sections- critical Chrome
Chrome 128 patches two V8 flaws already exploited in the wild — chromereleases.googleblog.com
Chrome stable 128.0.6613.84 and .85, released 21 August 2024, shipped 38 security fixes. Google stated exploits exist in the wild for CVE-2024-7971, a type confusion in V8 reported two days before the release, and CVE-2024-7965, an inappropriate implementation in V8. The same release fixed a use-after-free in Passwords that earned a US$36,000 bounty, plus out-of-bounds and heap overflow issues in Skia and Fonts.
Confirm your standard operating environment browser baseline is at or above 128.0.6613.84 and that your enterprise update channel did not defer this release. Two in-the-wild V8 zero-days in a single stable release, one reported two days before ship, is a forced-patch event.
- critical DNS
Lame DNS delegations leave over a million domains claimable — bleepingcomputer.com
Reported 1 August 2024, this domain-hijack class needs three conditions: authoritative DNS served by a provider other than the registrar; a lame delegation where the authoritative nameserver holds no zone data for the domain; and a DNS provider that lets a new account claim the zone without proving ownership. More than 35,000 domains had already been hijacked, with over a million exploitable on any given day and six providers still susceptible.
Enumerate every domain and subdomain delegation in the portfolio and check for NS records pointing at providers that no longer host the zone. Fix or remove lame delegations, starting with retired campaign and programme domains — government portfolios are exactly the shape that breaks here, with large inherited estates, split registrar and DNS providers, and long tails of decommissioned sites.
- notable Windows
Zero-click remote code execution in the Windows TCP/IP stack over IPv6 — nvd.nist.gov
Published 13 August 2024 at CVSS 9.8, CVE-2024-38063 is a Windows TCP/IP remote code execution vulnerability triggered by specially crafted IPv6 requests, network-reachable with no privileges and no user interaction. NVD lists affected Windows 10 from 1507 through 22H2, Windows 11 from 21H2 through 24H2, and Windows Server 2008 through 2022.
Verify the August 2024 cumulative update is applied; where it is not, disable IPv6 where it is not in use as an interim workaround.
Standards and compliance
Sections- notable ASD
ASD leads 15-agency guidance on event logging and threat detection — cyber.gov.au
Published 22 August 2024 and developed by ASD's ACSC with fourteen partner agencies from the US, UK, Canada, New Zealand, Japan, Korea, Singapore and the Netherlands — fifteen agencies across nine countries — the guidance covers logging for cloud services, enterprise IT networks, enterprise mobility and operational technology networks. It is aimed at practitioners, IT managers, OT operators and network administrators in medium-to-large organisations.
Map your platform's log coverage and retention against the cloud and enterprise-IT sections, and identify gaps where edge and CDN logs are not reaching the agency's SIEM.
- notable EU AI Act
The EU AI Act enters into force — europa.eu
The Act entered into force on 1 August 2024. Prohibitions on unacceptable-risk practices bite first — the Commission's own example is government social scoring — with general-purpose AI obligations applying twelve months later in August 2025, and the Commission expecting to finalise the general-purpose code of practice by April 2025.
If you supply or operate AI features touching EU users or EU-headquartered vendors, classify each feature against the risk tiers now rather than at the deadline. Australian agencies and suppliers increasingly inherit this framing through vendor contracts, and the risk-tier vocabulary is already being borrowed into Australian AI assurance drafting.
- notable CA/Browser Forum
Domain validation must be performed from multiple network perspectives — cabforum.org
Ballot SC-067v3 requires certificate authorities to perform domain validation and CAA checks from multiple network perspectives, to blunt BGP-hijack-based mis-issuance. The Forum published the passed ballot and opened its review period on 5 August 2024, after unanimous approval — 22 to nil among certificate issuers, with no certificate consumer voting against or abstaining. Not every validation method will require it.
Test your ACME issuance path against the possibility that validation must succeed from several network locations, and remove any geographic or network-based blocking in front of your ACME challenge path and authoritative DNS. Expect issuance to become slower and more sensitive to how a domain resolves from different vantage points — which matters for the split-horizon DNS setups common in government.
CMS and platforms
Sections- critical WordPress
A guessable seed hands administrator access on five million WordPress sites — thehackernews.com
CVE-2024-28000 is an unauthenticated privilege escalation to administrator in LiteSpeed Cache, CVSS 9.8, affecting all versions through 6.3.0.1 and fixed in 6.4 on 13 August 2024. The user-simulation feature seeded a hash from microsecond-based randomness with no salt and no binding to request or user, leaving roughly a million possible values. The plugin has more than five million active installations, and by 22 August tens of thousands of attacks against it were being blocked in a single day. It is not exploitable on Windows hosts.
Force LiteSpeed Cache to 6.4 or later everywhere. On any site that ran a vulnerable version while exposed, audit the users table for unexpected administrators and review recently installed plugins.
- notable Drupal
Drupal 11 released — drupal.org
Announced 1 August 2024 US time, with the release node created 2 August 05:45 UTC, Drupal 11 credits 1,858 contributors across 590 organisations. The two headline capabilities are Recipes — experimental in this release — which apply predefined configuration sets to add features to a site, and Single-Directory Components, which co-locate all of a front-end component's code in one directory.
