Security advisory: critical PHP and Node.js vulnerabilities are being exploited in the wild. What you need to do →
All months

Radar · 2024-10

October 2024

A FortiManager missing-authentication flaw is exploited as a zero-day, a default OWASP Core Rule Set configuration skips request-body inspection on some platforms, Drupal marks wkhtmltopdf unsupported, WordPress.org forks Advanced Custom Fields and auto-updates swap it out beneath live sites, and malicious lottie-player builds reach sites pinned to @latest.

What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.

AI platform and models

Sections
  • notable OWASP

    OWASP publishes three GenAI security guides at once — genai.owasp.org

    On 28 October 2024 the OWASP Top 10 for LLM Applications project released a Guide for Preparing and Responding to Deepfake Events, an LLM and Generative AI Security Center of Excellence Guide, and an AI Security Solution Landscape Guide that maps open-source and commercial tooling against the Top 10 risks. The project reported 500-plus contributing experts from more than 110 companies and 5,500 community members since its May 2023 start. The guides are pitched at CISOs and compliance officers as much as engineers.

    Use the Solution Landscape guide as the checklist when scoping AI guardrail tooling, and lift the deepfake response guide into your incident-response runbook for voice and video social engineering.

  • fyi Anthropic

    Claude 3.5 Sonnet is upgraded and computer use enters public beta — anthropic.com

    Announced 22 October 2024, the upgraded Claude 3.5 Sonnet shipped at the same price and speed as the version it replaced, Claude 3.5 Haiku was flagged for later in the month, and "computer use" entered public beta — an API capability that lets the model read a screen, move a cursor, click and type. Anthropic described computer use as experimental and "at times cumbersome and error-prone". Distribution named at launch was the Anthropic API, Amazon Bedrock and Google Cloud Vertex AI.

    If you are evaluating agentic automation, treat everything on the screen as attacker-controllable input and scope credentials and network egress before piloting. A model that can click is a model that can be talked into clicking.

  • fyi DTA

    The whole-of-government generative AI trial evaluation lands, and it is unflattering — itnews.com.au

    Released 23 October 2024, the DTA's evaluation of the whole-of-government generative AI trial covers 5,765 licences issued across the first six months of 2024. Only about a third of participants used the assistant daily, with two thirds using it a few times a week or less. Belief that it let them spend less time on email fell 32 per cent over the trial, and belief that it would mean fewer meetings fell 54 per cent. Use concentrated on summarising meetings and information and on rewriting content. Adoption was undercut by poor interface visibility — at CSIRO, users simply forgot the tool existed — and by uneven access to training.

    Read this before quoting a productivity figure at an agency. It is the DTA's published whole-of-government trial evaluation, and the finding that matters is that expectations fell as exposure rose — so scope pilots around a named task with measurable output, not around a licence count.

Security and edge

Sections
  • critical ASD

    FortiManager flaw exploited as a zero-day, ASD issues an advisory — cyber.gov.au

    ASD's ACSC published an advisory on 24 October 2024 for a FortiManager vulnerability scored CVSSv3 9.8, advising organisations to review networks for vulnerable instances and patch "as a matter of high priority". The flaw is CVE-2024-47575, missing authentication in the FortiManager fgfmd daemon reachable over the FGFM protocol, giving unauthenticated remote code execution. Attackers registered rogue FortiGate devices named localhost to bypass API authorisation, then exfiltrated managed-device configurations, IP addresses and credentials. Fixed builds are 6.2.13, 6.4.15, 7.0.13, 7.2.8, 7.4.5 and 7.6.1; CISA added the CVE to its Known Exploited Vulnerabilities catalogue on 23 October 2024.

    Patch FortiManager to a fixed build and confirm FGFM is not internet-facing. If it was exposed before patching, treat every managed FortiGate credential in the configuration store as compromised and rotate rather than assuming the patch closed the incident.

  • critical Mozilla

    Exploited Firefox use-after-free patched within 25 hours — thehackernews.com

    CVE-2024-9680, a use-after-free in Firefox's Animation timelines scored CVSS 9.8, allowed code execution in the content process and was confirmed under active exploitation. Mozilla shipped the fix on 9 October 2024, roughly 25 hours after disclosure by ESET researcher Damien Schaeffer, in Firefox 131.0.2, ESR 128.3.1 and ESR 115.16.1. The Tor Project released Tor Browser 13.5.7 for the same flaw.

    Push managed fleets to 131.0.2, 128.3.1 or 115.16.1, and if you publish a browser-support matrix to clients, raise the ESR floor to 128.3.1 rather than leaving it at the previous ESR point release.

  • notable OWASP

    A default Core Rule Set configuration skipped request-body inspection entirely — coreruleset.org

    Released 29 October 2024, CRS 4.8.0 and 3.3.7 fix a request-body inspection bypass on some platforms running v4.7.0 and earlier or v3.3.6 and earlier. The default allowed-content-types list included multipart/related, application/cloudevents+json and application/cloudevents-batch+json. Free and open-source WAF engines that run CRS could not, or by default would not, parse those types, so ARGS was never populated and most CRS rules did not inspect the body. Both releases remove those types from the default allow-list.

    Upgrade to 4.8.0, or 3.3.7 on the legacy line. If you genuinely need the extended JSON content types, re-enable parsing explicitly through rule 200006 rather than restoring the old allow-list — the failure mode here was silent non-inspection, not a blocked request, so nothing in your logs would have told you.

Standards and compliance

Sections
  • notable OAIC

    OAIC publishes two guidance documents on privacy and AI — oaic.gov.au

    On 21 October 2024 the OAIC released two guides: one on commercially available AI products and one on developing and training generative AI models. The commercial-products guide recommends as best practice that organisations do not enter personal information, particularly sensitive information, into publicly available generative AI tools, and treats that input as a use or disclosure that must meet APP 6. It also asks businesses to update privacy policies with clear information about AI use and to identify public-facing AI tools as such. The training guide states that data being publicly available does not mean it can lawfully be used to train or fine-tune a model, treats web scraping as a generally covert collection method raising APP 3 fairness questions, and requires valid consent for sensitive information with deletion from the dataset where consent cannot be obtained.

    Name the AI tools you actually run, and their purposes, in your privacy policy and staff AI-use policy, and add an APP 3 and APP 6 check to any retrieval or fine-tuning pipeline that ingests scraped or user-submitted content.

  • notable CISA

    CISA, the FBI and ASD's ACSC publish safe software deployment guidance — cisa.gov

    Released 24 October 2024 as part of the Secure by Design series, Safe Software Deployment — How Software Manufacturers Can Ensure Reliability for Customers urges manufacturers to run a documented safe deployment program with verified testing and measurement, to carry security thinking from design through development and vulnerability management to feature deprecation and product end of life, and to apply continuous improvement to the deployment process itself. It targets manufacturers deploying to mobile devices, laptops and cloud-based services. ASD's ACSC, a co-author with CISA and the FBI, published it on 25 October 2024.

    Map your release process against the staged-rollout and testing expectations in the guide. This is the document procurement will quote when it asks how you avoid shipping the update that takes the customer down.

  • fyi Home Affairs

    Cyber Security Bill 2024 and SOCI amendments reach Parliament — itnews.com.au

    Introduced 9 October 2024, the package covers mandatory reporting of ransomware payments, mandatory security standards for smart household devices, and an independent Cyber Incident Review Board modelled on the US Cyber Safety Review Board. It amends the Security of Critical Infrastructure Act to let regulators compel remediation of serious risk-management deficiencies, brings secondary data systems associated with critical infrastructure into scope, adds an assistance framework for cascading incident impacts, and moves telecommunications security obligations into SOCI. It also limits how the National Cyber Security Coordinator and ASD may use information reported to them, to encourage voluntary disclosure.

    If you hold or process data for a SOCI-regulated customer, check whether the secondary data systems expansion pulls your hosting or delivery configuration into their critical-infrastructure asset register, and get ransomware-payment reporting into the incident-response plan now rather than at commencement.

CMS and platforms

Sections
  • critical WordPress

    WordPress.org forks Advanced Custom Fields into Secure Custom Fields — wordpress.org

    On 12 October 2024 the WordPress security team invoked guideline 18 of the plugin directory guidelines to fork Advanced Custom Fields into a new plugin, Secure Custom Fields. The sequence matters: WP Engine deployed its own update and installation service in place of WordPress.org's on 1 October, the ACF team announced that change on 3 October, and the fork followed nine days later. The post says the fork removes commercial upsells and fixes a security problem, without naming a CVE or describing the flaw, and attributes the situation to WP Engine's legal action. Critically for operators: sites with auto-updates enabled and using the WordPress.org update service were switched from ACF to SCF automatically.

