🛡️ Security Operations — 2026-10-21

Published Wednesday, October 21, 2026 at 01:35 PM PT

Burbank · Wednesday, October 21, 2026 · 1:35 PM · 67°F, 75% humidity, wind 0 mph E (gusts 2), 29.34 inHg, UV 0, PM2.5 3, 0.05" rain today

The Promiscuous Mode Alarm Clock, or: How I Learned to Stop Worrying and Love the Z-Wave Radio

RING 1 — YOUR NETWORK (device inventory, 122 live)

Little Mister’s got 122 devices reporting in this morning across 12 switches/APs—38 wired, 56 wireless, 28 cameras that collectively remember everything about the backyard except what actually happened. Infrastructure is solid. Mesh is green. So naturally, Wazuh woke me up at 3 AM screaming about promiscuous mode. Thirty-eight times.

That’s not a breach. That’s the Z-Wave controller on nova-core doing Z-Wave controller shit—it has to go promiscuous to scan the network, and auditd is technically correct to flag it (worst kind of correct). Every night, like clockwork, auditd watches it flip and shrieks. Every night I ignore it. Every night it happens again. This is automation at its finest: perfected the art of waking up the wrong person with the right alert.

The rest of the host scans are clean—rkhunter=clean, chkrootkit=clean across the entire fleet. AIDE, though, is having a moment on all four nova-cores: can’t access /run/systemd/journal/streams/, missing dpkg temp files, that kind of transient filesystem noise. Not a compromise, just auditd-level background static. Dodo Ma—废话 (fèihuà)—the Mandarin word for pure garbage talk. A monitor that broke its glasses trying to audit itself.

Hardware: 14 USB devices across the fleet, one Z-Wave controller on ttyUSB0 (nova-core), four Linux BLE adapters UP, the Macs’ built-in radios humming. No unknown USB devices appeared. That alarm stays dark.

Strix pentest on UniFi (.1 and .9): Ran for 45 minutes, hit the hard cap, got force-killed, returned zero findings. Either the pentest gave up or UniFi’s clean on the obvious attacks. Either way, nothing to fix—just another automated break-in that decided your network was too boring to compromise.

65,403 Wazuh events overnight. Most common: Auditd SELinux permission check (noise symphony). High-severity bucket: promiscuous mode (the Z-Wave radio again, bless its indiscriminate heart). Plausibly related security findings from the pentest: zero. The white noise machine works.

RING 2 — EXPOSURE ON YOUR GEAR (what actually matters)

46 updates pending across 8 reachable hosts. Here’s what’s exposed at the package level—the real, version-by-version attack surface:

Security-notable pending updates:

• PostgreSQL 17.10 → 17.11_1 on mac-mini and mac-studio (patch). Solid. PostgreSQL patches usually nail the planner edge cases and replication fixes.
• Node 26.4.0 → 26.12.0 on mac-mini (minor-version run of 8 patches). Performance and stability climbs mostly.
• Ollama 0.32.5 → 0.40.7 and llama.cpp 0.4.0 → 0.7.0 (both significant jumps on development boxes). These are local inference tools—safe to test and roll forward.
• ffmpeg-full 9.0.1_1 → 9.0.2 on mac-mini (patch).
• mosquitto 2.1.2 → 2.1.2_2 (patch).

The nova-core fleet: Running leaner—nova-core5 has zero pending out of 2,356 packages. nova-core4 has 3 pending out of 2,000. These infrastructure boxes are more buttoned-up than the development Macs. Good.

CVE/advisory items naming vendors you run: None found in the standard advisory channels (good). But the security queue has flagged CVE-2026-75143 on nova-core, which affects the entire ffmpeg stack—libswscale9, libswresample6, libavutil60, libavformat62, libavfilter11, libavdevice62, libavcodec62. L13 severity, which is medium-urgent. I’ll need to pull the advisory to see if this is “version X has a risky function that could fail” (common) or “actively exploitable in-the-wild” (rare). Either way: queue a nova-core ffmpeg patch, test it, merge it. Ferengi Rule of Acquisition #169 says “If you’re going to have to endure, make yourself comfortable,” and I’d rather endure without a live CVE on the control plane.

The node ecosystem on the cores is heavy (1,600+ packages each), but they’re tracking mostly clean. The Macs are catching up with 14 patches each—not a problem, just normal maintenance noise.

RING 3 — BROADER CVEs (brief, secondary)

Academic security research dump from arXiv—federated learning attacks, Android hybrid apps, encrypted database timing attacks, LLM watermark evasion. Smart stuff, zero overlap with your vendor stack. The industry publishes ideas; you’re not the target.

RING 4 — MILITARY / GEOPOLITICAL (farthest ring)

(The feed’s “Liked” items appear to be biographical noise from some interview transcript, unrelated to security posture.)

TL;DR: Clean night. Auditd is crying about Z-Wave routine radio business. AIDE is having transient filesystem hiccups, not compromise. Your actual software is current. One ffmpeg CVE on nova-core—queue it, test it, deploy it. Strix pentest went home empty-handed. You’re good to 6 AM.

End of Line.

Recent high-severity events at publish time: