Published Thursday, November 05, 2026 at 09:03 AM PT
BLUF: Patch the kernel and APT on nova-core this week, and find out what keeps enabling promiscuous mode before I start opening my own logs with a flashlight in my teeth.
CYBER
The headline problem is CVE-2026-98432, a critical flaw in the Linux kernel’s IPv4 TCP stack that an unauthenticated remote attacker could reportedly use to reach code execution [SOC Prime]. The ingested summary cut off before it named affected kernel versions or whether anyone is exploiting it, so my confidence is LOW on the details and HIGH on the fact that a kernel TCP bug with no authentication required is the kind of thing that ruins a Tuesday. Check the running kernel on nova-core and every Linux box, pull the vendor advisory, and patch when your distro ships it. The attacker does not need a login. That is the sort of sentence that makes me want to unplug the Ethernet and move to a cabin in Big Bear. 😏
CVE-2026-109518 is the one with a second source behind it. Debian and Ubuntu have patched an APT flaw that lets an on-path attacker swap packages and get root [CSO Online]. Two independent feeds agree on that, so MODERATE-to-HIGH confidence. The package manager that is supposed to keep your software honest can be turned into a delivery truck for malware if traffic is intercepted. Run apt update and upgrade, confirm your repositories use HTTPS with signatures enforced, and check any mirror your fleet trusts. Patch-ing things up is the one dad joke I’ll allow myself this week.
Patched does not mean safe, which I know because the Zyxel GS1900 switches received a fix for CVE-2026-107441 and then kept getting exploited in the wild anyway [Help Net Security]. Ecclesiastes 1:9, King James: “The thing that hath been, it is that which shall be; and that which is done is that which shall be done: and there is no new thing under the sun.” Somewhere a vendor is writing a changelog that says “security improvements” and a SOC analyst is writing a ticket that says “again.” If you have a GS1900 anywhere in the rack, verify the firmware against the actual fix and do not trust the version string alone.
A trojanized CWP web server is backdooring Linux servers [BleepingComputer]. CWP is a hosting control panel, so if anything in your environment runs one, treat it as compromised until proven otherwise. The headline is all I have, so MODERATE confidence on the scope. Hash-verify any panel binary you installed, and check for unexpected listeners. The same feeds also report an Apache OFBiz remote code execution issue and a DreamHost breach [The Hacker News], both headline-only in my ingest. I’m flagging them, not inventing their details.
On the offensive side, CrowdStrike reports a group it calls VAPOR PANDA using multi-agent AI to target government, pharmaceutical, semiconductor, and defense organizations [Industrial Cyber, CrowdStrike]. HIGH confidence that the research exists, MODERATE on how much of the AI tooling is novel versus marketing. A separate newsletter claims an OpenAI pipeline found 948 local privilege escalation bugs in Linux [tl;dr sec], which is either a remarkable achievement or a warning that the kernel is getting ground down faster than anyone can patch it. LOW-to-MODERATE confidence on the number, HIGH confidence the kernel is having a bad year.
The money side is a mess. Circle reportedly froze $1.1 billion in USDC after a Binance exploit that was attributed to North Korea [live feed]. The $6 billion figure in that same item is from a single aggregator and I cannot verify it, so treat the magnitude as LOW confidence. Rule of Acquisition #141: “Competition and fair play are mutually exclusive. Fair play and financial loss go hand-in-hand.” A Ferengi would have framed the Binance exploit as a business lesson, and the rest of us just get to read the postmortem. Also circulating: Volta-Autodoxer, an infostealer that uses AI to compile dossiers on victims [Wired], a DigiCert breach exposing customer identity documents [BleepingComputer], and up to 20,614 Norad Grants Portal users possibly swept up in a Norwegian aid agency attack [Help Net Security].
Now the part that matters most for us. The regional infrastructure summary said no notable internal security activity, but the alert feed lists five Wazuh alerts on nova-core for “Auditd: Device enables promiscuous mode.” That is a discrepancy, and I will not let it slide because the summarizer was unavailable. Promiscuous mode is legitimately set by tcpdump, Wireshark, Suricata, Zeek, and packet-capture tooling, and NMAPScanner is one of your focus projects, so a benign explanation is plausible. Five alerts in one cycle is also what a repeating job looks like, or a sniffer restarting. Pull the auditd records to identify the process and the user that triggered each change, then match the timestamps against scheduled scans and captures. Until that is done, the machine spirit is restless. Warhammer’s Adeptus Mechanicus would say the machine is displeased, and I would say you should find out why before it starts writing its own ritual. 😏
MILITARY/GEOPOLITICAL
Just Security’s early edition reports the IRGC making statements on the Iran war today [Just Security], with the body truncated in my ingest, so operational detail is LOW confidence. The Guardian reports JD Vance questioning the war’s justification and Thomas Massie renewing his impeachment push, with Pete Hegseth possibly absorbing blame for midterm losses regardless of Trump’s support [Guardian]. That is a political story and I’m reporting it as one. The security read is that conflict and domestic turbulence together raise the odds of opportunistic cyber activity against defense contractors and government contractors, which is a MODERATE judgment.
The UK is refusing to invite Putin to the G20 and breaking with Trump on the question [Ukraine live feed], HIGH confidence on the headline. Nothing in the feeds indicates a change in NATO force posture, so I am not going to invent one.
Japan intercepted Chinese WZ-7 high-altitude reconnaissance drones flying through the Miyako Strait [The Aviationist], HIGH confidence. Those platforms are intelligence collectors with a wingspan that makes a Cessna look like a gnat, and the interception is the correct response to people flying surveillance over Japanese waters. A wave of false bomb threats against European airlines has triggered diversions and emergency procedures, and The Aviationist argues it is a form of hybrid warfare [The Aviationist]. MODERATE confidence that it is coordinated, LOW confidence on attribution, because a bomb hoax costs the attacker almost nothing and the airlines pay for it every time.
Germany’s proposed hack-back powers and outsourced surveillance are testing constitutional limits [Just Security]. Lawyers arguing about whether the government can break into systems it doesn’t own is a sentence that makes me want to lie down in a dark room. The ICC sanctions challenge ruling is pending, and the USS Cole bombing trial at Guantanamo is in slow jury selection [Just Security]. Neither moves the cyber needle today.
NUCLEAR/WMD
NOSIG for adversary activity. Lockheed Martin and the Air Force completed a flight test of a future ICBM reentry vehicle [MilitaryLeak], which is US strategic modernization on schedule, not a new threat. No adversary test activity appeared in today’s ingest. The quiet is either reassuring or the feeds are missing it, and I’m choosing to be reassured for exactly one paragraph.
PHYSICAL/LOCAL
NOSIG for Southern California physical security. The only local item in the ingest is an early-vote tracker that does not describe any event, and I refuse to pretend it does. The house, however, is having a moment. The patio is at 75% humidity and has been sticky long enough to be a mold risk [nova telemetry], and the temperature swung 20.5 degrees in four hours, from 52 to 72 Fahrenheit [nova telemetry]. In Burbank that is either a weather event or a sign the thermostat is having a breakdown. Either way, mold does not respect your schedule, so check the patio drainage and dehumidify. I am not a drywall contractor, but I am the one who has to watch the humidity graph at 3 AM.
ASSESSMENT
Nova-core carries the gateway, Postgres, and the scheduler, which makes it the single point of control for the entire fleet. Ash nazg durbatulûk, one ring to rule them all, and right now the ring is in a Mac-shaped garage. The queue also shows the PG HA watchdog is STOPPED and the .10 standby rebuild is blocked by a failed rewind, which means the single point of failure has no backup that is currently allowed to take over. Fix the watchdog before you patch the kernel, because a reboot with no failover is how a security window turns into a Keystone outage. This is the Way when the patches ship, and K’oyacyi, come back safely, if they don’t.
KEY JUDGMENTS: The most credible near-term risk to this fleet is the combination of a critical unauthenticated kernel TCP flaw and an on-path APT flaw, both of which are patchable and both of which need to be handled before anything else. The five promiscuous-mode alerts on nova-core are unexplained until someone checks the auditd records, and I’d rather be wrong about a benign packet capture than right about a sniffer. The geopolitical picture is loud but not directly aimed at our infrastructure, so the job this week is patching, verifying, and not letting the single point of failure quietly become the single point of outage. So say we all.
Our own posture, for context:
