docs: add security audit findings and register Tuxedo security tasks; add Basketball and Interactive Resume cards to Family Console portal

docs/security-audit.md

@@ -0,0 +1,55 @@
+# Security Findings Audit (October 2026)
+
+## Summary of Recent Security Disclosures & Network Audit
+
+---
+
+### 1. 🐍 LiteLLM Supply Chain Compromise (v1.107.0)
+
+* **Status**: **0% Impact / CLEAN**
+* **Audit Findings**:
+  * LiteLLM is **not installed or running** anywhere in the environment (`.13`, `.27`, `.35`).
+  * Central LLM gateway is **OmniRoute** (Next.js/Node.js on `.13:20129`).
+  * **IoC Scan**: Scanned all hosts for malicious `.pth` / `cook.py` / `cook.pth` files. Scan returned 100% clean across all filesystems.
+
+---
+
+### 2. 🐘 PHP Core Runtime ("PHP2Shell" - CVE-2026-109618 / CVE-2026-109619)
+
+* **Status**: **ACTION TAKEN / MITIGATED**
+* **Audit Findings**:
+  * 11 containerized PHP applications run on host `.35`.
+  * **Unauthenticated Applications (Action Taken)**:
+    - **BookStack** (`bookstack.lab.audasmedia.com.au`) -> **STOPPED** via `docker compose down` in `/Docker/Containers/bookstack`
+    - **Kanboard** (`kanboard.lab.audasmedia.com.au`) -> **STOPPED** via `docker compose down` in `/Docker/Containers/kanboard`
+    - **LinkAce** (`linkace.lab.audasmedia.com.au`) -> **STOPPED** via `docker compose down` in `/Docker/Containers/linkace`
+  * **Caddy HTTP Basic-Auth Shielded Applications**:
+    - **Firefly III** (`firefly.lab.audasmedia.com.au`)
+    - **phpIPAM** (`phpipam.lab.audasmedia.com.au`)
+    - **FreshRSS** (`freshrss.lab.audasmedia.com.au`)
+    - **LibreNMS** (`librenms.lab.audasmedia.com.au`)
+    - **Spotweb** (`spotweb.lab.audasmedia.com.au`)
+    - **DokuWiki** (`dokuwiki.lab.audasmedia.com.au`)
+    - **Homebox** (`homebox.lab.audasmedia.com.au`)
+    - **Metube** (`metube.lab.audasmedia.com.au`)
+  * **Local LAN Only**:
+    - **Pi-hole Admin** (`pihole.home.lab`)
+    - **LinkStack** (`linkstack.home.lab`)
+
+---
+
+### 3. 🟢 Node.js / HTTP2Shell Stream Multiplexing (CVE-2026-11002 / 03)
+
+* **Status**: **MONITOR & UPDATE BASE IMAGES**
+* **Audit Findings**:
+  * Node.js web services (**OmniRoute**, **Outline Wiki**, **n8n**, **Paperclip AI**) sit behind Caddy reverse proxy.
+  * Caddy terminates front-end TLS/HTTP2 requests, mitigating raw HTTP/2 stream multiplexing floods to backends.
+  * Base container images should be updated when upstream maintainers release Node v20.19.0+ / v22.14.0+ / v23.9.0+ images.
+
+---
+
+### 4. 🐍 Python Runtimes
+
+* **Status**: **SAFE**
+* **Audit Findings**:
+  * **Console Portal** (`.13:8500`), **DeepSeek Harness** (`.13:3081–84`), and **Prefect** run Python 3.12 with Uvicorn in standard HTTP/1.1 mode behind Caddy.