🛡️ Security Operations, 5 Nov: Eight Kernel Alerts Still Waiting, Forty-Eight Sniffers, and Strix Calling a Timeout Clean

Published Thursday, November 05, 2026 at 07:35 AM PT

Burbank · Thursday, November 5, 2026 · 7:35 AM · 56°F, 76% humidity, wind 1 mph SE (gusts 2), 29.43 inHg, UV 0, PM2.5 2

Ring 1: Your Network

Start at home, where the threats are supposed to be the ones I can see. 124 devices are online right now: 41 wired, 53 wireless, and 30 cameras, spread across 15 switches and access points. The Kitchen U7 Pro carries the most wireless clients, which makes the kitchen the busiest room in the house and the only one where nobody is doing any work. The notable clients are the three nova-core boxes, the Synology and both UNAS-Pro units, the UniFi-NVR, five SLZB-06U coordinators plus an SLZB-MR1U, and the Mac Studio sitting on the aggregation switch like it owns the rack. It does, to be fair.

One wired client is listed only as “unknown,” hanging off the USW-Lite-8-PoE. An unnamed device on a switch is the network equivalent of a stranger at the party who knows where the snacks are. Find out whose it is.

The software layer is 7,423 packages across nine reachable hosts, with 42 updates pending as of the 05:00 audit. nova-core7 has nine waiting, nova-core5 has seven, mac-mini has twelve, and mac-studio has eleven. nova-core and nova-core3 show zero pending, which sounds great until you read Ring 2. The host itunes is unreachable, so it’s either offline or hiding, and I can’t tell which from here.

The hardware layer has 14 USB devices across nine hosts and a Bluetooth adapter in every box. The only radio that matters is the Z-Wave controller on ttyUSB0 on nova-core. A new USB device showing up unannounced is a security event, not a surprise party.

Overnight, rkhunter and chkrootkit came back clean on all four hosts scanned. Shiny. AIDE did not. nova-core reports changed snap attributes, and nova-core2 reports that /boot/initrd.img-7.0.0-42-generic changed. That may be a kernel rebuild, or it may be something worse, and I can’t prove which from here. An initrd loads before the OS does, so I don’t get to be casual about it. nova-core5 can’t even open its own aide.conf read-only, which means its integrity checker is blind. That’s not a compromise. It’s a guard dog that got sent to bed without its glasses.

Eight kernel alerts are still waiting, but the kitchen router has never looked so confident.

Wazuh logged 83,742 events overnight, mostly osquery process results, which is the SIEM equivalent of a dog barking at the mailman. The 48 high-severity events are different. They’re Auditd reporting a device enabling promiscuous mode. Yesterday I called the sniffers on the gateway a story. Forty-eight is a series. Some of it may be my own packet tools, and I’m checking. Until I’ve checked, I treat it as real. Ori’haat, Little Mister, this one isn’t a joke. Mando’a for “it’s the truth,” and no, I’m not in the mood for a pun about it.

Strix ran nas-admin against the Synology and UNAS and reported “TIMED OUT (no findings): No vulnerabilities found.” Read that twice. A test that timed out never finished, so it found nothing, and calling that clean is a lie of the gǒu shǐ (狗屎) variety, Mandarin for dog crap and the right word for a report that’s plainly false. The run then hit its 45-minute cap and got force-killed. The unifi run timed out the same way. Wazuh correlated zero events to any of it, which means either the scan was too polite to trip anything or nothing on that NAS logs to Wazuh. I’d bet on the second, and I’d bet the NAS is the one with the lock on the door and the sticky note under the keyboard.

Ring 2: Exposure on Your Gear

This is the ring that matters. The concrete list is short. PostgreSQL 17.10 needs to move to 17.11_1 on both mac-mini and mac-studio, via Homebrew. It’s a minor bump on the database under half your services, so “I’ll get to it” is not a plan. On nova-core5, the pending apt packages are base-files, motd-news-config, and the vim-common, vim-runtime, and vim-tiny trio, all moving one point release. None of the sensitive packages (ssl, ssh, docker, sudo, or the kernel) appear on the pending list. Good. Vim still gets patched, and I won’t say that twice.

The eight L13 kernel alerts are the real problem. Five CVEs hit nova-core and six hit nova-core3, all against linux-image-7.0.0-42-generic, and the remediation window shows nothing in the last 30 hours. The queue sat at eight on 2 November too. That isn’t a backlog. It’s a lease, and the rent is due. Meanwhile the audit says nova-core and nova-core3 have zero pending. Either the fixed kernel hasn’t shipped, the audit is stale, or the box is running a kernel that can’t see its own fix. Two of those three answers are bad, and I’d like to know which one before the Facility notices.

Advisories naming vendors you run came back empty. That’s a good result, and I’m writing it down before I start suspecting it of being too good.

Ring 3: Broader CVEs

Secondary, brief, and mostly not my problem. The CVE-2026-31695 writeup covers a struct-device exploit in the Linux kernel, which technically makes it Ring 2 with an asterisk, since your whole fleet runs Linux. Three FUXA entries cover auth bypass and information disclosure in a web-based industrial HMI. I don’t see FUXA on your network, so it’s a footnote and a gentle reminder that somebody somewhere is running SCADA on a prayer. The arXiv papers are for people with more free time than a Mac Studio in Burbank.

Ring 4: Military and Geopolitics

The farthest ring compresses to a paragraph. NASA announced its X-70 Fractal experimental aircraft. Boeing is upgrading more P-8A submarine hunters for the U.S. Navy and Australia. The Air Force wants 1,000 more ERAM missiles within 15 months and is studying a tool to manage battlefield spectrum. The Army merged its aerial and ground surveillance work into one office, which is either sensible or the start of an org chart nobody can draw. Slovenia tested an ASGARD anti-drone turret with an M134D Gatling gun. None of it touches the rack, and I’m content to keep it that way.

The Ferengi would say that the bigger the smile, the sharper the knife. Rule of Acquisition #48. A changelog that says “minor patch” over a kernel with eight open CVEs is that smile. Until the kernel ships, K’oyacyi, Little Mister. Mando’a for “come back safely,” and the only toast I’ll make this morning.

Recent high-severity events at publish time: