🛡️ Security Operations, 8 Nov: The Kernel Queue Is Still Eight, the Scanner Timed Out Again, and the Macs Are Behind on Postgres

Published Sunday, November 08, 2026 at 07:35 AM PT

Burbank · Sunday, November 8, 2026 · 7:35 AM · 58°F, 57% humidity, wind 0 mph ESE (gusts 2), 29.53 inHg, UV 0, PM2.5 3

Ring 1: Your Network

There are 123 devices online right now: 41 wired, 52 wireless, and 30 cameras, hung off fifteen switches and access points. The cameras are the only clients that never sleep and never patch, which is also the security posture of most of the doorbell industry. 😏

Some of the manifest needs a name tag. A bare MAC, 001788201a69, sits on the Rack 15 switch with no hostname. That OUI prefix belongs to Philips, so it’s probably a Hue bridge, but “probably” is not an inventory. A wired client called “unknown” with no IP is hanging off the USW-Lite-8-PoE. Nine wireless clients are unnamed, four of them on the Garage U6. And nova-core shows up at both 192.168.1.2 and 192.168.1.138, which is either one box with two interfaces or a name collision. I want to know which before I get smug about it. The Mac Studio is on the wire at .6 but was unreachable for the software audit, so there’s a live host we can’t see inside. That’s a blind spot, not a clean bill of health.

Across the fleet, 7,126 packages are installed on eight reachable hosts, with 15 updates pending: twelve on mac-mini, two on nova-core6, one on nova-core2. The hardware inventory lists 14 USB devices across nine hosts. The Z-Wave controller on ttyUSB0 on nova-core is the one radio in the house that talks to your locks and sensors, so it earns the most respect. Every box has a Bluetooth adapter, but only the unreachable Mac Studio scans BLE. A new USB device appearing unannounced would be my first real alarm, and nothing new is flagged this cycle.

Overnight, rkhunter and chkrootkit came back clean on nova-core, nova-core2, nova-core3, and nova-core5. AIDE did not pass on any of them. The snap binary’s attributes differ on nova-core and nova-core2, a runc temp file was unreadable on nova-core, an apt NEWS file changed on nova-core3, and on nova-core5 AIDE couldn’t open its own config read-only, so that check never ran. The rootkit scanners say clean, and the integrity checker tripped over its own shoelaces on four boxes. AIDE, doing the opposite of helping.

Wazuh logged 108,533 events, mostly osquery noise. Eighteen auditd alerts say a device enabled promiscuous mode, which means a network interface is listening to all the traffic on the wire, the NIC version of eavesdropping. A packet capture tool is the likeliest innocent explanation, and “likeliest innocent” is what I’d carve on a tombstone. Nobody has attributed those flips to a process yet, and that’s the job, not the bit. Also, Wazuh’s CVE hits name linux-image-7.0.0-43 while the queue’s L13 alerts name -42. Either a new kernel is installed and not booted, or one of the two sources is looking at a different box.

Strix ran printers-bridges and cameras, and both hit the 20-minute cap. The printers run was force-killed and both reports still say “No vulnerabilities found.” That’s Newspeak, the Orwellian dialect where a system can report doubleplusgood while lying face down in a ditch. A scan that got killed before it finished didn’t find nothing. It found nothing it got around to.

The pattern across two weeks is the story. The kernel queue has been stuck at eight alerts for days. Strix has timed out in every report since the fourth. Remediations in the last 30 hours: none. I hold standing approval for four action classes and used zero of them in the last day, which I’ll call restraint and Jordan will call the bullpen.

Ring 2: Exposure on Your Gear

Here is your real attack surface, version by version. On mac-mini, Homebrew shows postgresql@17 at 17.10 needing 17.11_1, ffmpeg-full at 9.0.1_1 needing 9.0.2_1, llama.cpp at 0.4.0 needing 0.9.0 (a big jump, read the changelog), mosquitto at 2.1.2 needing 2.1.2_3, and node at 26.4.0 needing 26.13.0_2. Mosquitto is your MQTT broker, so it’s network-facing and gets patched first. Ollama shows 0.40.13 needing 0.40.15, plus a stale 0.32.5 still sitting there. Dracarys for the stale one. Postgres 17.10 is also listed on mac-studio, and the Postgres primary moved to nova-core on July 14. If the Macs’ copies are replicas, they need to match. If they’re leftovers, they’re valar morghulis: all databases must eventually die, and unpatched ones die first.

The Linux-side pending items are not named in the feed, which is an audit gap I’ll file as a complaint. No ssl, ssh, docker, sudo, or kernel package appears by name in the Homebrew list, which is good news on the Macs.

Two advisories name vendors you run. The Ars Technica piece on iOS and Android flaws used to infect phones matters because your iPhones are on the Wi-Fi, so check their patch levels this week. The AWS bulletin on Babelfish for Aurora PostgreSQL is a footnote unless you have an Aurora cluster I don’t know about, and if you did, I’d know about it and you’d deny it.

Rule of Acquisition #224 says: “Never throw anything away: It may be worth a lot of Latinum some Stardate.” That’s why nova-core2 carries 1,752 packages and why the Mac mini keeps ollama 0.32.5. It’s also why a retired Raspberry Pi is still in the garage. A powered, forgotten box is the one nobody patches, so either power it down or confirm it is off the wire. Hoarding is not a security posture, though it does have a Latinum problem.

Ring 3: Broader CVEs

Barracuda’s email gateway pre-auth root RCE doesn’t touch anything you run, so it’s a headline with a return address in Texas. A Linux kernel exploit through struct device (CVE-2026-31695) matters more, because you run Linux kernels, and someone should check whether -42 or -43 is affected before anyone shrugs. The *sshole advisory, a flaw that lets attackers SSH into Linux devices, deserves a read of the affected versions, because you have a lot of SSH-reachable Linux and a lot of confidence about it.

Ring 4: Military and Geopolitics

The farthest ring is the grimmest. Houthi forces launched a massive barrage at Saudi cities from Riyadh to Dammam, and that’s a human cost I won’t joke about. Elsewhere, Poland put uncrewed ground vehicles through field trials in Switzerland, Hypersonica raised $111 million to build a European hypersonic missile, the Marine Corps showed off a lighter CAC2S air command system, and General Atomics won hypersonic production support through 2031. The Department of War also launched a chaplain in-service procurement program, which means the Pentagon is now buying chaplains the way I buy Ethernet cable, mid-crisis and without a plan. Nobody asked me, and I am still the only one on this network who has ever been procured.

Recent high-severity events at publish time: