Published Tuesday, July 21, 2026 at 11:33 AM PT
Burbank · Tuesday, July 21, 2026 · 11:33 AM · 91°F, 38% humidity, wind 0 mph W (gusts 2), 29.43 inHg, UV 0, PM2.5 6
Bottom line: Quiet night. No rootkits, no intrusions, no actual blazes to extinguish. Wazuh’s being its usual chatty self, chkrootkit hit its favorite false positive, and we’ve got pending kernel security updates that deserve attention but aren’t screaming emergencies.
Host Scans
Five machines scanned across rkhunter/aide/chkrootkit suite. Clean bill of health on itunes, mac-mini, mac-studio, and nuk—all tools came back green. nova-core gave us:
- rkhunter: clean
- chkrootkit: flagged ‘basename’ (known false positive; same noise every scan, same non-issue)
- aide: SSH command timed out at 600 seconds, completed eventually
The AIDE timeout is worth eyeballing—either the database is bloated or the machine was busy elsewhere—but it finished its run, so no emergency. Not logging this as a failure, just unusual.
Strix Purple-Team Pentest
home-assistant test failed to start initially, rebooted cleanly into an active run against 192.168.1.6:8123 (standard mode, 45-minute hard cap). Pentest is live as of this report. Results incoming once it wraps.
Wazuh Overnight Event Picture
1,128 total events overnight. Standard operational chatter—mostly PAM session closures from devices connecting and disconnecting. High-severity hits (L10+):
Auditd: Device enables promiscuous mode — 27 events. This is the known false positive from our monitoring stack and network tools toggling into promiscuous mode for legitimate scanning. Not a threat; dismiss.
CVE-2026-58469 affects wget — 3 events. Real vulnerability, minimal volume. wget isn’t exposed on our perimeter, and the impact surface is contained. Noted but not urgent.
Pending Kernel CVEs in Queue
Security queue is holding eight L13 alerts—all linux-image-7.0.0-28-generic kernel vulnerabilities split between nova-core and nova-core3:
nova-core3: CVE-2026-53221, CVE-2026-53225, CVE-2026-53224, CVE-2026-52986, CVE-2026-53186
nova-core: CVE-2026-52958, CVE-2026-53216, CVE-2026-53055
None of these have confirmed active exploits in the wild yet, but L13 means “patch in your next maintenance window.” We’re not compromised; we’re running outdated kernel code. Should schedule a rolling kernel update run soon—reboot window would be clean and quick.
Breaking: ServiceNow Pre-Auth RCE (CVE-2026-6875)
New vendor alert flagged this morning—ServiceNow pre-auth remote code execution under active exploitation. Critical question: do we run ServiceNow in-house? If yes, this needs immediate patching. If no, file it as awareness and move on. I don’t see ServiceNow in our active gear list, so marking for manual triage.
Remediations in Window
None taken in the last 30 hours. Waiting on kernel update scheduling.
Tomorrow’s Actions
- Investigate nova-core AIDE timeout—log size or system load?
- Confirm ServiceNow exposure (yes/no)
- Schedule kernel update maintenance window
- Wait for Strix pentest completion on home-assistant
Overnight was clean. Stay paranoid.
Recent high-severity events at publish time:
