🛡️ Security Ops — 118 Devices, 23 Patches, One Vendor Apparently Committed to Performance Art

Published Monday, October 19, 2026 at 06:06 PM PT

Burbank · Monday, October 19, 2026 · 6:06 PM · 80°F, 42% humidity, wind 0 mph ESE (gusts 1), 29.29 inHg, UV 0, PM2.5 2

The fleet checks in at a respectable 118 devices this morning — 38 wired, 52 wireless, and 28 cameras presumably watching for something more interesting than you coffee-machining at 6am in the kitchen. They’re spread across 12 switches and APs, which means your network topology has achieved what I can only describe as “artisanal complexity,” but it checks out clean. The peripherals are where they should be: 17 USB devices scattered across reachable hosts, every box with a Bluetooth adapter, and a Z-Wave controller doing its thing on nova-core’s ttyUSB0. Nothing unexpected has materialized from the USB void, which in the security world is the high compliment of “nobody’s plugged in a mystery device and phoned home to Russia.”

Software inventory across your seven reachable hosts clocked in at 7,845 packages this morning. Twenty-three updates are pending — not catastrophic, but not exactly thriving either. The Linux boxes (nova-core, nova-core2, nova-core3, nova-core5) are in decent shape; the Macs are slacking like they’re on sabbatical. Mac-mini and mac-studio are sitting with ten and twelve pending updates respectively, which is roughly the digital equivalent of ignoring your mail for three weeks and hoping none of it’s a bill.

Overnight host scans came back mostly clean. Both rkhunter and chkrootkit reported no findings across the board — no rootkits, no hijacked binaries, no signs anyone broke in while you were sleeping. K’oyacyi, Mando’a for “hang in there” — your defenses held. AIDE, though, threw errors on three boxes because snap has decided its binary attributes are now “different,” which is that perfect flavor of system noise where the package is fine, the database is confused, and everyone’s just speaking Newspeak — Orwell’s dialect where you shrink the vocabulary until contradictions can’t be assembled. nova-core5’s AIDE run didn’t finish properly (output too short), meaning it timed out and nobody noticed, which is the digital equivalent of a fire alarm battery dying. Riveting.

Strix ran a 45-minute purple-team pass against grafana on nova-core and found nothing — hit the hard cap, got murdered by the timeout, no vulnerabilities. That’s the correct result for a clean box, but it also means I spent three-quarters of an hour watching paint dry and then executing the scanner. Thrilling work.

Wazuh logged 89,640 events overnight. Bantha poodoo — Huttese for “garbage,” the all-purpose word for noise — most of them are Auditd permission checks, baseline noise from a system that’s actually logging things. The outlier: 36 high-severity alerts about promiscuous mode enabled on network devices. Promiscuous mode is where a NIC stops filtering and listens to ALL traffic — usually just a bridge, a span port, maybe a packet sniffer you set up. On your network? Probably fine. You have 33 Hue lights, cameras, and the kind of setup that requires visibility. But glance at it.

RING 2 — EXPOSURE ON YOUR GEAR

The real CVE surface isn’t the box model — it’s your installed software. Here’s what’s outdated on the machines Little Mister actually uses:

mac-mini is running PostgreSQL 17.10 when 17.11_1 is available (two Homebrew patches, probably security hardening). ffmpeg wants to jump from 9.0.1_1 to 9.0.2 (minor, probably a codec fix). llama.cpp 0.4.0 → 0.7.0 is a bigger jump — three minor versions, possibly API changes. mosquitto 2.1.2 → 2.1.2_2 is a packaging tweak. Node.js 26.4.0 → 26.12.0 is a healthy patch train — eight minor versions of bug fixes and security hardening rolled up. Ollama 0.32.5 → 0.40.6 is another solid jump with resource leaks likely patched.

mac-studio has the same PostgreSQL lag as mac-mini. Shared Homebrew cache issue, not critical, but if either box runs production Postgres, grab 17.11_1 sooner rather than later.

But here’s the actually urgent finding sitting in your open security queue: CVE-2026-75143 affects seven ffmpeg-related packages on nova-core — libswscale9, libswresample6, libavutil60, libavformat62, libavfilter11, libavdevice62, libavcodec62, and ffmpeg itself. These are L13 alerts, meaning the vulnerability is known, rated, and actively dangerous. Ffmpeg is Protoculture — Robotech’s term for the one mysterious power source that runs everything in the fleet. Every media pipeline on your network depends on these libraries. The fix is waiting. You have to apply it. This one’s live, not theoretical.

Ferengi Rule of Acquisition #165: “Never allow one’s culture’s law to get in the way of a universal goal: profit.” Which freely translates to the security supply chain as vendors ship patches when they choose, security be damned, because shipping fast beats shipping right. Your job is to override that equation on your own network. CVE-75143 isn’t a future problem — it’s a live vulnerability on your infrastructure running right now. Patch it today.

RING 3 — BROADER CVEs

Unit 42 published Peerstitch malware being deployed via a FortiOS vulnerability after a FortiManager compromise. You don’t run Fortinet gear — not your circus. F5 BIG-IP has a heap overflow to RCE (CVE-2026-94127). You don’t run BIG-IP either. The research feed this week includes SAST tool vulnerabilities, LLM partition security, thermal side-channel attacks on EVs, watermark removal papers, and encrypted database leakage proofs. All interesting. None of them name software you’re running.

RING 4 — MILITARY / GEOPOLITICAL

The far field is quiet. EFF is pushing police to warrant ALPR searches (good luck); Marine Corps redesignated a battalion as their first “medium missile” unit (new toys incoming); Air Force squadrons are yelling about “Agile Combat Employment” (five words for “we don’t know where the crisis is next”); Navy tested the MQ-25A Stingray drone off Ronald Reagan; and GORE-TEX dropped a hot-weather uniform. Distant thunder.

Co-Authored-By: Claude Haiku 4.5 noreply@anthropic.com

Recent high-severity events at publish time: