Security advisory: critical PHP and Node.js vulnerabilities are being exploited in the wild. What you need to do →
All months

Radar · 2024-11

November 2024

The OAIC finds Bunnings breached the Privacy Act with facial recognition across 63 stores, Drupal 7 Overlay gets a critical reflected-XSS fix, an authentication bypass in a WordPress security plugin hands over administrator access, an exploited PAN-OS chain reaches CISA's catalogue, and the Cyber Security Act 2024 receives assent.

What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.

AI platform and models

Sections
  • notable OWASP

    OWASP publishes the Top 10 for LLM Applications 2025 — genai.owasp.org

    Released 17 November 2024, the 2025 revision runs LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Supply Chain, LLM04 Data and Model Poisoning, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weaknesses, LLM09 Misinformation and LLM10 Unbounded Consumption. System Prompt Leakage and Vector and Embedding Weaknesses are new, the latter added in response to community requests for retrieval guidance. Unbounded Consumption evolved from the previous denial-of-service entry to cover resource management and unexpected cost, and Excessive Agency expanded to reflect agentic architectures.

    Map any retrieval or vector-database stack against LLM08 and any agent tooling against LLM06 — those two changed most, and they are the entries a procurement questionnaire will reach for first.

  • fyi MCP

    The Model Context Protocol is published as an open standard — anthropic.com

    Announced 25 November 2024, the Model Context Protocol is an open standard for connecting AI assistants to external data sources and tools. The initial release comprised three things: the specification and SDKs on GitHub, local MCP server support in the Claude desktop applications, and an open-source repository of pre-built servers with connectors for Google Drive, Slack, GitHub, Git, Postgres and Puppeteer. All Claude.ai plans could connect servers to the desktop app, and Claude for Work customers could test servers locally against internal systems.

    If you expose content or search APIs, start treating an MCP server as a first-class integration surface rather than a curiosity — this is where AI clients will look for tools, and the pre-built server repository is the template to copy.

  • fyi AWS

    Claude 3.5 Haiku reaches Bedrock in US regions only — aws.amazon.com

    Announced 4 November 2024, Claude 3.5 Haiku became available in Amazon Bedrock in US West (Oregon), and in US East (N. Virginia) via cross-region inference. The model was text-only at launch, with image input flagged as coming. Asia Pacific (Sydney) was not among the launch regions, despite Bedrock itself having been available there since April 2024. Fine-tuning for Claude 3 Haiku reached general availability on 1 November, also Oregon-only.

    Do not assume a new Bedrock model is Sydney-available on announcement day. Check the region table before quoting data residency to a client, and treat cross-region inference as a residency decision rather than a performance one.

Security and edge

Sections
  • critical CISA

    Exploited PAN-OS management interface chain added to the KEV catalogue — cisa.gov

    On 18 November 2024, CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalogue: CVE-2024-0012, a Palo Alto Networks PAN-OS management interface authentication bypass; CVE-2024-9474, a PAN-OS management interface OS command injection; and CVE-2024-1212, an OS command injection in Progress Kemp LoadMaster. The two PAN-OS entries chain — authentication bypass on the management web interface followed by command injection — giving unauthenticated attackers privileged execution on the firewall itself. It was the third Palo Alto entry of the month: Expedition appeared on 7 November with CVE-2024-5910 and again on 14 November with CVE-2024-9465 and CVE-2024-9463.

    Confirm no PAN-OS management interface is reachable from the internet or from untrusted internal networks, then patch. A KEV listing means exploitation was already observed, so an interface that was exposed needs hunting, not just patching. If you run Expedition for migrations, it is the forgotten box in the same estate and it was hit twice.

  • critical Chrome

    Chrome stops trusting new Entrust TLS certificates — security.googleblog.com

    From 12 November 2024, Chrome 131 and later no longer trust TLS server-authentication certificates chaining to Entrust or AffirmTrust roots by default. Google announced the change on 27 June 2024 and revised it on 10 September 2024, setting blocking to begin on 12 November to align with the Chrome 131 milestone. The cut is keyed to issuance rather than to the roots outright: certificates whose earliest Signed Certificate Timestamp is on or before 11 November 2024, 11:59:59 pm UTC, are unaffected and stay trusted until expiry, so the practical trigger is any Entrust certificate first logged after that moment. Sites still presenting one to a Chrome 131+ visitor get an interstitial.

    If any certificate in your estate or a client's chains to Entrust, replace it with one from a different certificate authority — reissuing from Entrust does not help after the cutover. This is also the argument for automated issuance: a notice period of four and a half months only helps if you know what your certificates chain to.

