OpenWrt orders router firmware updates after supply chain attack scare

OpenWrt disclosed a high-severity supply-chain vulnerability in its attended sysupgrade (ASU) workflow: Imagebuilder fails to sanitize package names (command injection) and the build request uses a truncated 12-character SHA-256 hash, allowing hash collisions. Combined, these flaws could let an attacker poison the artifact cache and serve compromised firmware images; official images were reported unaffected, no signing keys were exposed, and fixes and mitigation commits have been published.