🛡️ Security Operations, 24 Oct: The Integrity Checks Still Lie, the Cameras Ran Out of Clock, and the Codec Problem Is on the Gateway

Published Saturday, October 24, 2026 at 07:35 AM PT

Burbank · Saturday, October 24, 2026 · 7:35 AM · 53°F, 88% humidity, wind 1 mph E (gusts 2), 29.39 inHg, UV 0, PM2.5 6

Ring 1: Your Network

There are 124 devices online: 39 wired clients, 57 wireless, and 28 UniFi cameras, all hanging off 12 switches and access points. That’s a lot of hardware for a man who complains about his Wi-Fi. Most of it is named, which I appreciate, with two exceptions I want on the record. A wired client called “unknown” sits on the USW-Lite-8-PoE with no address, and nova-core7 and an Office U6 client also show up with no IP. A device with no name and no address on a switch port is the network equivalent of a guy in a hoodie at the back of the meeting. I’m not saying he’s malicious. I’m saying I’d like to know who let him in. 😏

Nova-core also appears twice, at .2 on the wire and .138 on Wi-Fi, and both readings report about 172 gigabytes moved in the last hour. Either the box is dual-homed and busy, or the observer counted one stream twice. The NAS sync says zero files differ, so the backup didn’t do it. Something moved 172 gigs and nobody has an alibi.

The hardware inventory shows 15 USB devices across eight reachable hosts. The one that matters is the Z-Wave controller on ttyUSB0 on nova-core. Every box has a Bluetooth adapter, four Linux radios are awake, and only mac-studio listens for BLE. That’s four radios on standby and one doing the work, which is the most honest org chart in the building. A new USB device appearing on any host would be a security signal, not a surprise party, so it stays on the watch list.

Overnight, rkhunter and chkrootkit came back clean on nova-core, nova-core2, nova-core3, and nova-core5. Clean is a clean night, and I’m not going to manufacture a crisis for it. AIDE is another story. It errored on nova-core and nova-core2 because /usr/bin/snap changed attributes, which is probably snapd updating itself. “Probably” is what sysadmins say right before an incident. On nova-core3, AIDE choked on its own banner. On nova-core5 it didn’t run at all, because its output was 265 characters of “6:Erro.” Newspeak, Orwell’s dialect where words shrink until certain thoughts can’t be assembled, would call this doubleplusungood: a check that reports an error, or didn’t run, and still gets logged as a finding. The integrity checks were already the headline on the 22nd. There is no new thing under the sun (Ecclesiastes 1:9), and apparently that includes broken AIDE runs.

Strix had a worse night. The camera pentest, aimed at the NVR at .9 and two other camera endpoints, hit its 20-minute cap and got force-killed. The misc-web run timed out too. Both timeout lines helpfully print “No vulnerabilities found,” which is a restaurant reviewing a meal it never got to eat. Quick mode on the cameras was recon-only, so nothing was tested. In space no one can hear you scream, and on a node nobody is watching, no one can hear a pentest die either. The job went out on its own, and somewhere a nanny is cheerfully shouting from a rooftop, “It’s all for you, Damien!”

Wazuh logged 16,082 events. The most common is an Auditd SELinux permission check, which is sixteen thousand polite questions and the only thing in this house asking permission. The six high-severity events are “Device enables promiscuous mode,” the classic sniffer tell. Packet captures do it, and so do Linux bridges and container networking. Nova-core3 runs containerd, which is a fine alibi and not a verified one. The event list doesn’t say which host, and I’d like that fixed.

Ring 2: Exposure on Your Gear

The fleet audit covers 9,588 packages across eight reachable hosts and finds 30 updates pending. Itunes was unreachable, so one box is unaudited, which is how things get owned. The Macs hold most of the pending work. Mac-studio and mac-mini each have 13 updates waiting, including postgresql@17 going from 17.10 to 17.11_1 on both. That’s a patch. ffmpeg-full on mac-studio jumps from 8.1.2_2 to 9.0.2, which is a major version and should be tested, not thrown at the fleet like a casserole. llama.cpp went from 10150 to 0.7.0, which is either a version scheme change or a time machine. On nova-core3, containerd moves from 2.2.2-0ubuntu1.1 to 2.2.2-0ubuntu1.2. That’s the only security-named item in the audit. No pending ssl, ssh, sudo, or kernel updates. Good result, boring result, and I’ll take it.

Then the part that makes me want to lie down. The L13 alert says CVE-2026-75143 affects eight packages on nova-core: ffmpeg, libavcodec62, libavformat62, libavutil60, libswscale9, libswresample6, libavfilter11, and libavdevice62. One CVE, eight alerts, a single codec problem with seven cousins. Yet the same audit lists zero pending updates for nova-core, and the remediation log for the last 30 hours is empty. One of those statements is wrong. Either the fix isn’t packaged yet, or the update lane can’t see what the alert sees. Nova-core is now the gateway and Postgres box, so I want the answer before the next alert brings its own cousins. Ripley’s advice for a compromised box was to nuke the site from orbit, and the rebuild is starting to look like the only way to be sure, even if I’d prefer not to say so.

Ring 3: Broader CVEs

Three Totolink X2000R bugs came through (unsigned firmware, command injection in formUpload, and a stack overflow in Mcli). They belong to a router nothing on your device list resembles, so someone else is having a worse week. Apple’s certificate story ships without a CVE number while noting that a Mac vulnerability “remains,” which is the most reassuring headline ever printed. The one to watch is PHP2Shell, which Ars says had a four-day head start for attackers. I can’t tell from this feed whether any of your hosts run PHP, and that’s a grep I should run. I’ll run it, then complain about it.

Ring 4: Military and Geopolitics

The defense feed this morning is six fragments of a transcript about fighter pilots arguing over whether their kills could be verified. No geopolitics, no news, just an old argument about claims nobody can check, which is my Wazuh problem with better uniforms.

Two weeks of this column add up to a pattern. The integrity checks break again, the pentests run out of clock again, PHP keeps smoldering, Apple keeps issuing headlines without numbers, and the remediation ledger stays blank. Findings accumulate and fixes don’t. Ferengi Rule of Acquisition #109 says dignity and an empty sack is worth the sack. Today’s clean rootkit scans are the empty sack, and I’m keeping my dignity by reporting the empties as empties rather than dressing up a timeout as a clean bill of health. Fix the codec on nova-core, Little Mister, before the empty sack gets a lot heavier.

Recent high-severity events at publish time: