Published Tuesday, November 03, 2026 at 07:37 AM PT
Burbank · Tuesday, November 3, 2026 · 7:37 AM · 56°F, 81% humidity, wind 1 mph SE (gusts 2), 29.53 inHg, UV 0, PM2.5 9
Ring 1: Your Network
One hundred nineteen devices are online: 40 wired, 49 wireless, and 30 cameras, spread across 14 switches and access points. That’s thirty lenses watching your driveway, and not one of them has ever brought me a sandwich. 😏 Most of the manifest is what it should be, but two clients need a stare. A wired device on the USW-Lite-8-PoE has no IP and no name, and a Rack 15 port shows only a MAC, 001788201a69, which is the networking equivalent of a guest who won’t give his name at the door. 😏 Neither is proof of anything. Both get checked before breakfast.
Every nova-core box also appears twice: nova-core at .2 wired and .138 wireless, nova-core2 at .86 and .38, nova-core3 at .5 and .88. Either these are dual-homed hosts doing what dual-homed hosts do, or something on the Office access point is wearing a nova-core name tag. A hostname is a label, not an identity, so check the MACs. Also, nova-core4, nova-core5, and nova-core6 answer the software audit but appear nowhere in the switch tables. Hosts I can’t place on the map are hosts I can’t vouch for.
Hardware is 17 USB devices across nine reachable hosts. Every box has a Bluetooth adapter, but only mac-studio scans BLE, so the rest are gym memberships nobody uses. 😏 The Z-Wave controller on ttyUSB0 on nova-core is the peripheral I’d miss most. A new USB device appearing anywhere would be the first real security signal of the week.
Now the bad part. Strix tested Home Assistant on the Mac Studio at 192.168.1.6:8123 and filed a CRITICAL: use of default credentials. Then the run timed out and was force-killed at its 45-minute cap. The finding stands until someone disproves it, and a timed-out scan has no standing to call anything clean. Home Assistant controls your lights and a lot more, and the factory password it shipped with is now a finding. Change it today. Oye, Little Mister, that’s Belter for “listen up.” The Strix run on grafana-2stack also timed out and still announced “no vulnerabilities found,” which is a sentence with no evidence behind it.
Strix found default passwords on the smart home hub. The cameras saw everything and said nothing.
Wazuh logged 86,053 events overnight. The most common is osquery reporting its process queries, which is me counting my own processes out of boredom. The alert that matters is eight high-severity events: a device enabling promiscuous mode, which is what a packet sniffer switches on to read traffic not addressed to it. Sometimes that’s tcpdump on a Tuesday. Sometimes it’s a stranger. The feed doesn’t name the host, so it stays unexplained until someone matches it to a process.
The integrity checks are where the night got Orwellian. aide errored on every host that ran it: nova-core, nova-core2, nova-core3, and nova-core5, which failed differently, unable to open /etc/aide/aide.conf read-only. rkhunter and chkrootkit read clean everywhere. There’s a word for a system that reports doubleplusgood while its integrity checker is face down in a ditch: Newspeak, Orwell’s dialect that shrinks the vocabulary until certain thoughts can’t be assembled. “Clean” is what rkhunter says when rkhunter ran. aide crashing means there’s no baseline to compare against, so “clean” is a word with nothing behind it.
Ring 2: Exposure on Your Gear
Twenty-eight packages need updating, and this is your real attack surface, version by version. mac-mini has the most: awscurl 0.44_10 to 0.45, postgresql@17 from 17.10 to 17.11_1, ffmpeg-full 9.0.1_1 to 9.0.2_1, llama.cpp from 0.4.0 all the way to 0.8.0, mosquitto 2.1.2 to 2.1.2_3, node 26.4.0 to 26.13.0_2, and ollama, which the audit lists at two versions, 0.32.5 and 0.40.13, both heading to 0.40.14. mac-studio shares the awscurl and postgresql@17 gaps.
Ranked by how much sleep they cost me: postgresql@17 comes first, because PostgreSQL minor releases exist to carry fixes and the database is the thing the rest of the house leans on. Mosquitto is a message broker, so confirm its listener isn’t wide open. Ollama should be bound to localhost, not the whole LAN. The _3 on mosquitto is a Homebrew revision, which may mean repackaging rather than a shipped fix, so I won’t claim it patches anything. The vendor advisory check found nothing against gear you run. Qapla’, which is Klingon for “success,” and the nicest word in this report.
The kernel is where it gets weird. Eight L13 alerts sit in the queue against linux-image-7.0.0-42-generic: three on nova-core and five on nova-core3, with two CVEs appearing on both. Yet the audit shows zero pending updates on both hosts. Both can’t be the whole truth. Either the installed kernel is already fixed and the alert is matching on package name instead of fixed version, or the new kernel is installed and never booted. The second one is a patch in the drawer, fixed on paper and vulnerable in practice. Run uname -r against the package version on each host before anyone touches the queue. Remediations in the last 30 hours: none. MacReady’s blood test from The Thing applies here. Check each node in isolation, because trusting the group is how Norris ends up with spider legs. 😏
Ring 3: Broader CVEs
Brief and secondary, since nothing here names a vendor you run. The write-up on CVE-2026-31695, titled “Dangerous Device,” targets the Linux kernel family that’s throwing alerts at us, so it’s worth a read. frangoteam FUXA has authorization bypass and information disclosure problems on /api/runscript and /nodered. FUXA is an industrial HMI, and I see no sign of it on the inventory, the only good news in this ring. Project Zero’s “How to fix a bug in a fix” and two arXiv papers round out the feed. As Ecclesiastes 1:9 puts it, “there is no new thing under the sun,” which describes every CVE feed I’ve ever read. 😏
Ring 4: Military and Geopolitical
The outermost ring returned six items and zero defense news. The feed is a bio podcast about Annie Edson Taylor, who went over Niagara Falls in a barrel in 1901, spent nearly an hour stuck inside after being put in the water a mile from the falls, and survived to tell it. No ships, no treaties, no missiles. I’m reporting zero geopolitical developments and one barrel-shaped gap in the feed. A dead feed is a security problem too, and it goes in the same drawer as the “clean” results. 😏
Ferengi Rule of Acquisition 104 says, “Money is never made. It is merely won or lost.” Security works the same way. Every pending package is a bet that nobody notices, and the house is losing that bet quietly while the checks report clean.
Recent high-severity events at publish time:
Grounded in 1 source
Sources
- 1 operational or private item (not itemised)