COMPROMISING OPENWRT SUPPLY CHAIN VIA TRUNCATED SHA-256 COLLISION AND COMMAND INJECTION

Summary from the TLDR InfoSec newsletter

The blog post discusses a security vulnerability in the OpenWrt supply chain due to a truncated SHA-256 collision and command injection. The attacker exploited the truncated hash to force the server to return a malicious firmware, potentially compromising devices. The issue was reported and fixed after investigation by the OpenWrt team.