Blog

Red Hat Satellite is built for RHEL. If your fleet also runs Windows, Ubuntu, or Debian, here is how Gardience covers all of it from one console, with patching, STIG and CMMC evidence, and approvals.

SUSE Multi-Linux Manager (formerly SUSE Manager) runs on Salt and manages many Linux distributions, but not Windows. Gardience runs on the same open-source Salt and patches and proves Windows and Linux from one console.

Broadcom ends support for VMware Tanzu Salt (Aria Automation Config, formerly SaltStack Config) in October 2028 and publishes no price. Gardience runs on the same open-source Salt, keeps your states and agents, and has a public flat price.

Microsoft deprecated WSUS. What it recommends instead for servers, what that costs at 250 and 1,000 servers, why it does not work on offline networks, and how Gardience patches Windows and Linux from your own server for one flat price.

CVE-2026-99999, called PwnEscape, lets a virtual machine send crafted network packets that corrupt the Linux host's kernel, leak host memory, crash the host, or run commands on it as root. Who is affected, which distributions have a fix, and how to patch KVM hosts without missing one.

Chef Infra Client from Progress is free only for personal and non-commercial use; commercial use needs a license, listed at $189 per node a year for Chef Enterprise. What that means for a fleet, the free Cinc distribution, and the realistic alternatives.

Check fleet health before a deploy, run a playbook in check mode on every merge request, and run approved changes from Jenkins, GitHub Actions, or GitLab CI with the gdn command line and the REST API.

Run Gardience next to the Salt master you already operate. Your agents, states, and pillars stay where they are, setup is one command with a plan you confirm first, and one command undoes it.

Import your AWX or AAP projects, job templates, surveys, inventories, and schedules into Gardience, keep your playbooks in Git unchanged, and drop WinRM, SSH keys, and per-node pricing. With a sample repository to try first.

Perforce moved new Puppet packages to a private repository with a commercial license above 25 nodes, and the community forked it as OpenVox. What changed, the four realistic paths for a Puppet fleet, and how to choose.

A free, verified mirror of the open-source Salt packages for Debian, Ubuntu, RHEL-family Linux, and Windows, synced nightly from packages.broadcom.com. Same layout, same signatures, one host name to change.

The Department of War suspended CMMC Phase 2 in July 2026, so November 10 is no longer the date. NIST 800-171, your SPRS score, and 72-hour reporting still apply. What that means for your servers.

CISA added the Fragnesia Linux kernel flaw to its exploited list after attackers chained it with PHP2Shell to get root. The fixed kernels per distribution, what to check before you reboot, and why a patched server is not protected until it restarts.

How to run Salt the GitOps way. Keep states in a Git repository with review before they reach a machine, manage runbooks, schedules and change windows as Terraform or OpenTofu code, and adopt an existing setup without recreating it.

A use-after-free in the Linux kernel's IPv4 TCP handshake, rated 9.8, that Anthropic says an unreleased Claude model turned into a zero-click root exploit. Which distributions have a fix, which do not yet, and what to do on each.

Is there a WSUS for Linux? Not from Microsoft, but the idea works. How a local Linux update cache works, the open-source ways to build one, and a built-in cache that also carries into networks with no internet.

CISA's Known Exploited Vulnerabilities catalog is the short list of CVEs attackers are actually using. What it is, the new 3-day deadlines under BOD 26-04, whether it applies to you, and a script that checks any scan export against it.

CVE-2026-96951 lets a crafted file skip Windows' downloaded-file warnings and was exploited before the patch. The October 2026 KB and fixed build for each Windows version, a script that checks any machine, and the build-number trap with Server 2025.

The exploited Collabora built-in CODE server bug lives in a Nextcloud app, not an OS package, so package-based CVE scanners say you are safe. How we found every copy in our lab, checked for planted files, and updated it, with the commands.

We gave Claude a narrow key to our Gardience fleet and asked it to deal with Node2Shell. It found the exposed server, got refused four times for asking too broadly, requested the fix with a reason, waited for a person to approve, and then checked its own work.

What KB5131594 is (the October 2026 Windows Recovery Environment update for Windows Server 2022), why it reports success and is offered again, the 250 MB recovery partition fix, and why WSUS can't deploy it.

CVE-2026-111497 is in Node.js and in the system Brotli library, on Linux and Windows. How to find every affected server and patch it, with the commands to check your own. Patched on Windows in 22 seconds.

With master_type failover, a Salt minion that can't resolve any master at the moment its master goes away logs "No master could be resolved" and never reconnects until restarted. What we found in Salt's code, how to reproduce it, and a small watchdog for Linux and Windows that fixes it.

How to check whether a server is exposed to PHP2Shell, the fixed PHP versions per distribution, the commands to patch one server, and a live test patching 600 exposed Debian web servers at once.

ChatGPT and Claude can write Salt states, and they can also invent modules and run the wrong thing on the wrong machines. The guardrails that make AI useful for fleet changes, and how to keep a self-hosted model in an air-gapped network.

Cloud patch services need the internet; enclaves cannot reach it. How to patch and prove compliance for Windows and Linux machines with no internet access, and what the management tool itself must satisfy.

Red Hat Ansible Automation Platform (Ansible Tower) pricing in 2026. Premium lists at $19,250 per 100 managed nodes a year on AWS Marketplace, $192,500 for 1,000 nodes. What it adds up to, how nodes are counted, and a flat-priced alternative.

WinRM is the hardest part of Ansible on Windows. Your three options today (WinRM done right, OpenSSH on Server 2022+, or an agent-based transport), with the trade-offs of each.

Azure Update Manager charges per server per month for machines outside Azure and needs Azure Arc on each. The math at 100, 500, and 1,000 servers, and when a flat-priced on-prem console is cheaper.

Broadcom set October 2028 as end of support for its standalone Salt console (SaltStack Config, Aria Automation Config, Tanzu Salt). What that means and the three realistic paths.

A fair comparison of Red Hat Ansible Automation Platform and Gardience for teams that manage Windows and Linux servers: connection model, patching and compliance, AI, Terraform, pricing, and when each is the better choice.

Ivanti Endpoint Manager flaws keep landing on CISA's actively exploited list. What to look for in the tool that controls every server, and how to replace it for Windows and Linux servers.

Perforce moved Puppet's packages to a private repository in 2025, with a commercial license needed past 25 nodes, and the community forked it as OpenVox. The three paths for Puppet shops, especially with Windows.

Salt install failing with 404s from repo.saltproject.io or bootstrap.saltproject.io? The packages moved to packages.broadcom.com in late 2024. How to fix installs, pin versions, and stop it biting again.

Salt 3006 LTS is down to critical fixes and loses those in June 2027; Salt 3007 STS is already out of active support. A practical, low-risk plan to move masters and minions to Salt 3008 LTS.

After upgrading a Salt master to 3008, VMware SaltStack Config / Aria Automation Config / VCF Salt stops talking to it. Broadcom's KB explains why; here are the fixes and the longer-term choice.

Beacons let a Salt minion report what happens on its machine; reactors let the master act on those events. How they work, a working example, the security trap most examples fall into, and when to use a console instead.

Salt supports multi-master and failover setups, but key sync, split brain, and stale data catch teams out. The options, their trade-offs, and a tested warm-standby design with automatic failover.

Ansible is easier to start, Salt is stronger on Windows at scale. A practical comparison for Windows Server fleets (connection model, patching, speed, events, licensing) and how to get both.

SaltGUI is a solid open-source web UI for Salt. What to look for when a team needs roles, approvals, patching, compliance, Windows, and audit evidence on top of it.

SaltStack SecOps (Aria Automation for Secure Hosts) stopped being sold standalone in 2024 and its replacement reached end of life. How to keep scored STIG and CIS compliance on a Salt fleet.

Microsoft Configuration Manager is built for Windows desktops. For server teams with Windows and Linux, what to use instead for patching, configuration, compliance, and audit, and what to keep in MECM.

Restart a stopped service in seconds, warn before a disk fills, configure new machines the moment they join. How event-driven automation works with Salt's beacons and reactors, compared with Event-Driven Ansible and cron-style tools.

Assessors want proof, not screenshots. What evidence a configuration and patching program should produce for CMMC, NIST 800-53, and STIG reviews, and how to make it verifiable.

Terraform builds the machine; something has to configure it. How to make every instance join configuration management, get its baseline in seconds, and leave the fleet on destroy, with the Gardience provider.

Uyuni and SUSE Multi-Linux Manager are strong for Linux, but Uyuni closed its Windows support request as not planned. How to manage the Windows side of a SUSE or Uyuni shop without a second silo.

Extended support for Windows Server 2016 ends January 12, 2027. How to find every 2016 server, keep them patched until the end, decide upgrade, Extended Security Updates, or retire, and prove where each one stands.

Microsoft deprecated WSUS in September 2024 and points servers at Azure Update Manager. For teams patching Windows and Linux together, on-prem or offline, here are the realistic replacements.