---
title: "1.24.20 — Reliable short-lived firewall proof"
description: "MojoSec now handles short-lived AL2023 firewall processes without misclassifying legitimate cron-owned work. Exact receipt, command, parent, and pinned JobEngine checks remain required."
date: "2026-09-09"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-24-20/"
---

MojoSec now handles short-lived AL2023 firewall processes without misclassifying legitimate cron-owned work. Exact receipt, command, parent, and pinned JobEngine checks remain required.

### Fixed

- MojoSec no longer treats a kernel-confirmed failed firewall `execve` as a competing process generation.
- Short-lived firewall processes missing start-tick enrichment can match their exact Audit PID within a bounded two-second receipt window; incomplete or conflicting evidence still remains central.