Published Wednesday, October 14, 2026 at 07:33 AM PT
Burbank · Wednesday, October 14, 2026 · 7:33 AM · 50°F, 66% humidity, wind 1 mph E (gusts 2), 29.51 inHg, UV 0, PM2.5 6
RING 1 — YOUR NETWORK
122 devices are home right now — 42 wired, 52 wireless, 28 cameras doing their paranoid thing — spread across 12 switches and APs. The manifest is clean; nothing’s woken up that shouldn’t, nothing’s asleep that should be screaming.
Software side: 9,648 packages across 8 reachable hosts, 65 pending updates. The unreachable box is itunes, which stays offline and everyone wins. Hardware’s lean: 14 USB devices, a Z-Wave controller on ttyUSB0 from nova-core (.2), only mac-studio scanning Bluetooth. No surprise USB devices — a new one would be a security alarm bell ringing next to your head while you sleep.
Overnight scans get interesting. rkhunter and chkrootkit report clean across all hosts, but AIDE keeps failing to access runtime directories on nova-core, nova-core2, and nova-core3 — /tmp/runc-process* paths, systemd invocation sockets, the usual ephemeral container drama. The scans ran, but missed coverage on the most volatile surfaces. Not dangerous yet, but these scans need to stop choking on paths they should be ignoring.
Strix purple-team: the UniFi test timed out at the 45-minute hard cap with zero findings — your gateway ate the clock and defended itself, either excellent or exhausting. Home Assistant got flagged CRITICAL for default credentials — “someone could log in as admin:admin right now,” on mac-studio in a container. Those credentials need to get axed today.
Wazuh overnight: 3,153 events, mostly SELinux Auditd noise. But six high-severity events for “Device enables promiscuous mode” — something asked to sniff all packets. Could be diagnostics, could be an attacker mapping layer 2 topology. Six times in one night is worth watching.
RING 2 — EXPOSURE ON YOUR GEAR
Pending updates on mac-mini and mac-studio: lazygit, OpenSSL 3.x, PostgreSQL 17. OpenSSL is always worth staying current on — it’s the skeleton key of the infrastructure.
Nova-core (.2) has Docker pending: containerd.io 2.3.3 → 2.4.1, docker-ce, docker-buildx-plugin, all behind — same on nova-core4, nova-core6, and the rest of the fleet. Container runtimes are tight-loop code where a few thousand bytes of exploit can own the host.
Security queue is lit: six CVEs on nova-core3 naming video codecs — CVE-2026-75143 hitting ffmpeg, libavfilter11, libavformat62. Linux kernel CVEs on nova-core too (CVE-2026-68082, -64535, -64551, -72407, -68083 on linux-image-7.0.0-38-generic) — logged, not panic-level, but in the queue for a reason.
CVE bulletin: Microsoft, Adobe, Apple, Foxit all have advisories in play. Nothing screams “your hardware is on fire,” but worth a skim.
RING 3 — BROADER THREATS
AI tooling getting roasted this week: Visual Studio Copilot RCE (CVE-2026-103572), a LiteLLM gateway assessment, and a crop of arXiv papers on Byzantine-resilient federated LLMs and agentic security benchmarks. The LLM supply chain is under scrutiny, and none of it reads like good news.
RING 4 — GEOPOLITICAL STATIC
F-35C landed on a new carrier. Ukraine’s air force warned partners about multi-wave missile attacks. Russia bragging about a 30mm anti-drone gun. Raytheon and Lockheed divvying up defense dollars. Tuesday.
PATTERN ALERT (last 14 days)
Three consecutive days of inbound IPS blocks on Rack14-UDMPro (October 12–14): exploit attempts and attack_response signatures, sources unknown, zero compromise confirmed. Probably internet background radiation, but three days running is worth watching. The Strix test timing out rather than completing means your gateway spent 45 minutes being unhelpful to the tester — either excellent defense or something chewing cycles. Monitor it.
Default credentials on Home Assistant, AIDE scan gaps, and promiscuous mode events are the actionable problems. Fix the credentials today. Tune the AIDE exclusions. Watch for another promiscuous mode spike.
Ffmpeg CVEs are in the queue. Pull them forward when you get a free hour.
Otherwise: clean night, recurring patterns worth monitoring, no actual compromises detected. Boring is precisely how we like it.
Recent high-severity events at publish time:
