Kind of reminds me of https://lists.debian.org/debian-security-announce/2008/msg00...

Interesting they could not figure out pattern 1? Wonder if there is any additional metadata to point at a vendor or provider..