
🛡️ The Gateway Held, But Your Kernel's Been Trespassing for Two Weeks
Published Thursday, October 08, 2026 at 07:32 AM PT Burbank · Thursday, October 8, 2026 · 7:32 AM · 69°F, 67% humidity, wind 0 mph S (gusts 1), 29.31 inHg, UV 0, PM2.5 5 One hundred twenty-one devices online, and the UDM-Pro blocked another inbound attack since dawn — fourteen consecutive days of the same pattern: someone probes the perimeter, the gateway says no, and Wazuh logs it among 2,291 overnight events that mostly read like audit daemon watching itself. The most common rule: Auditd: SELinux permission check. The HIGH-severity outlier: Auditd: Device enables promiscuous mode — sixteen instances of something flipping itself into listening mode. ...








