diff --git a/meta-security/dynamic-layers/meta-python/recipes-devtools/python/python3-pyinotify_0.9.6.bb b/meta-security/dynamic-layers/meta-python/recipes-devtools/python/python3-pyinotify_0.9.6.bb
index 8dd5e15..963fcfe 100644
--- a/meta-security/dynamic-layers/meta-python/recipes-devtools/python/python3-pyinotify_0.9.6.bb
+++ b/meta-security/dynamic-layers/meta-python/recipes-devtools/python/python3-pyinotify_0.9.6.bb
@@ -9,7 +9,6 @@
     ${PYTHON_PN}-logging \
     ${PYTHON_PN}-misc \
     ${PYTHON_PN}-shell \
-    ${PYTHON_PN}-smtpd \
     ${PYTHON_PN}-threading \
 "
 
diff --git a/meta-security/dynamic-layers/meta-python/recipes-security/fail2ban/python3-fail2ban_1.0.2.bb b/meta-security/dynamic-layers/meta-python/recipes-security/fail2ban/python3-fail2ban_1.0.2.bb
index 68695f2..135e97c 100644
--- a/meta-security/dynamic-layers/meta-python/recipes-security/fail2ban/python3-fail2ban_1.0.2.bb
+++ b/meta-security/dynamic-layers/meta-python/recipes-security/fail2ban/python3-fail2ban_1.0.2.bb
@@ -72,4 +72,3 @@
 RDEPENDS:${PN}-ptest = "python3-core python3-io python3-modules python3-fail2ban"
 
 RRECOMMENDS:${PN} += "${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'python3-systemd', '', d)}"
-RRECOMMENDS:${PN} += "python3-distutils"
diff --git a/meta-security/meta-integrity/README.md b/meta-security/meta-integrity/README.md
index 1a37280..2f30e78 100644
--- a/meta-security/meta-integrity/README.md
+++ b/meta-security/meta-integrity/README.md
@@ -219,12 +219,16 @@
     -sh: /usr/bin/rpm: Permission denied
 
 Enabling the audit kernel subsystem may help to debug appraisal
-issues. Enable it by adding the meta-security-framework layer and
+issues. Enable it by adding a kernel configuration fragment and
 changing your local.conf:
     SRC_URI:append:pn-linux-yocto = " file://audit.cfg"
     CORE_IMAGE_EXTRA_INSTALL += "auditd"
 
-Then boot with "ima_appraise=log ima_appraise_tcb".
+Then boot with "ima_appraise=log ima_appraise_tcb integrity_audit=1".
+For example, for QEMU by changing variable QB_KERNEL_CMDLINE_APPEND
+in your local.conf:
+    QB_KERNEL_CMDLINE_APPEND:remove:pn-integrity-image-minimal = "ima_policy=tcb ima_appraise=fix"
+    QB_KERNEL_CMDLINE_APPEND:append:pn-integrity-image-minimal = " ima_appraise=log ima_appraise_tcb integrity_audit=1"
 
 Adding auditd is not strictly necessary but helps to capture a
 more complete set of events in /var/log/audit/ and search in
diff --git a/meta-security/meta-integrity/recipes-core/images/integrity-image-minimal.bb b/meta-security/meta-integrity/recipes-core/images/integrity-image-minimal.bb
index 5022170..856249f 100644
--- a/meta-security/meta-integrity/recipes-core/images/integrity-image-minimal.bb
+++ b/meta-security/meta-integrity/recipes-core/images/integrity-image-minimal.bb
@@ -2,18 +2,16 @@
 
 IMAGE_FEATURES += "ssh-server-openssh"
 
+LICENSE = "MIT"
 
-IMAGE_INSTALL = "\
+inherit core-image
+
+IMAGE_INSTALL += "\
     packagegroup-base \
     packagegroup-core-boot \
     packagegroup-ima-evm-utils \
     os-release"
 
-
-LICENSE = "MIT"
-
-inherit core-image
-
 export IMAGE_BASENAME = "integrity-image-minimal"
 
 INHERIT += "ima-evm-rootfs"
diff --git a/meta-security/meta-integrity/recipes-kernel/linux/linux-yocto%.bbappend b/meta-security/meta-integrity/recipes-kernel/linux/linux-yocto%.bbappend
index be60bfe..9c599aa 100644
--- a/meta-security/meta-integrity/recipes-kernel/linux/linux-yocto%.bbappend
+++ b/meta-security/meta-integrity/recipes-kernel/linux/linux-yocto%.bbappend
@@ -1 +1,3 @@
+FILESEXTRAPATHS:prepend := "${THISDIR}/linux:"
+
 require ${@bb.utils.contains_any('DISTRO_FEATURES', 'integrity ', 'linux_ima.inc', '', d)}
diff --git a/meta-security/meta-integrity/recipes-kernel/linux/linux/audit.cfg b/meta-security/meta-integrity/recipes-kernel/linux/linux/audit.cfg
new file mode 100644
index 0000000..214dbe3
--- /dev/null
+++ b/meta-security/meta-integrity/recipes-kernel/linux/linux/audit.cfg
@@ -0,0 +1,2 @@
+CONFIG_AUDIT=y
+CONFIG_AUDITSYSCALL=y
diff --git a/meta-security/meta-parsec/recipes-parsec/parsec-tool/files/0001-parsec-cli-tests.sh-adapt-to-new-serialNumber-output.patch b/meta-security/meta-parsec/recipes-parsec/parsec-tool/files/0001-parsec-cli-tests.sh-adapt-to-new-serialNumber-output.patch
new file mode 100644
index 0000000..6c5a94f
--- /dev/null
+++ b/meta-security/meta-parsec/recipes-parsec/parsec-tool/files/0001-parsec-cli-tests.sh-adapt-to-new-serialNumber-output.patch
@@ -0,0 +1,33 @@
+From b5cbf8635483e2c1254d15af7427696a378dadf7 Mon Sep 17 00:00:00 2001
+From: Mikko Rapeli <mikko.rapeli@linaro.org>
+Date: Wed, 3 Jan 2024 12:30:38 +0000
+Subject: [PATCH] parsec-cli-tests.sh: adapt to new serialNumber output
+
+openssl 3.2.0 from yocto prints serialNumber to output
+without spaces so support both that and the old with
+spaces output to pass the test. Not using regular
+expressions to work on simpler grep implementations.
+
+Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
+---
+ tests/parsec-cli-tests.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Upstream-Status: Submitted [https://github.com/parallaxsecond/parsec-tool/pull/120]
+
+diff --git a/tests/parsec-cli-tests.sh b/tests/parsec-cli-tests.sh
+index 7693072..4dad2bb 100755
+--- a/tests/parsec-cli-tests.sh
++++ b/tests/parsec-cli-tests.sh
+@@ -225,7 +225,7 @@ test_csr() {
+         run_cmd $OPENSSL req -text -noout -verify -in ${MY_TMP}/${KEY}.csr >${MY_TMP}/${KEY}.txt
+         debug cat ${MY_TMP}/${KEY}.txt
+ 
+-        if ! cat ${MY_TMP}/${KEY}.txt | grep "Subject:" | grep "serialNumber = ${TEST_SERIAL}"; then
++        if ! cat ${MY_TMP}/${KEY}.txt | grep "Subject:" | grep -e "serialNumber = ${TEST_SERIAL}" -e "serialNumber=${TEST_SERIAL}"; then
+             echo "Error: The CSR does not contain the serialNumber field of the Distinguished Name"
+             EXIT_CODE=$(($EXIT_CODE+1))
+         fi
+-- 
+2.34.1
+
diff --git a/meta-security/meta-parsec/recipes-parsec/parsec-tool/parsec-tool_0.7.0.bb b/meta-security/meta-parsec/recipes-parsec/parsec-tool/parsec-tool_0.7.0.bb
index 26e4d80..af0d362 100644
--- a/meta-security/meta-parsec/recipes-parsec/parsec-tool/parsec-tool_0.7.0.bb
+++ b/meta-security/meta-parsec/recipes-parsec/parsec-tool/parsec-tool_0.7.0.bb
@@ -5,7 +5,9 @@
 
 inherit cargo cargo-update-recipe-crates
 
-SRC_URI += "crate://crates.io/parsec-tool/${PV} \
+SRC_URI += "\
+  crate://crates.io/parsec-tool/${PV} \
+  file://0001-parsec-cli-tests.sh-adapt-to-new-serialNumber-output.patch \
 "
 SRC_URI[parsec-tool-0.7.0.sha256sum] = "76afb4416d04c5af9f81285dfff390b09c6926aabd6b4ee20dc07470a9698732"
 
diff --git a/meta-security/meta-tpm/recipes-tpm1/hoth/libhoth_git.bb b/meta-security/meta-tpm/recipes-tpm1/hoth/libhoth_git.bb
index 7ba64f5..df1dc04 100644
--- a/meta-security/meta-tpm/recipes-tpm1/hoth/libhoth_git.bb
+++ b/meta-security/meta-tpm/recipes-tpm1/hoth/libhoth_git.bb
@@ -7,7 +7,7 @@
 LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
 
