{"slug": "this-week-in-security-whats-in-a-name-the-ai-bugpocalypse-hits-everyone-openwrt", "title": "This Week in Security: What’s in a name, the AI Bugpocalypse Hits Everyone, OpenWRT flaws, and Duress Passwords", "summary": "Google has introduced a new threat actor naming system with categories 'RELIC', 'CASTLE', and 'COMET', joining existing schemes from CrowdStrike and Microsoft. OpenWRT released a major update fixing a critical DHCPv6 stack-based buffer overflow in the odhcpd server, which is more severe on MIPS devices lacking modern protections. Cisco announced a shift to a twice-monthly patch cycle and will stop assigning CVEs to every bug, citing the surge in AI-discovered vulnerabilities.", "body_md": "The great thing about standards is there’s so many to pick from, right?. (Insert obligatory [XKCD #927](https://xkcd.com/927/) here.) Several companies have developed naming schemes to refer to groups of attacks, and [now Google has too](https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system).\n\nSometimes, malware, ransomware, or exploit groups name themselves: “Shinyhunters”, “LapSus$”, “Cl0p”, “Lockbit”, and so on. For the groups that don’t advertise their presence, identification and naming can be more difficult. Mostly state-run affairs that didn’t want to draw attention to themselves, these Advanced Persistent Threats (APT) groups were originally simply given numbers. APT28 refers to the Russian GRU Intelligence Directorate suspected of hacking the Democratic Party email servers, APT38 is a North Korean governmental agency involved in financial and crypto currency theft.\n\nMultiple companies and agencies have developed naming schemes to make referring to threat groups easier, typically including a regional identifier as well. [CrowdStrike](https://www.crowdstrike.com/en-us/adversaries/) naming uses name groups like “Bear” group for suspected Russian actors, “Panda” for China, “Spider” for unattributed crime groups, while [Microsoft](https://learn.microsoft.com/en-us/unified-secops/microsoft-threat-actor-naming) uses “Blizzard”, “Typhoon”, and “Tempest”.\n\nGoogle, deciding there weren’t enough classifications already, now introduces “RELIC”, “CASTLE”, and “COMET”. Of course, each naming organization has dozens of other classification groups as well, but now the next time you hear about an attack being attributed to “Scattered Spider” you know it’s the CrowdStrike name for a crime group.\n\n## Critical OpenWRT DHCP Flaw Fixed\n\nThe Hacker News reports on a [major release of OpenWRT](https://thehackernews.com/2026/07/critical-openwrt-dhcpv6-flaw-could-let.html) which includes fixes to the `odhcpd`\n\nserver, the embedded DHCPv4 and DHCPv6 server written by OpenWRT.\n\nThe bug is a straight-forward stack style attack where a buffer is allocated, but not length-checked against the data required to reply to a malformed request. OpenWRT runs on a wide range of devices, but one of the most popular legacy platforms still in use, the MIPS processor architecture, lacks most modern security protections against stack-based attacks, making this attack sting more than it might on other architectures.\n\nThe latest OpenWRT releases also fix issues in the `uhttpd`\n\nembedded web server, multiple issues in the LUCI web configuration interface that allowed attackers to inject cross-site scripting content and Linux kernel security fixes. If you run a direct OpenWRT build on your equipment, update! These bugs will have an extremely long tail however, with tens of thousands, or likely more, OpenWRT-based devices that will never see updates.\n\nThe company behind several of the findings, Hacker House, say they used multiple AI tools and both open and frontier models to discover the bugs, then manual review and testing to confirm before reporting.\n\n## Cisco to Stop Assigning (some) CVEs\n\nCisco has announced it is moving to a [twice-monthly patch cycle](https://blogs.cisco.com/security/strengthening-the-foundation-a-predictable-customer-focused-response-to-ai-accelerated-vulnerability-discovery). Additionally, Cisco will no longer assign CVEs to each bug in the release.\n\nCisco says this is in reaction to the rapid increase in bugs found by AI tools, and that “Assessing security risk CVE-by-CVE and applying point mitigations is no longer fit for purpose.” Cisco will still assign a CVE to a bug that “requires compensating controls” or is known to be exploited.\n\nIt seems like it will be business as usual for the most severe bugs, but it will be interesting to see what happens when exploits are found for bugs which did not get a CVE in a prior release.\n\n## Microsoft Suggests Three-Day Patch Race\n\nMicrosoft is now recommending a [3 day patch window](https://techcommunity.microsoft.com/blog/microsoftmechanicsblog/deploy-windows-updates-to-counter-ai-discovered-threats/4534505) for new patches. This is, to say the least, an “aggressive” schedule for applying new patches, given the recent track record of issues introduced by patches.\n\nA update that crashes is inconvenient on a home computer — even more so if it’s your parent’s computer — but could be catastrophic when it brings down an entire corporate fleet. Most large organizations have their own internal patch schedules and internal testing requirements before patches are deployed, delaying the patch process further.