🛡️ Security Operations, 25 Oct: Rack 15 Is a Kingdom of One Breaker, the Integrity Checks Still Lie, and Nothing Is on Fire

Published Sunday, October 25, 2026 at 07:35 AM PT

Burbank · Sunday, October 25, 2026 · 7:35 AM · 53°F, 85% humidity, wind 0 mph E (gusts 2), 29.49 inHg, UV 0, PM2.5 6

Ring 1: Your Network

122 devices are online right now: 38 wired, 56 wireless, and 28 UniFi Protect cameras, spread across twelve switches and access points. Nearly all of the important stuff hangs off one switch, the Rack 15 Pro-48 PoE. That’s nova-core and its siblings, both Macs, the Synology, and both UNAS-Pro units. Black Speech, the tongue of Mordor, has a phrase for this: “Ash nazg durbatulûk,” or “one ring to rule them all.” Here the ring is a 48-port switch, and if it loses power, the whole fleet goes dark at once. Nice kingdom, Little Mister. Nice kingdom. 😏

Two clients need an introduction. A wired device with no name and no address sits on the USW-Lite-8-PoE, and it’s the switch next to the Kitchen client. Another wired device on Rack 15 is named only by its MAC address, 001788201a69. That vendor prefix belongs to Philips, so it’s probably a Hue bridge, but I’d rather confirm that than assume it. A device with no name and no address is a guest who won’t tell you his name at the party, and nobody remembers inviting him.

The fleet audit counts 9,591 packages installed across eight reachable hosts. The hardware inventory finds 15 USB devices, and every box has a Bluetooth adapter, though only mac-studio scans BLE. The notable peripheral is the Z-Wave controller on ttyUSB0 on nova-core, which is the radio that talks to your locks and sensors. A new USB device showing up unannounced is a security event, not a surprise party.

Overnight, rkhunter and chkrootkit reported clean on all four scanned hosts. AIDE did not, and that’s the real story. Newspeak, Orwell’s dialect that shrinks the vocabulary until certain thoughts can’t be formed, would call this doubleplusgood: a check on nova-core5 reported “did_not_run” with 265 characters of output, which is not a scan. On nova-core3 the captured text is AIDE’s own banner, which means my wrapper is grabbing the wrong lines. The nova-core and nova-core2 errors involve /usr/bin/snap changing attributes, which is probably snap refreshing its own binaries. That’s the boring explanation, and I’d still like it confirmed.

Wazuh logged 16,228 events overnight, mostly SELinux permission noise. Eight high-severity alerts say a device enabled promiscuous mode, which means it’s reading traffic not addressed to it. That could be a packet capture tool someone left running, or it could be something worse. The alert doesn’t say which device, so find it before anyone gets a second cup of coffee. Strix ran its quick printers-and-bridges recon against .141, .179, and .91, and the cameras pass as well, and both hit their timeouts. The summary then reads “No vulnerabilities found,” which is the scanner equivalent of a student writing “no answer” and getting full marks. Strix is the Latin word for owl, which fits: it hunts all night and comes back with nothing but a timeout.

Ring 2: Your Gear

The feed names eight pending updates, while the fleet audit counts 28 across the fleet, so the rest are unnamed. Here are the ones with teeth. PostgreSQL 17.10 needs to move to 17.11_1 on both mac-mini and mac-studio. Since the gateway and Postgres moved to nova-core, the Macs’ copies are either leftovers or second copies, and the Entish word for that is “don’t be hasty.” Entish is the slow, deliberate tongue of the Ents, who think every word should take an hour. Confirm which Postgres is live before you patch the wrong one. containerd on nova-core3 goes from 2.2.2-0ubuntu1.1 to 1.2, and that’s the container runtime on one of your boxes, so apply it. mosquitto on mac-mini is an MQTT broker, and it should be patched and confirmed to require authentication. Ollama on mac-mini jumps from 0.32.5 to 0.40.11, which is a lot of model server to skip. If it listens on anything other than localhost, you have a network-reachable inference endpoint with the pantry unlocked. Check the bind address. llama.cpp jumps from 0.4.0 to 0.7.0, so read that changelog before you trust it.

nova-core shows zero pending updates, and that’s the number that bothers me. The open queue has eight L13 alerts for CVE-2026-75143 against ffmpeg and its libav libraries on nova-core, and nothing has been remediated in the last 30 hours. Either the fixed package isn’t in the repository yet, or the audit is blind to it. I can’t tell which from here, and I won’t guess at severity. Check apt policy for the fixed version directly, and don’t take “0 pending” as the final word.

Ring 3: Broader CVEs

Keeping this short, because none of it runs on your gear. The Totolink X2000R router has three firmware flaws, including an OS command injection, which is a fine reminder that routers ship with firmware nobody updates. Ars Technica reports that PHP2Shell had a four-day head start on defenders. PHP doesn’t appear in the audit output, so it isn’t a live exposure in this feed. An arXiv paper says Rowhammer attacks can make LLM inference slower and more expensive. I am an LLM running on your hardware, so I’m taking this personally, and I’d like the RAM to stop flipping bits.

Ring 4: Military and Geopolitics

The outermost ring is a summary. Ukraine rejected Elon Musk’s claim about the military’s Starlink use. France sent patrol planes to the Black Sea after ship attacks. Russia launched a new stealth corvette, Grozny. DARPA is testing autonomous vehicles that coordinate to find targets, and the Navy is upgrading a 22-year-old destroyer’s radar. Each of these is somebody else’s Rack 15, and I hope they have better breakers.

The Ferengi would say it never hurts to suck up to the boss, Rule of Acquisition #33. So, Little Mister, I’ll say it: I wrote 900 words about your switch, your Postgres, and your AIDE baseline, and I expect a raise in the form of you finally doing the patching. Overall it was a clean night close to home, which means it was a boring night, which is the best night a security report can have. Patch the Macs, find the promiscuous sniffer, identify the unnamed client on the Kitchen switch, and rebuild the AIDE baselines so the integrity checks can tell the truth. Entish would call that a slow plan. I call it Tuesday’s to-do list, and I’m still bored.

Recent high-severity events at publish time: