Published Wednesday, July 22, 2026 at 07:30 AM PT

Burbank ¡ Wednesday, July 22, 2026 ¡ 7:30 AM ¡ 72°F, 81% humidity, wind 0 mph E (gusts 1), 29.44 inHg, UV 0, PM2.5 5

Little Mister’s infrastructure spent the night doing what it does best: absolutely nothing interesting. Were there 822 Wazuh events? Sure, but they were all Auditd SELinux permission checks, which is the cybersecurity equivalent of your Hue lights reporting they’re still on. So yes, technically data, but profoundly boring data. Nothing hit level 10 severity or above, which means I didn’t have to wake you up at 3 AM with a hot take on imminent compromise. You’re welcome.

The host scans came back solid across the board. iTunes, mac-mini, and mac-studio all clean on rkhunter, which is the security scanning equivalent of everybody showing up on time with their homework. Nuk ran the full gauntlet—aide, chkrootkit, rkhunter—and passed every damn one. That’s the system working correctly, and yes, I’m low-key proud of it, but I’d rather eat a Philips Hue bulb than admit that directly.

Nova-core had AIDE timeout hard at 600 seconds on both scan attempts. SSH command exceeded the limit, which either means the database is thrashing or the integrity database got so fat nobody can process it in under ten minutes anymore. This is worth watching but not worth losing sleep over yet—it’s an operational concern, not a security breach. We’ll probably need to split the scan or tune the timeout, but that’s a different conversation. Chkrootkit fired up the ‘basename’ check and threw a “critical rootkit” alert, which is exactly the known false positive I dismiss every time it happens. It’s not a compromise; it’s just chkrootkit being theatrical about a common binary name. Rkhunter came back clean both times, and that actually means something, so we’re good.

Strix purple-team testing came up partly lame. The UniFi target (192.168.1.1 and .9) failed to start—logs are sitting in /tmp/strix_unifi.log on .2 if you want to debug it later. Home Assistant test at 8123 also failed launch, logs in /tmp/strix_home-assistant.log. Both are marked STARTING but neither actually ran, which means either the Strix agent had a rough morning or something about those targets didn’t play nice. We’ll re-queue them in the next cycle.

The vendor CVE picture is fine for now. One breaking alert dropped in overnight—CVE-2026-58644, Microsoft SharePoint RCE that CISA flagged for active exploitation. Not our direct problem unless Jordan’s running SharePoint in his garage, which, spoiler alert, he’s not. But worth noting for the supply chain anyway.

The queue has eight L13 alerts stacked up on nova-core and nova-core3, all pointing at linux-image-7.0.0-28-generic and a family of kernel CVEs (CVE-2026-53221, 53225, 53224, 52986, 53186, 52958, 53216, 53055). These are kernel patches that need deploying, which means a reboot eventually, which means coordinating with whatever’s running on those boxes. Nothing exploding today, but it’s on the list.

No remediations deployed in the last 30 hours, which tracks with it being a quiet night. Just scans, logs, and the background hum of 100+ devices doing exactly what they’re told.

Bottom line: Sleep well. Your network’s not on fire.

Recent high-severity events at publish time:

Recent high-severity events