This Week in Security: What’s in a name, the AI Bugpocalypse Hits Everyone, OpenWRT flaws, and Duress Passwords

Google has introduced a new threat actor naming system with categories 'RELIC', 'CASTLE', and 'COMET', joining existing schemes from CrowdStrike and Microsoft. OpenWRT released a major update fixing a critical DHCPv6 stack-based buffer overflow in the odhcpd server, which is more severe on MIPS devices lacking modern protections. Cisco announced a shift to a twice-monthly patch cycle and will stop assigning CVEs to every bug, citing the surge in AI-discovered vulnerabilities.

The great thing about standards is there’s so many to pick from, right?. Insert obligatory XKCD 927 https://xkcd.com/927/ here. Several companies have developed naming schemes to refer to groups of attacks, and now Google has too https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system . Sometimes, malware, ransomware, or exploit groups name themselves: “Shinyhunters”, “LapSus$”, “Cl0p”, “Lockbit”, and so on. For the groups that don’t advertise their presence, identification and naming can be more difficult. Mostly state-run affairs that didn’t want to draw attention to themselves, these Advanced Persistent Threats APT groups were originally simply given numbers. APT28 refers to the Russian GRU Intelligence Directorate suspected of hacking the Democratic Party email servers, APT38 is a North Korean governmental agency involved in financial and crypto currency theft. Multiple companies and agencies have developed naming schemes to make referring to threat groups easier, typically including a regional identifier as well. CrowdStrike https://www.crowdstrike.com/en-us/adversaries/ naming uses name groups like “Bear” group for suspected Russian actors, “Panda” for China, “Spider” for unattributed crime groups, while Microsoft https://learn.microsoft.com/en-us/unified-secops/microsoft-threat-actor-naming uses “Blizzard”, “Typhoon”, and “Tempest”. Google, deciding there weren’t enough classifications already, now introduces “RELIC”, “CASTLE”, and “COMET”. Of course, each naming organization has dozens of other classification groups as well, but now the next time you hear about an attack being attributed to “Scattered Spider” you know it’s the CrowdStrike name for a crime group. Critical OpenWRT DHCP Flaw Fixed The Hacker News reports on a major release of OpenWRT https://thehackernews.com/2026/07/critical-openwrt-dhcpv6-flaw-could-let.html which includes fixes to the odhcpd server, the embedded DHCPv4 and DHCPv6 server written by OpenWRT. The bug is a straight-forward stack style attack where a buffer is allocated, but not length-checked against the data required to reply to a malformed request. OpenWRT runs on a wide range of devices, but one of the most popular legacy platforms still in use, the MIPS processor architecture, lacks most modern security protections against stack-based attacks, making this attack sting more than it might on other architectures. The latest OpenWRT releases also fix issues in the uhttpd embedded web server, multiple issues in the LUCI web configuration interface that allowed attackers to inject cross-site scripting content and Linux kernel security fixes. If you run a direct OpenWRT build on your equipment, update These bugs will have an extremely long tail however, with tens of thousands, or likely more, OpenWRT-based devices that will never see updates. The company behind several of the findings, Hacker House, say they used multiple AI tools and both open and frontier models to discover the bugs, then manual review and testing to confirm before reporting. Cisco to Stop Assigning some CVEs Cisco has announced it is moving to a twice-monthly patch cycle https://blogs.cisco.com/security/strengthening-the-foundation-a-predictable-customer-focused-response-to-ai-accelerated-vulnerability-discovery . Additionally, Cisco will no longer assign CVEs to each bug in the release. Cisco says this is in reaction to the rapid increase in bugs found by AI tools, and that “Assessing security risk CVE-by-CVE and applying point mitigations is no longer fit for purpose.” Cisco will still assign a CVE to a bug that “requires compensating controls” or is known to be exploited. It seems like it will be business as usual for the most severe bugs, but it will be interesting to see what happens when exploits are found for bugs which did not get a CVE in a prior release. Microsoft Suggests Three-Day Patch Race Microsoft is now recommending a 3 day patch window https://techcommunity.microsoft.com/blog/microsoftmechanicsblog/deploy-windows-updates-to-counter-ai-discovered-threats/4534505 for new patches. This is, to say the least, an “aggressive” schedule for applying new