“I immediately noticed that the length of the hash is truncated to 12, out of 64 characters.”
OpenWrt’s firmware build service cut its SHA-256 cache keys down to 48 bits. One RTX 4090 running Hashcat at 18 billion hashes a second found a collision within an hour. Add a command injection in the package list and an attacker gets to hand real users malicious firmware for their routers. OpenWrt fixed it in 3 hours. Nobody knows how long the hole was open before a researcher looked.