    Inventory every WordPress site you maintain for ACF, establish whether it is now running SCF or ACF from its vendor's own endpoint, and make that a recorded decision rather than an artefact of the October auto-update.

  • critical Drupal

    Fifteen contributed-module advisories, led by a highly critical unsupported module — drupal.org

    Drupal published SA-CONTRIB-2024-042 through -056 on four of October 2024's five Wednesdays: 2, 9, 23 and 30 October. SA-CONTRIB-2024-049 for wkhtmltopdf on 9 October is rated Highly critical (23/25). The security team marked the module unsupported because a known issue went unfixed, and the upstream wkhtmltopdf tool it wraps is itself archived, so this is a migrate-off signal rather than a patch. Three more are rated Critical: Two-factor Authentication on 2 October, Facets on 9 October and Monster Menus on 23 October. The remainder run Moderately critical or below and include Diff, Persistent Login, Block permissions, Gutenberg, SVG Embed, Views SVG Animation, Smartling Connector, Loft Data Grids, Cookiebot + GTM and OhDear Integration. The month's one core advisory, SA-CORE-2024-002 on 16 October, is a moderately critical (13/25) CKEditor 5 bug in Drupal 10.2: under uncommon configurations some image uploads could move the entire webroot. It is fixed in 10.2.10, and 10.3 and later are unaffected.

    Patch the four rated Critical or above first — a two-factor module failing open and a faceted-search module are both common on Australian government sites. For wkhtmltopdf, plan the replacement rather than the update: PDF generation is widespread on government sites and the upstream library no longer has a maintainer to ship the next fix.

  • notable Jetpack

    Jetpack patches a contact form data exposure across 101 versions — thehackernews.com

    Disclosed 14 October 2024, the flaw sat in Jetpack's Contact Form feature and allowed any logged-in user on a site to read form submissions made by visitors. It was introduced in Jetpack 3.9.9 in 2016, giving it an eight-year exposure window. Automattic backported the fix across 101 versions, including 13.9.1, 13.8.2, 13.7.1, 13.6.1 and 13.5.1, down to 3.9.10. Jetpack is installed on roughly 27 million sites.

    Confirm the backport actually landed on every site you maintain rather than assuming auto-updates applied it, and on any multi-author or membership site treat historic contact-form submissions as potentially read by lower-privileged accounts.

Supply chain, CI/CD and IaC

Sections
  • critical npm

    Malicious lottie-player builds published to npm — github.com

    On 30 October 2024, versions 2.0.5, 2.0.6 and 2.0.7 of @lottiefiles/lottie-player were published to npm carrying code that prompted site visitors to connect a cryptocurrency wallet, with the goal of draining funds. The clean version is 2.0.8. The attacker used an npm automation token held in the project's CI/CD pipeline, which bypassed two-factor authentication on the maintainer account. Because public CDN front-ends serve @latest by default, sites loading the player from a CDN without a pinned version were served the malicious build automatically.

    Grep lockfiles and every third-party <script> tag for lottie-player, pin to 2.0.8 or an exact version rather than latest, and audit npm automation tokens for publish scope wider than the one package they exist to release.

  • critical Git

    Mass harvesting of credentials from exposed .git and .env files — bleepingcomputer.com

    Disclosed 30 October 2024, a campaign scanned roughly 500 million IP addresses across 12,000 ranges for web-exposed /.git/config and Laravel .env files, harvesting over 15,000 cloud credentials. Reported totals include 67,000 URLs with exposed configuration files, 28,000 Git repositories, 6,000 GitHub tokens and 2,000 credentials validated as live. Targets included AWS keys, cloud platform secrets and email-service provider credentials. The tooling was commodity automation rather than novel exploitation.

    Confirm every site you serve returns 404 for /.git/ and /.env — this is an edge configuration check, not an application fix — and rotate any long-lived cloud credential that has ever sat in a repository-adjacent configuration file.

  • notable OpenTofu

    OpenTofu 1.8.3 lets module sources and backend config be marked sensitive — github.com

    Released 3 October 2024, OpenTofu 1.8.3 added the ability to mark variables used in module sources and versions and in backend configuration as sensitive, gated behind the TOFU_ENABLE_STATIC_SENSITIVE environment variable. By default it emits a warning rather than an error, to preserve compatibility with earlier 1.8.x; the flag becomes default behaviour in 1.9.0. The release also fixed a crash when sensitive values were used in module sources, versions and backend configuration, and fixed autoloaded test tfvars files being applied in non-test runs. OpenTofu 1.8.4 followed on 23 October with bug fixes only.

    If you use 1.8 early evaluation to template backend or module-source strings from variables, upgrade and set TOFU_ENABLE_STATIC_SENSITIVE=1 in CI so sensitive values are enforced rather than warned about.

    Update, November 2024: OpenTofu 1.8.5, released 4 November 2024, fixed a tofu init "Backend configuration changed" regression introduced by 1.8.4's backend fix, so move to 1.8.5 or later rather than stopping at 1.8.4.

Languages, runtimes and frameworks

Sections
  • notable Python

    Python 3.8 reaches end of life — python.org

    Python 3.8 reached end of life on 7 October 2024. Its release cycle is frozen and accepts no further changes, including security fixes. Python 3.13.0 shipped the same day. The next end of life in the series is Python 3.9, due in October 2025.

    Inventory build images, function runtimes and CI matrices for 3.8 and move to 3.11 or 3.12 now, and put the 3.9 migration in next year's plan rather than discovering it in October 2025.

  • notable Node.js

    Node.js 22 enters Active LTS — nodejs.org

    Node.js 22.11.0, released 29 October 2024, moved the 22.x line into Active LTS under the codename "Jod". Active LTS runs until October 2025, then maintenance to end of life in April 2027. There are no functional changes from 22.10.0 — the release only updates metadata such as process.release. Official binaries ship OpenSSL 3.0.x. Node.js 23 became the Current line on 16 October 2024 and, as an odd-numbered release, never becomes LTS.

    Make 22.x the default runtime for new builds and pin engines and Dockerfiles accordingly. Do not offer Node 23 as a supported build target — it is a compatibility-testing line, not a production one.

Static site and web tooling

Sections
  • notable Next.js

    Next.js 15 changes caching defaults and stops overriding Cache-Control — nextjs.org

    Released 21 October 2024, Next.js 15 made fetch requests, GET route handlers and the client router cache uncached by default, and set the page-segment staleTime default to 0. Request APIs — cookies, headers, draftMode, params in layouts, pages, routes and generateMetadata, and searchParams in pages — became asynchronous, with a codemod and a deprecation window until the next major. The minimum Node.js version rose to 18.18.0 and next dev --turbo became stable. For self-hosting specifically, experimental.swrDelta became expireTime with a new default of one year, and Next.js no longer overrides custom Cache-Control values.

    For any self-hosted Next.js site behind a cache, re-test cache behaviour after upgrading. The Cache-Control and expireTime changes alter what your edge tier stores and for how long, and neither shows up in a functional test.

  • notable Astro

    DOM clobbering XSS in Astro's client-side router — github.com

    CVE-2024-47885, published 14 October 2024, is a DOM clobbering gadget in Astro's client-side router that can lead to cross-site scripting on pages using ViewTransitions where an unsanitised name attribute on an iframe is rendered from user-controlled content. It affects Astro 3.0.0 through 4.16.0 and is fixed in 4.16.1. GitHub rates it moderate at CVSS 5.9. NVD lists a score of 5.4.

    Move to Astro 4.16.1 or later on any site that renders user-supplied HTML with ViewTransitions enabled, and sanitise name and id attributes in that content if you cannot upgrade immediately.

  • notable Svelte

    Svelte 5 released as a compiler and runtime rewrite — svelte.dev

    Released 22 October 2024, Svelte 5 is a ground-up rewrite of the compiler and runtime that introduces runes as the reactivity model. The announcement states Svelte 5 is "almost completely backwards-compatible with Svelte 4" and that for most users the initial upgrade is seamless. A whole app can be migrated with npx sv migrate svelte-5, and individual components with the "Migrate Component to Svelte 5 Syntax" command in the Svelte VS Code extension. Svelte 4 support was to be phased out later with notice. A SvelteKit release taking advantage of Svelte 5 features was flagged as still to come.

    Upgrade the dependency in a branch and migrate components one at a time with the Svelte VS Code extension — the compatibility layer means you can ship the version bump well before rewriting anything to runes.

Build on what the radar tracks

Integrations

How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.

Learn more

AI applications

Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.

Learn more

For developers

REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.

Learn more