Inventory contributed and custom module Drupal 11 compatibility now. Do not schedule an upgrade on the strength of Recipes, which is experimental in 11.0. Single-Directory Components is the piece that changes how component libraries get shared between agencies.
- fyi Craft CMS
Craft 5.3 adds configurable response headers — craftcms.com
Released 6 August 2024, Craft 5.3 brought CLI commands for tidying fields and entry types after a major upgrade, a bulk action for moving entries between sections, a new Link field type covering URLs and relations, relation fields usable multiple times in one field layout, and configurable front-end response headers through new application-config filters.
The response-header configuration is the part worth noting — it gives Craft sites first-class control over cache and security headers, which matters when the CMS sits behind a CDN or is crawled to static.
Supply chain, CI/CD and IaC
Sections- notable Jenkins
Jenkins controller arbitrary file read rated Critical — jenkins.io
Disclosed 7 August 2024, CVE-2024-43044 lets calls to an internal channel method retrieve files from the Jenkins controller with no path restriction, giving arbitrary file read from the controller filesystem and, in practice, remote code execution. Jenkins rates it Critical (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H — 9.0). It affects weekly releases up to 2.470 and LTS up to 2.452.3, fixed in weekly 2.471 and LTS 2.452.4 or 2.462.1. The same advisory covers a missing permission check on My Views.
Patch immediately, then treat any controller that ran a vulnerable version with untrusted agents as credential-compromised and rotate. The controller holds deployment credentials for everything it builds, so controller-level file read is a full supply-chain compromise.
- notable GitHub
Actions will stop sweeping hidden files into uploaded artifacts from 2 September 2024 — github.blog
Announced 19 August 2024 and effective 2 September, upload-artifact v3 and v4 will no longer include hidden files and folders by default. The same notice bundled other breaking changes: arm64 Ubuntu base images deprecated from 3 September, .NET 6 support removed in October alongside the Node 20 migration, and macOS 12 fully retired on 3 December.
Grep workflows for artifact consumers that expect hidden files, set include-hidden-files explicitly where genuinely needed, and audit historical artifacts for leaked credentials. The notice says this reduces the risk that credentials are accidentally uploaded.
Languages, runtimes and frameworks
Sections- notable Go
Go 1.23 ships iterators and opt-in telemetry — go.dev
Released 13 August 2024, Go 1.23 made range-over-func iterators generally available and added the iter, structs and unique packages. It also introduced an opt-in telemetry system, reworked the timer and ticker implementations, added go env -changed and go mod tidy -diff, and extended go vet to report symbols too new for the target Go version.
When you adopt 1.23 in build images, decide the telemetry setting deliberately rather than by default — agencies with strict egress and privacy postures will want that recorded. Note that go vet's new version check may surface previously silent problems.
- fyi PHP
Four PHP releases in August, none of them security — php.net
PHP shipped 8.3.10 and 8.2.22 on 1 August 2024, then 8.3.11 and 8.2.23 on 29 August, alongside 8.4 alpha and beta builds. None of the four stable releases was a security release.
Nothing urgent — treat as normal bug-fix uptake. For Drupal and Symfony fleets on a monthly patch rhythm, the useful editorial line is that there was nothing to escalate.
Update, September 2024: PHP's next security releases, 8.1.30, 8.2.24 and 8.3.12, shipped on 26 September 2024.
Static site and web tooling
Sections- notable Nuxt
Three Nuxt advisories including remote code execution in local end-to-end testing — github.com
Published 5 August 2024, GHSA-v784-fjjh-f8r4 is rated High and allows remote code execution via a browser during local end-to-end testing. GHSA-rcvg-rgf7-pppv, also High, is a path traversal in Nuxt DevTools. GHSA-vf6r-87q4-2vjf is a Moderate cross-site scripting flaw in
navigateTofollowing server-side rendering.Patch, and note where these land: two of the three are in developer tooling rather than production output, which means the exposed machine is an engineer's laptop holding credentials for everything else. Treat local test runs as a production-adjacent surface.
- fyi Astro
Astro's Content Layer API arrives in experimental form — astro.build
Astro 4.14, released 15 August 2024, shipped the first experimental release of the Content Layer API, a more flexible successor that builds on content collections and can run alongside them, plus experimental IntelliSense inside content frontmatter, a new integration API for injecting type definitions, and deprecation of dynamic prerender values.
If you are prototyping CMS-to-static with Astro, evaluate the Content Layer API now, but do not build production pipelines on it behind an experimental flag. This is how Astro ingests content from external sources including a headless CMS at build time, so it is the direct upstream of any Drupal-to-Astro static publishing pattern.
- fyi Nuxt
Nuxt 3.13 lets server islands emit their own head metadata — nuxt.com
Released 22 August 2024, Nuxt 3.13 added route groups — parenthesised directories that organise routes without affecting URLs — head metadata manipulation from server component islands, configurable NuxtLink prefetch triggers based on visibility or interaction, and server source maps pointing at original sources rather than build output.
Nothing urgent. The head-metadata change is the piece that makes partially hydrated Nuxt pages behave correctly for search and for government metadata requirements.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more