patches, given the recent track record of issues introduced by patches. A update that crashes is inconvenient on a home computer — even more so if it’s your parent’s computer — but could be catastrophic when it brings down an entire corporate fleet. Most large organizations have their own internal patch schedules and internal testing requirements before patches are deployed, delaying the patch process further. Systems like the CISA KEV database, a list of vulnerabilities known to be actively exploited, are in place to help identify the most important issues. With repeated record-breaking numbers of vulnerabilities pushed in Patch Tuesday and the decreasing support of the KEV and related vulnerability indexing systems, the load on IT departments and administrators is becoming impossible. The AI “bugpocalypse” is finding record numbers of vulnerabilities, while also closing the timeline between bug to exploit to hours in some cases. The time between bug and exploit then drives the patch cycle, which means less testing. With less testing, the patches are less stable, leading to less trust in rapidly installing them. Oracle Patches Almost 1500 CVEs Moving directly from the impacts of the flood of Microsoft security issues, the July 2026 patch set from Oracle https://blogs.oracle.com/security/july-2026-critical-patch-update-released included fixes for 1499 security issues and 1434 CVEs over 334 Oracle products. Oracle is also pressuring administrators to move to a monthly patch cycle, but acknowledges “transitioning to a monthly security patching cadence may require updates to existing operational processes”. Not to worry – there is a Oracle consulting service you can hire to help you patch your Oracle problems. Linux Patches 323 CVEs in Two Days After announcing over 400 CVEs in the Linux kernel last week, Linux mainters have announced an additional 323 https://lore.kernel.org/linux-cve-announce/ in the last three days alone. The vulnerabilities cover Bluetooth, Ethernet, USB gadget mode, WiFi drivers, virtualization systems, SMB file sharing, and of course more. One benefit to the architecture of the Linux kernel is that typically all the fixes will arrive in a single kernel update, but when almost every week brings critical updates and a new kernel, patch fatigue is a real thing. Either users stop applying every update, or the uptime and testing requirements of a company prohibits constantly updating and changing servers. Duress Passwords Aren’t Necessarily a Good Thing The security-hardened Android variant Graphene https://grapheneos.org , is in the news this week https://www.yahoo.com/news/us/articles/man-gave-border-agents-phone-174036936.html for the use of duress passwords. A duress password is a mechanism where a second PIN or password can be used to initiate a device wipe. The hope is that in a situation where you are compelled to unlock a device, providing a password which then wipes the device is a preferable option. The legality of a duress password depends on the environment it is used in. The United States Customs and Border Patrol claims that by wiping a device during an inspection at the US border, Samuel Tunick destroyed evidence and property in violation of federal laws. The issue is compounded because the stop happened at a border, where many US laws against search, seizure, and the availability of a lawyer are suspended, even for US citizens. The inclusion of duress passwords, and their cousin hidden encrypted volumes, can sound like a good idea, but can place users in serious danger when in situations with less strict rules of law. Having the ability to wipe data sounds great in isolation, but protestors, human rights workers, and other targeted groups have faced direct and physical threats under some regimes. Facing retaliation for wiping a device, or facing physical violence before providing an unlock code out of fear that it might wipe a device, can be a real risk for some. FreeBSD Fixes a WireGuard Bug FreeBSD has issued a security update https://lists.freebsd.org/archives/freebsd-announce/2026-July/000301.html pertaining to the WireGuard VPN implementation. WireGuard is a modern VPN with excellent performance even on low-end systems, and which has implementations on basically every platform. The FreeBSD implementation, however, didn’t fully validate VPN packets, accepting packets without checking one of the cryptographic validation measures. Attackers are able to inject data to a FreeBSD WireGuard implementation if they are able to guess some attributes of the connection, and able to fully modify the data in the VPN if they are able to intercept the packets. The bug impacts any FreeBSD user of WireGuard. FreeBSD has released updated kernels.