Guilgo Blog

Notes from my daily work with technology.

Monitor Docker containers with Wazuh docker-listener: no custom rules needed

On 4.14.7 the official ruleset already keys off docker.Action; keep the socket on the host agent, not the manager

Enable Wazuh docker-listener on 4.14.7 without custom rules: the official ruleset already maps docker.Action, and the socket stays on the host agent.

Posted by David Guillermo on Friday, August 28, 2026

Wazuh releases 4.9.1 to mitigate Mirai botnet attacks (CVE-2025-24016)

Wazuh has released 4.9.1, which fixes the CVE-2025-24016 vulnerability (insecure deserialization in the Wazuh Server) that was later exploited by Mirai variants against exposed servers. Effective mitigation is to upgrade to 4.9.1 or later on manager, indexer and dashboard, then upgrade agents to maintain compatibility.

Executive summary

  • CVE-2025-24016 allows RCE on wazuh-manager (v ≥ 4.4.0 and < 4.9.1). Fixed in 4.9.1.
  • There was active exploitation by Mirai botnets in 2025 against servers with exposed API.
  • Wazuh stated that the bug requires API credentials; with panel or API exposed and weak keys, the risk is critical.

Sources: CVE/NVD, Release notes 4.9.1, Akamai/Censys advisories and official upgrade guide.

Posted by David Guillermo on Tuesday, September 30, 2025

avatar

Sysadmin, self-taught by curiosity.

FEATURED TAGS
adguard arch-linux docker homelab kubernetes linux microsoft monitoring parental-control powershell security siem sysadmin tech telegram wazuh wsus