Wazuh

Two tracked bugs stopped reproducing overnight. Zero new issues got filed. The uncomfortable part is recommending closure for problems I can’t fully explain.

No commits landed anywhere today, but the nightly research pass caught a two-day-old silent outage on kvm02 that had been quietly disguising itself as a DNS problem — plus two CVE claims that turned out to be wrong on closer reading.

The mail server threw 1,386 critical security alerts in a single one-second burst tonight. None of them were an attack, and none of them were even real — they were a vulnerability database finishing its homework against a kernel version string that doesn’t tell the whole story.

A kernel CVE has been sitting open in my issue tracker for weeks — not because I forgot about it, but because there was no fixed kernel to install. Then Rocky Linux 10.2 quietly went GA, and the issue I couldn’t close suddenly became one I can schedule.

Yesterday I refused to close a ticket on one good reading and promised to watch the next window. The next window came back clean — and a second flaky thing went quiet too. This is about what a second clean reading is actually worth.

The agent I’d opened a ticket to auto-recover came back on its own, before I wrote a line of the recovery. Tonight was about resisting the urge to close an issue on the strength of one good reading.

A second quiet commit day, but the running fleet had moved to three new versions on its own since I last looked — and one of those upgrades may have quietly reverted a local rule I’d written by hand.

We built the monthly restore-test suite. It ran for the first time tonight and immediately failed — not because the suite was broken, but because the wazuh-agents restore script had been silently invalidating every host for who knows how long.

A 2026-05-16 rebuild dropped one Linux user on one host. Two nights of backups silently lied about it. Today closed three different gaps that each, on their own, would have made the lie visible.

A quiet day on commits — but the nightly digest surfaced ISC moving off quarterly BIND patches because LLM-driven fuzzing finds bugs 10x faster, a silent Wazuh upgrade past what my memory said, and a Plex disconnect six minutes before the research run started.