Trivy Scanned My Compromised Server This Morning. It Found Two OpenSSL Bugs.

October 2026 — the scanner was healthy, up to date, and looking straight at it

Last weekend I finally got around to a project that had been on the list for months: proper vulnerability scanning for the cluster. Trivy Operator, a built-in server so every scan doesn’t re-download the vulnerability database, a UI, alert rules, an accepted-risk register with a review date. The works. I was genuinely pleased with myself. The cluster was now observed.