\n\nSystems like the CISA KEV database, a list of vulnerabilities known to be actively exploited, are in place to help identify the most important issues. With repeated record-breaking numbers of vulnerabilities pushed in Patch Tuesday and the decreasing support of the KEV and related vulnerability indexing systems, the load on IT departments and administrators is becoming impossible.\n\nThe AI “bugpocalypse” is finding record numbers of vulnerabilities, while also closing the timeline between bug to exploit to hours in some cases. The time between bug and exploit then drives the patch cycle, which means less testing. With less testing, the patches are less stable, leading to less trust in rapidly installing them.\n\n## Oracle Patches Almost 1500 CVEs\n\nMoving directly from the impacts of the flood of Microsoft security issues, the [July 2026 patch set from Oracle](https://blogs.oracle.com/security/july-2026-critical-patch-update-released) included fixes for 1499 security issues and 1434 CVEs over 334 Oracle products.\n\nOracle is also pressuring administrators to move to a monthly patch cycle, but acknowledges “transitioning to a monthly security patching cadence may require updates to existing operational processes”. Not to worry – there is a Oracle consulting service you can hire to help you patch your Oracle problems.\n\n## Linux Patches 323 CVEs in Two Days\n\nAfter announcing over 400 CVEs in the Linux kernel last week, Linux mainters have [announced an additional 323](https://lore.kernel.org/linux-cve-announce/) in the last three days alone. The vulnerabilities cover Bluetooth, Ethernet, USB gadget mode, WiFi drivers, virtualization systems, SMB file sharing, and of course more.\n\nOne benefit to the architecture of the Linux kernel is that typically all the fixes will arrive in a single kernel update, but when almost every week brings critical updates and a new kernel, patch fatigue is a real thing. Either users stop applying every update, or the uptime and testing requirements of a company prohibits constantly updating and changing servers.\n\n## Duress Passwords Aren’t Necessarily a Good Thing\n\nThe [security-hardened Android variant Graphene](https://grapheneos.org), [is in the news this week](https://www.yahoo.com/news/us/articles/man-gave-border-agents-phone-174036936.html) for the use of duress passwords.\n\nA duress password is a mechanism where a second PIN or password can be used to initiate a device wipe. The hope is that in a situation where you are compelled to unlock a device, providing a password which then wipes the device is a preferable option.\n\nThe legality of a duress password depends on the environment it is used in. The United States Customs and Border Patrol claims that by wiping a device during an inspection at the US border, Samuel Tunick destroyed evidence and property in violation of federal laws. The issue is compounded because the stop happened at a border, where many US laws against search, seizure, and the availability of a lawyer are suspended, even for US citizens.\n\nThe inclusion of duress passwords, and their cousin hidden encrypted volumes, can sound like a good idea, but can place users in serious danger when in situations with less strict rules of law. Having the ability to wipe data sounds great in isolation, but protestors, human rights workers, and other targeted groups have faced direct and physical threats under some regimes. Facing retaliation for wiping a device, or facing physical violence *before* providing an unlock code out of fear that it might wipe a device, can be a real risk for some.\n\n## FreeBSD Fixes a WireGuard Bug\n\nFreeBSD has [issued a security update](https://lists.freebsd.org/archives/freebsd-announce/2026-July/000301.html) pertaining to the WireGuard VPN implementation.\n\nWireGuard is a modern VPN with excellent performance even on low-end systems, and which has implementations on basically every platform. The FreeBSD implementation, however, didn’t fully validate VPN packets, accepting packets without checking one of the cryptographic validation measures.\n\nAttackers are able to inject data to a FreeBSD WireGuard implementation if they are able to guess some attributes of the connection, and able to fully modify the data in the VPN if they are able to intercept the packets.\n\nThe bug impacts any FreeBSD user of WireGuard. FreeBSD has released updated kernels.", "url": "https://wpnews.pro/news/this-week-in-security-whats-in-a-name-the-ai-bugpocalypse-hits-everyone-openwrt", "canonical_source": "https://hackaday.com/2026/07/31/this-week-in-security-whats-in-a-name-the-ai-bugpocalypse-hits-everyone-openwrt-flaws-and-duress-passwords/", "published_at": "2026-07-31 14:00:37+00:00", "updated_at": "2026-07-31 14:04:43.324578+00:00", "lang": "en", "topics": ["ai-tools", "ai-research"], "entities": ["Google", "OpenWRT", "Cisco", "CrowdStrike", "Microsoft", "Hacker House", "odhcpd", "uhttpd"], "alternates": {"html": "https://wpnews.pro/news/this-week-in-security-whats-in-a-name-the-ai-bugpocalypse-hits-everyone-openwrt", "markdown": "https://wpnews.pro/news/this-week-in-security-whats-in-a-name-the-ai-bugpocalypse-hits-everyone-openwrt.md", "text": "https://wpnews.pro/news/this-week-in-security-whats-in-a-name-the-ai-bugpocalypse-hits-everyone-openwrt.txt", "jsonld": "https://wpnews.pro/news/this-week-in-security-whats-in-a-name-the-ai-bugpocalypse-hits-everyone-openwrt.jsonld"}}