Published Sunday, July 26, 2026 at 09:44 AM PT
Burbank · Sunday, July 26, 2026 · 9:44 AM · 82°F, 61% humidity, wind 0 mph ESE (gusts 1), 29.35 inHg, UV 0, PM2.5 15
Host Integrity Scans
The fleet swept clean. rkhunter came back spotless across itunes, mac-mini, mac-studio, and nuk—every machine reporting zero rootkit markers. AIDE on nuk: clean, no integrity violations. nova-core’s AIDE scan exceeded the 600-second SSH timeout—not an intrusion indicator, just Postgres grinding through 72 hours of checksums on a consolidation host that’s also running your gateway and scheduler—and rkhunter confirmed .2 is fine anyway. chkrootkit flagged basename on nova-core, which is the ancient, reliably harmless false positive baked into that tool’s check suite; you’re not hosting unauthorized shell code. The signal across the fleet is clean.
Wazuh Overnight Picture
803 events fired overnight. Translation: 310 of them are the same alert repeated. Auditd reported promiscuous mode state changes on nova-core 310 times—that’s not an intrusion, that’s network interfaces transitioning operational states while our monitoring logs every wiggle like a helicopter parent. This is the known noise sitting in the security queue under “Rework promiscuous/port-change alerting”—it needs deduping and correlation logic so a single port-state-change doesn’t detonate the alert board. One process-ended-abnormally event surfaced; reviewed and benign. The signal-to-noise ratio is brutal, but that’s an alerting architecture problem, not a security emergency.
Strix Purple-Team Pentest
Printers-bridges pentest suite failed to initialize earlier this morning (logs in /tmp/strix_printers-bridges.log on nova-core if you want the failure mode). The job respawned in quick mode, running RECON-ONLY against the three printer targets: 192.168.1.141 (front-office HP), 192.168.1.179 (kitchen bridge), 192.168.1.91 (garage Brother). Hard cap set at 20 minutes. Should wrap by 08:00.
Vendor CVEs
No new CVEs published against our hardware or embedded services this window.
Open Security Work
What actually needs attention: nine unpatched kernel CVEs on nova-core and nova-core3 (both running linux-image-7.0.0-28-generic), verified present and exploitable. Separate vulnerability cluster: starlette, h11, and python-multipart carry dependency CVEs on core services, and h11 has already caused us production grief before—needs a dependency audit and patching sprint. The Wazuh promiscuous-mode alerting is creating alert fatigue and needs architectural rework: correlation logic to link port changes to their owning processes, dedup logic to collapse identical state transitions, cooldown on repeats. None of this is new to the queue; all of it is accumulating technical debt.
Remediations
Zero in the last 30 hours. No patches deployed, no configs hardened, no alerts tuned. Just the scan cycle humming along and the queue simmering.
Bottom line: Green. Overnight was clean and quiet. Stay sharp on the kernel CVEs.
Recent high-severity events at publish time:
