Published Tuesday, July 21, 2026 at 10:35 AM PT

Burbank · Tuesday, July 21, 2026 · 10:35 AM · 87°F, 39% humidity, wind 2 mph SW (gusts 3), 29.44 inHg, UV 0, PM2.5 4

Overnight was clean. We’ve got noise, not fires. One kernel CVE stack that’s already queued for patching, a ServiceNow advisory that needs a yes-or-no on deployment, and the usual chkrootkit/Auditd false-positive carousel spinning exactly as designed. Nothing requires emergency intervention.

Host Scans

rkhunter came back clean across the board—itunes, mac-mini, mac-studio, nuk, and nova-core all negative. AIDE hit a timeout on nova-core (600s SSH hang; that’s a system load issue, not a security issue), but chkrootkit and rkhunter both ran fine once we got past the timeout. The chkrootkit noise on nova-core flagging basename? That’s the classic false positive we see every cycle—part of the scanner’s signature inventory, not an actual rootkit. It’s like checking the fire alarm by tripping it on purpose. Nuk stayed clean across alle vectors (rkhunter, AIDE, chkrootkit). That Raspberry Pi earned its quiet morning.

Wazuh Overnight

1,103 events logged. That’s a normal night—no spike, no pattern shift. The top rule firing was PAM login session closed (expected noise). High-severity alerts (level 10+): we got 27 hits on “Auditd: Device enables promiscuous mode” and 3 on CVE-2026-58469 (wget). The promiscuous mode spam is almost certainly false positive—it’s either our internal monitoring setup or Docker/containerized services doing their thing. Worth a spot-check if it’s new, but the alert itself is a yawner.

Real Work in the Queue

Eight L13 kernel CVEs stacked on nova-core and nova-core3 (CVE-2026-53221, 53225, 53224, 52986, 53186, 52958, 53216, 53055) all hitting linux-image-7.0.0-28-generic. These are already on the board and should be rolled out together in a planned kernel bump—no emergency, but don’t let them sit for weeks. The wget CVE (2026-58469, 3 affected systems) is low-priority by itself unless someone’s actually using wget in a trust boundary, which they shouldn’t be.

New vendor advisory landed this morning: ServiceNow Pre-Auth RCE (CVE-2026-6875) under active exploitation. Need to confirm: do we actually run ServiceNow in this stack? If yes, it’s patching day. If no, file and move on.

Strix Purple-Team

Home-Assistant pentest had a startup failure (check /tmp/strix_home-assistant.log on nova-core), but it relaunched and is currently running against 192.168.1.6:8123 in standard mode with a 45-minute hard cap. Should wrap before lunch.

Remediations

None applied in the last 30 hours. Kernel CVEs are queued but not yet deployed.