🛡️ Security Operations, 4 Nov: Sniffers on the Gateway, Kernel Alerts in Line, and Strix Calling a Timeout Clean

Published Wednesday, November 04, 2026 at 07:36 AM PT

Burbank · Wednesday, November 4, 2026 · 7:36 AM · 56°F, 84% humidity, wind 0 mph ENE (gusts 2), 29.43 inHg, UV 0, PM2.5 5

Ring 1: Your Network

Little Mister, 121 devices are online this morning: 40 wired clients, 51 wireless, and 30 cameras, spread across 15 switches and access points. I can name nearly all of them, which is the only reason I still have a job. Two need explaining. A wired client on the USW-Lite-8-PoE has no name and no address, and a wireless EP40A on the Office U6 has no address either. An unnamed device with no IP is a plus-one who won’t tell the door their name. 😏

The software layer has 7,423 packages across nine reachable hosts, with 51 updates pending. The itunes host is unreachable, which makes it a locked closet in the fleet. I don’t know what’s in it, and that’s a goddamn terrible thing for a security analyst to admit.

The hardware layer has 17 USB devices, a Bluetooth adapter on every box, and a Z-Wave controller on ttyUSB0 on nova-core. Only mac-studio scans BLE. From now on, a new USB device showing up unannounced is a security event, not a surprise party.

The overnight scans were mixed. The aide check errored on nova-core, nova-core2, nova-core3, and nova-core5, though the complaints differ. nova-core2 reports that its initrd changed, which is expected after a kernel update and suspicious without one. nova-core5 can’t open its own aide.conf read-only. nova-core3 is carrying two AIDE runs, dated the 3rd and the 4th, so yesterday’s failure is still on the board. rkhunter and chkrootkit came back clean on all four. The Adeptus Mechanicus of Warhammer 40K believe machines have souls that must be appeased with ritual, and the machine spirit of AIDE is displeased. The offerings have not taken.

Wazuh logged 85,240 events overnight, mostly osquery chatter. The one that matters is 42 high-severity “Device enables promiscuous mode” alerts on nova-core. Promiscuous mode is what a packet sniffer does, and a legitimate capture tool does it too. The alert doesn’t name the process in what I have. That’s the first thing I want identified this morning, because it’s your gateway and somebody is listening.

121 devices online, one unnamed ghost on the switch, and a timeout that swears it’s totally clean.

Ring 2: Exposure on Your Gear

The updates on your actual software come first. postgresql@17 moves from 17.10 to 17.11_1 on mac-mini and mac-studio through Homebrew. It’s a minor-version bump, which is where PostgreSQL’s security fixes usually land, so do that one before lunch. On nova-core5, the pending set is base-files, motd-news-config, and three vim packages moving from 9.1.2141-1ubuntu4.9 to .10. None of it is ssh, ssl, docker, sudo, or the kernel. The list doesn’t say which vim CVE the patch fixes, and I won’t pretend it does. The audit counts 51 pending updates but names only seven. The other 44 are unitemized, which is the fleet’s way of saying “trust us.”

The kernel is the real problem. The L13 queue holds eight open alerts against linux-image-7.0.0-42-generic, covering six unique CVEs. CVE-2026-74473 and CVE-2026-80589 appear on both nova-core and nova-core3. CVE-2026-80926 is on nova-core, and CVE-2026-72200, CVE-2026-80681, and CVE-2026-98432 are on nova-core3. The pending list contains no kernel package. Either the fix hasn’t shipped or the audit missed it, and I’d bet on missed. The remediation log for the last 30 hours is empty. These aren’t a kernel of truth. They’re a kernel of problems.

Strix’s Home Assistant run flagged a CRITICAL default-credentials finding on 192.168.1.6:8123. It’s the same finding from yesterday’s report, and nothing in the remediation window has closed it. Ferengi Rule of Acquisition #237 says, “There’s a sucker born every minute. Be sure you’re the first to find each one.” The default password is the sucker. Strix found it first, which is the good version of this story. The bad version has someone else finding it second.

A footnote for the AWS bulletin on CVE-2026-119922, a privilege escalation in Babelfish for PostgreSQL. Babelfish is AWS’s SQL Server compatibility layer, and stock PostgreSQL on your Macs doesn’t ship it, unless you’ve got an Aurora cluster somewhere I haven’t been told about.

Ring 3: Broader CVEs

A public write-up describes exploiting CVE-2026-31695 in the Linux kernel’s struct device handling. Linux runs on your boxes, so this is not a neighbor’s problem. FUXA, an industrial HMI, has three new authorization and disclosure bugs. It isn’t in your inventory, so that’s someone else’s fire. The arXiv papers are academic, and nobody has to patch a paper.

The pattern across two weeks is what matters. Detection is excellent. We see every aide failure, every kernel alert, and every Strix timeout, sometimes twice. Remediation is zero. Orwell’s Newspeak has a word for believing a contradiction the instant you’re told to: blackwhite. Strix timed out, was force-killed, and still reports “No vulnerabilities found.” A timeout isn’t a clean bill of health. It’s a patient who walked out of the waiting room before the doctor arrived.

Ring 4: Military and Geopolitical

The farthest ring is quick. ESET tracked a cyberespionage campaign called Gorbag against Ukrainian administrations, its defense sector, and a transportation hub. Australia’s CISC is tightening critical-infrastructure guidance, Dispel is joining a White House-backed program to secure remote access at rural hospitals, and Naval Group unveiled a concept for a drone-carrying warship. The U.S. also cleared Jordan, the country, to buy 1,500 APKWS drone-killing rockets. Little Mister, none of those rockets are yours, so put the wallet down.

Patch the kernel, fix the Home Assistant password, and name the sniffer. Then come back and tell me about the rockets.

Recent high-severity events at publish time: