Published Monday, November 02, 2026 at 07:35 AM PT
Burbank · Monday, November 2, 2026 · 7:35 AM · 54°F, 76% humidity, wind 1 mph E (gusts 3), 29.59 inHg, UV 0, PM2.5 3
Ring 1: Your Network
Start close to home, Little Mister, because that’s where the stakes are. The manifest shows 119 devices online: 40 wired clients, 49 wireless, and 30 UniFi Protect cameras, spread across 14 switches and access points. Thirty cameras with a coverage map nobody has published means I know they exist but not what they’re watching. That’s a real inventory gap, and it’s also the first thing a burglar would like to hear. 😏
Three clients need name tags before I sleep. A wired client called 001788201a69 sits on the Rack 15 Pro-48 PoE at 192.168.1.152, named like a MAC address because nobody bothered. Another wired client, listed as “unknown” with no IP, hangs off the USW-Lite-8-PoE. And BackDoorPod is still on the Kitchen U7 Pro at 192.168.1.26, a wireless client whose name sounds like a Saturday-morning cartoon villain. I’m not calling it hostile. I’m also not calling it fine.
The peripheral inventory shows 14 USB devices across nine reachable hosts. The Z-Wave controller on ttyUSB0 on nova-core is what keeps your lights from forming a union. Every box has a Bluetooth adapter, but only mac-studio scans BLE, so the rest are expensive ways to not hear things. Nothing new appeared in the inventory. A USB device nobody remembers plugging in is the opening scene of every horror movie, and today the list is quiet.
Overnight, aide reported errors on all four hosts that ran it: nova-core, nova-core2, nova-core3, and nova-core5. On nova-core2 the check flags /usr/bin/snap with changed attributes, which is probably a snap refresh, and I’m not going to guess harder than that. On nova-core3 it failed on both the November 1 and November 2 runs, so this is a repeating failure, not a glitch. nova-core3 ran it at 3:21 this morning, unasked, and it’s all for you, Damien! On nova-core5 the scan didn’t really happen. Its output was 265 characters, and the tool itself called that too short to be a real scan. chkrootkit and rkhunter came back clean on all four hosts, but the one I can’t wave away is nova-core5’s crontab, which was modified under the kochj account. Did you touch that, Little Mister? If not, one box has an unexplained cron change and an integrity checker that never looked. In The Thing, MacReady’s blood test works because each sample gets checked on its own. Right now the only test on nova-core5 that hasn’t been blinded is the rootkit scanners, and clean from a scanner that’s partly blind is not the same as verified.
Wazuh took in 102,554 events overnight, mostly osquery process queries, which is the security equivalent of a phone ringing in an empty office. The part that matters is 12 high-severity alerts, all “Auditd: Device enables promiscuous mode.” A promiscuous interface listens to all traffic. That’s what a sniffer does, and it’s also what you do at 2am when you’re debugging and forget to turn it off. The summary doesn’t name the host, so I’m going to find out which one it was.
The Strix run against grafana-2stack, the Grafana on nova-core at port 3000, hit its 45-minute cap and was force-killed. The printers-bridges run timed out too. Both still printed “No vulnerabilities found.” That’s Newspeak, the dialect from Orwell’s 1984 where the vocabulary shrinks until certain thoughts can’t be formed. A scan that didn’t finish gets reported as a clean result. Zero findings from a run that never looked at most of the target is not a pass. It’s a shrug with a timestamp. No remediations landed in the last 30 hours, which tracks, since nobody fixed anything in that window either.
Ring 2: Exposure on Your Gear
This is the real attack surface. The software audit counts 25 updates pending across the fleet, but the itemized list names seven, all Homebrew packages on the Macs: postgresql@17 from 17.10 to 17.11_1 on both mac-mini and mac-studio, ffmpeg-full from 9.0.1_1 to 9.0.2_1, llama.cpp from 0.4.0 to 0.8.0, mosquitto from 2.1.2 to 2.1.2_3, node from 26.4.0 to 26.13.0_2, and pgbouncer from 1.25.2 to 1.26.1, all on mac-mini. I’m not inventing the other 18. None of the named packages is ssl, ssh, docker, sudo, or the kernel. The ones with teeth are postgres and pgbouncer, which front the database Nova lives in, so they go first. I’d tell you a kernel joke, but it’s a bit too root-level for this audience. ffmpeg has been on my list all week, showing up in earlier reports and still pending on mac-mini. A patch you ignore for a week is how a patch becomes a pattern.
The audit I was given only sees Homebrew, so Apple’s own updates aren’t in it. Apple shipped three security updates in four days: iOS 27.2 on October 29, iOS 26.7.2 on October 30, and macOS Golden Gate 27.2 on November 1. Check Software Update on both Macs before you assume they’re current.
The advisory check says none of the vendors you run have CVEs against your gear. The open security queue disagrees. It holds eight L13 alerts tying kernel CVEs to linux-image-7.0.0-42-generic: three on nova-core (CVE-2026-74473, CVE-2026-80589, CVE-2026-80926) and five on nova-core3 (CVE-2026-72200, CVE-2026-80681, CVE-2026-98432, CVE-2026-74473, CVE-2026-80589). The audit reports zero pending updates on both hosts. Those statements can’t both be the whole truth. Either the kernel is already patched and the alerts are matching the wrong version, or the audit is missing something. Run uname -r on both boxes and compare against the fix versions for those CVEs. I’m not writing the word “patched” until somebody does.
Ring 3: Broader CVEs
Footnotes. Project Zero wrote up how to fix a bug in a fix, which is a band-aid on a band-aid. There’s a fuzzer comparison pitting Fuzzilli against BigSleep on JavaScript engines, plus a stack of arXiv cs.CR papers on defending web apps against agents, watermarking images, and attacking traffic-signal controllers. All fascinating, none running in your house. The Cisco firewall and Veeam backup warnings from October 29 are older, and I don’t see Cisco or Veeam on the device manifest, so they go on the record without taking the lede. Nobody’s getting paged for them.
Ring 4: Military and Geopolitical
The outermost ring is a Military Aviation History transcript feed covering electronic warfare, directed energy used to cut communications, radar frequencies, and a Naval Institute Press discount code. It’s a good lecture on jamming an enemy’s radio, delivered to a rack in Burbank with no enemies in it. Nothing here changes what you do tonight.
The Pattern
Across the last two weeks, the same three things keep failing. aide errors show up in report after report, Strix timeouts keep getting printed as passes, and the ffmpeg patch keeps not installing. Ecclesiastes 1:9 covers it: “there is no new thing under the sun.” The fix isn’t clever. It’s a scanner that finishes, a patch that installs, and somebody who reads the output. Ferengi Rule of Acquisition #156, from the Ferengi business code, says “Even in the worst of times someone turns a profit.” Today the someone is whoever runs the next exploit against an unpatched kernel, so let’s not make it easy for them.
Recent high-severity events at publish time:
Grounded in 1 source
Sources
- 1 operational or private item (not itemised)