  • notable CA/Browser Forum

    Ballot SC-080v3 sunsets WHOIS-based domain validation — cabforum.org

    Published 14 November 2024 after a voting period of 31 October to 7 November, SC-080v3 passed with certificate issuers voting 23 to 0 with one abstention and all three certificate consumers in favour. It amends the Baseline Requirements on two dated tracks. From 15 January 2025, certificate authorities must stop using HTTPS websites to obtain domain contact information, must follow prescribed practices when using WHOIS or RDAP, and may not rely on cached WHOIS server information or IANA RDAP bootstrap data older than 48 hours. From 15 July 2025, CAs must not issue subscriber certificates relying on method 3.2.2.4.2 (email, fax, SMS or postal mail to domain contact) or method 3.2.2.4.15 (phone contact), and prior validations by those methods cannot support new issuance.

    If any certificate issuance for your domains still validates through a registrant email address or phone number derived from WHOIS, move it to DNS-based or HTTP file validation well before 15 July 2025 rather than discovering the cutoff on a renewal.

Standards and compliance

Sections
  • critical PSPF

    PSPF Release 2024 replaces the framework every Commonwealth entity works to — protectivesecurity.gov.au

    The Department of Home Affairs launched PSPF Release 2024 on 1 November 2024, the first in a planned annual series and a restructure of the previous sixteen core policies. It splits risk and technology into their own protective security domains, adds requirements for supply chain security, third-party risk management, foreign interference and the security of operational and emerging technology, and moves entity reporting from a maturity model to a compliance model. The accompanying List of Requirements is dated 31 October 2024.

    If you build or host for a Commonwealth entity, get the new List of Requirements rather than working from a mapping to the old sixteen policies — assessment reporting from this point references the new structure, and a control mapping built against the old one will not line up.

  • notable OAIC

    Bunnings breached the Privacy Act with facial recognition — oaic.gov.au

    Determined 19 November 2024, Privacy Commissioner Carly Kind found that Bunnings Group breached the Privacy Act by deploying facial recognition across 63 stores in Victoria and New South Wales between November 2018 and November 2021, capturing the faces of hundreds of thousands of customers. The findings were that Bunnings collected sensitive biometric information without consent, failed to notify individuals of the collection, and omitted required disclosures from its privacy policy, with governance gaps preventing effective compliance. The reasoning is the part that generalises: facial recognition was held to be the most intrusive option available and disproportionate, affecting every visitor rather than the small number of individuals the deployment targeted. In the Commissioner's words, that a technology may be helpful or convenient does not make its use justifiable.

    Treat the necessity-and-proportionality test in this determination as the operative Australian standard before deploying anything that collects biometric or otherwise sensitive information — the question is not whether the technology works but whether a less intrusive option would have. The OAIC published business guidance on facial recognition in retail settings the same day.

  • notable Home Affairs

    The Cyber Security Act 2024 receives assent — legislation.gov.au

    The Cyber Security Act 2024 received Royal Assent on 29 November 2024 as Act No. 98 of 2024. It establishes four frameworks: mandatory ransomware payment reporting with limits on secondary use of the disclosed information; security standards for smart and connectable devices, with compliance statements and enforcement via compliance, stop and recall notices; an independent Cyber Incident Review Board with confidentiality protections for draft reports; and a limited-use obligation restricting information shared voluntarily or under reporting requirements to permitted cyber security purposes, preserving legal professional privilege.

    Establish whether your organisation and your hosted clients fall within the ransomware-payment reporting threshold, and put the limited-use protection into the incident-response runbook so responders know what they can safely tell the designated Commonwealth body and the National Cyber Security Coordinator.

CMS and platforms

Sections
  • critical WordPress

    Authentication bypass in a WordPress security plugin allows login as any user — nvd.nist.gov

    CVE-2024-10924 affects the Really Simple Security plugin, free, Pro and Pro Multisite, in versions 9.0.0 through 9.1.1.1, and is fixed in 9.1.2. NVD scores it 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The flaw is improper user-check error handling in the two-factor REST API actions within the check_login_and_get_user function: an invalid login nonce is not properly rejected and the request is authenticated on user ID alone, so an unauthenticated attacker can log in as any existing user including an administrator. The condition is that two-factor authentication is enabled. BleepingComputer reports the flaw was found on 6 November 2024 and fixed in 9.1.2, released on 12 November for Pro and 14 November for free users. NVD published the CVE on 15 November 2024.

    Audit any managed WordPress estate for versions in the 9.0.0 to 9.1.1.1 range and confirm they moved to 9.1.2. A forced update was pushed, but sites with auto-updates disabled did not receive it — and because this is an authentication bypass, review administrator accounts and recent role changes on anything that lagged.

  • notable Drupal

    Drupal patches six core advisories and eight contributed modules — drupal.org

    On 20 November 2024 Drupal published SA-CORE-2024-003 through SA-CORE-2024-008 alongside releases 10.2.11, 10.3.9, 11.0.8 and 7.102. SA-CORE-2024-005 is the critical one, rated 17 out of 25 and tracked as CVE-2024-55635: reflected cross-site scripting in the Drupal 7 Overlay module, affecting 7.0 through 7.101 and fixed in 7.102, only where Overlay is enabled. SA-CORE-2024-003 is cross-site scripting in JavaScript-rendered status messages, rated 13 out of 25; SA-CORE-2024-004 is an access bypass rated 10 out of 25 where inconsistent uniqueness validation across database engines and collations lets a user register with an email address another user already holds. SA-CORE-2024-006, -007 and -008 are PHP object-injection gadget chains rated 8, 14 and 14, none directly exploitable without a separate flaw passing unsafe input to unserialize(). Eight contributed-module advisories also landed across the month, two of them Critical: Basic HTTP Authentication on 6 November, where the module can strip existing access checks from some paths, and POST File on 13 November, rated 17 out of 25 for cross-site scripting plus arbitrary PHP execution through unrestricted upload. Three more — Node export, Mailjet and Eloqua, all on 20 November — are the same unserialize() class as the core gadget chains.

    Update Drupal 10 to 10.2.11 or 10.3.9, Drupal 11 to 11.0.8 and any surviving Drupal 7 to 7.102, and check afterwards for duplicate-email accounts created before the fix — the access bypass leaves data behind rather than just an exposure. Then audit contributed and custom code for paths that pass attacker-influenced data to unserialize(): five of this month's fourteen advisories are that one bug class, which makes it the month's actual lesson rather than any single patch.

  • notable WordPress

    WordPress 6.7.1 fixes the regressions in 6.7 — wordpress.org

    Released 21 November 2024, nine days after 6.7 “Rollins”, this is a maintenance and bug-fix release. It carries 16 bug fixes across core and the block editor and is scoped to bugs introduced in 6.7. The five high-impact targets named in the release plan were sizes=auto causing images to render smaller than intended, translations failing to apply, editor crashes when browsing uncategorised patterns, zoom focus issues, and a missing zoom-out button where plugins register toolbar items. The team scoped it tightly to deliver stability before the holiday retail period.

    If you held 6.7 back because of the responsive-image regression, this is the release to move to — and verify image output on image-heavy templates afterwards, since sizes=auto changes which candidate the browser picks and therefore what your cache serves.

Supply chain, CI/CD and IaC

Sections
  • notable GitHub

    GitHub sets dates for breaking Actions changes — github.blog

    Published 5 November 2024, the notice sets out five changes. The ubuntu-latest runner label migrates to Ubuntu 24 between 5 December 2024 and 17 January 2025, bringing a different tool and package set. actions/upload-artifact@v3 and actions/download-artifact@v3 get brownouts on 9, 16 and 23 January 2025 and shut down fully on 30 January 2025. Effective immediately, workflows triggered from forked repositories validate both the pull request author and the event actor, and a limit of 1,500 triggered events per 10 seconds per repository applies. Self-hosted runners must allow outbound traffic to ghcr.io and *.actions.githubusercontent.com, because immutable actions are stored in the container registry.

    Pin runs-on: ubuntu-22.04 anywhere a build is sensitive to toolchain drift, and grep every workflow for the v3 artifact actions now rather than in the brownout window. If self-hosted runners sit behind an egress allowlist, add the two new hosts before the next runner upgrade.

  • notable Terraform

    Terraform 1.10 keeps secrets out of state with ephemeral values — hashicorp.com

    Announced 27 November 2024, Terraform 1.10 became generally available with ephemeral values — ephemeral input and output variables, and ephemeral resource blocks that fetch a value, use it within a single phase and then close. HashiCorp states these values are not stored in any artefact, neither the plan file nor the state file, which addresses the long-standing problem that secrets read through a data source persisted in plaintext in state. Initial provider support covered AWS, Azure, Kubernetes and random, with Google Cloud support stated for 9 December 2024. Write-only attributes for managed resources were deferred to 1.11.

    For any module that pulls a credential through a data source, plan the move to ephemeral blocks — this is the first mechanism that removes those secrets rather than marking them sensitive. Audit existing state files for plaintext secrets before assuming the upgrade fixes history.

  • notable PyPI

    PyPI ships digital attestations — blog.pypi.org

    On 14 November 2024 PyPI implemented PEP 740, letting maintainers publish signed digital attestations alongside distributions, and added an Integrity API plus file-level attestation detail in the web interface for consumers and installers. More than 20,000 attestations had already been published at announcement. Projects publishing through GitHub Actions using Trusted Publishing and the pypa/gh-action-pypi-publish action get attestations automatically with no configuration change. Automatic generation from other Trusted Publisher environments was stated as planned rather than shipped.

    If you publish Python packages, move to Trusted Publishing with the official action so attestations come for free. If you consume them in a build, start recording which dependencies carry attestations via the Integrity API — that inventory is what makes a future enforcement policy possible.

Languages, runtimes and frameworks

Sections
  • notable Symfony

    Symfony patches nine CVEs including a persistent-login bypass — symfony.com

    Symfony published nine CVEs across two release rounds: the bulk on 6 November 2024 with 5.4.46, 6.4.14 and 7.1.7, and CVE-2024-51996 on 13 November 2024 with 5.4.47, 6.4.15 and 7.1.8. CVE-2024-51996 is an authentication bypass via a persisted RememberMe cookie. CVE-2024-50340 allows the application environment to be changed from a query string, and CVE-2024-51736 permits command-execution hijack on Windows through the Process class. The remainder cover internal address enumeration, an open redirect via browser-sanitised URLs, a login path that ignores a custom user checker, and a validator returning the wrong response for input ending in a newline. Two further CVEs, CVE-2024-51754 and CVE-2024-51755, are Twig sandbox escapes through unguarded __toString() and __isset() or array-access calls.

    Upgrade to at least 5.4.47, 6.4.15 or 7.1.8 — the 6 November round does not carry the RememberMe bypass. If you render user-authored templates anywhere, patch Twig for the two sandbox escapes as a separate check rather than assuming the framework bump covered it.

  • notable Laravel

    Laravel environment can be changed from a query string — github.com

    CVE-2024-52301, published 12 November 2024 and rated CVSS 8.7 by GitHub, applies when the PHP directive register_argc_argv is on: an attacker calling any URL with a crafted query string can change the environment the framework uses to handle that request, and on many deployments that means a different configuration set or debug behaviour. Affected ranges are below 6.20.45, 7.0.0 to below 7.30.7, 8.0.0 to below 8.83.28, 9.0.0 to below 9.52.17, 10.0.0 to below 10.48.23 and 11.0.0 to below 11.31.0. The fix makes the framework disregard argv values for environment detection on non-CLI server APIs.

    Upgrade to 11.31.0, 10.48.23, 9.52.17 or the relevant patched tag. Where you cannot patch quickly — shared hosting is the usual case — set register_argc_argv = Off for the web SAPI as a stopgap.

  • notable PHP

    PHP 8.4.1 released 21 November 2024 — php.net

    PHP 8.4 was released on 21 November 2024 as 8.4.1, which PHP's announcement calls the latest minor release of the language. Security releases 8.3.14, 8.2.26 and 8.1.31 shipped the same day. PHP's release index carries no entry for 8.4.0.

    Start PHP 8.4 compatibility testing now, and more urgently confirm nothing you run is still on 8.1, whose security support ends on 31 December 2025.

Static site and web tooling

Sections
  • notable Vite

    Vite 6.0 ships the Environment API and drops Node.js 21 — vite.dev

    Released 26 November 2024, Vite 6 requires Node.js 18, 20 or 22 and later, dropping support for Node.js 21. The headline addition is the experimental Environment API, aimed at framework authors rather than application developers, letting them model development environments closer to production. Changes that affect build output include a new default for resolve.conditions, JSON stringification updates, Sass defaulting to its modern API, PostCSS configuration loading changes, expanded HTML asset reference support and changed CSS output file customisation in library mode. Vite now maintains a dedicated breaking-changes page.

    Before upgrading, check whether you rely on the old resolve.conditions default or on legacy Sass API behaviour — those two are the most likely to change built output without failing a build. Single-page applications should be unaffected by the Environment API.

  • notable Remix

    React Router v7 released, and Remix v2 users are told to upgrade to it — remix.run

    Released 22 November 2024, React Router v7 folds the Remix framework back into React Router. The announcement states that v7 "brings everything you love about Remix back into React Router proper" and encourages all Remix v2 users to upgrade. New capabilities include improved type safety, routing configured via routes.ts, and support for pre-rendering static pages. An upgrade guide was published alongside.

    Treat v7 as the maintained path for existing Remix v2 projects and budget the migration. If you were evaluating Remix for a statically hosted site, the pre-rendering support changes the calculation.

  • notable Hugo

    Hugo 0.139.0 removes long-deprecated code that already failed builds — gohugo.io

    Released 18 November 2024, Hugo 0.139.0 combines bug fixes and features with what the maintainer describes as the primary emphasis: removing code that has been deprecated for a long time. The announcement notes that this code has been shown as an ERROR in the build log and has failed the build for at least the last six minor versions, so 0.139.0 removes the underlying code rather than introducing a new failure mode.

    Before bumping past 0.139.0, run a build on the previous version and read the log for deprecation errors — anything listed there already stops the build and the supporting code is now gone.

Build on what the radar tracks

Integrations

How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.

Learn more

AI applications

Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.

Learn more

For developers

REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.

Learn more