 SRC_URI = "git://github.com/google/libhoth;protocol=https;branch=main"
-SRCREV = "e520f8fa637589324ec56d34f26a48a8162a250c"
+SRCREV = "e4827163741e0804f12ac96c81b8e97649be6795"
 
 DEPENDS += "libusb1"
 
diff --git a/meta-security/recipes-compliance/lynis/lynis_3.0.9.bb b/meta-security/recipes-compliance/lynis/lynis_3.0.9.bb
index 5b5864c..b8b97a5 100644
--- a/meta-security/recipes-compliance/lynis/lynis_3.0.9.bb
+++ b/meta-security/recipes-compliance/lynis/lynis_3.0.9.bb
@@ -41,4 +41,4 @@
 FILES:${PN} += "${sysconfdir}/developer.prf ${sysconfdir}/default.prf"
 FILES:${PN}-doc += "lynis.8 FAQ README CHANGELOG.md CONTRIBUTIONS.md CONTRIBUTORS.md" 
 
-RDEPENDS:${PN} += "procps findutils"
+RDEPENDS:${PN} += "procps findutils coreutils iproute2-ip iproute2-ss net-tools"
diff --git a/meta-security/recipes-compliance/openscap/files/0001-Replace-distutils.sysconfig-with-sysconfig.patch b/meta-security/recipes-compliance/openscap/files/0001-Replace-distutils.sysconfig-with-sysconfig.patch
new file mode 100644
index 0000000..f3f8cf7
--- /dev/null
+++ b/meta-security/recipes-compliance/openscap/files/0001-Replace-distutils.sysconfig-with-sysconfig.patch
@@ -0,0 +1,57 @@
+From 9a8e01f8421f92f40b4cbff6cf055538e9a0b0ae Mon Sep 17 00:00:00 2001
+From: Evgeny Kolesnikov <ekolesni@redhat.com>
+Date: Thu, 25 Jan 2024 21:37:05 +0100
+Subject: [PATCH] Replace distutils.sysconfig with sysconfig
+
+Upstream-Status: Backport
+[https://github.com/OpenSCAP/openscap/commit/9a8e01f8421f92f40b4cbff6cf055538e9a0b0ae]
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ docs/developer/developer.adoc | 2 +-
+ swig/python3/CMakeLists.txt   | 2 +-
+ utils/CMakeLists.txt          | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/docs/developer/developer.adoc b/docs/developer/developer.adoc
+index 77c6d5161..e923069cc 100644
+--- a/docs/developer/developer.adoc
++++ b/docs/developer/developer.adoc
+@@ -113,7 +113,7 @@ On Ubuntu 18.04 and potentially other distro, the python3 dist-packages path is
+ If the following command:
+ 
+ ----
+-$ python3 -c "from distutils.sysconfig import get_python_lib; print(get_python_lib())"
++$ python3 -c "import sysconfig; print(sysconfig.get_path('platlib'))"
+ ----
+ 
+ returns "/usr/local/lib/python3/dist-packages" instead of a path like
+diff --git a/swig/python3/CMakeLists.txt b/swig/python3/CMakeLists.txt
+index 2594cf000..5f301326c 100644
+--- a/swig/python3/CMakeLists.txt
++++ b/swig/python3/CMakeLists.txt
+@@ -26,7 +26,7 @@ add_custom_target(python3_compile ALL DEPENDS ${PYTHON_COMPILED_FILES})
+ 
+ if(NOT PYTHON_SITE_PACKAGES_INSTALL_DIR)
+ execute_process(COMMAND
+-	${PYTHON_EXECUTABLE} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(True, prefix='${CMAKE_INSTALL_PREFIX}'))"
++	${PYTHON_EXECUTABLE} -c "import sysconfig; print(sysconfig.get_path('platlib'))"
+ 	OUTPUT_VARIABLE PYTHON_SITE_PACKAGES_INSTALL_DIR
+ 	OUTPUT_STRIP_TRAILING_WHITESPACE
+ )
+diff --git a/utils/CMakeLists.txt b/utils/CMakeLists.txt
+index 93ce1f2a9..9347c2976 100644
+--- a/utils/CMakeLists.txt
++++ b/utils/CMakeLists.txt
+@@ -91,7 +91,7 @@ if(ENABLE_OSCAP_UTIL_DOCKER)
+ 
+ 	if(NOT PYTHON_SITE_PACKAGES_INSTALL_DIR)
+ 	execute_process(COMMAND
+-		${OSCAP_DOCKER_PYTHON} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(False, False, prefix='${CMAKE_INSTALL_PREFIX}'))"
++		${OSCAP_DOCKER_PYTHON} -c "import sysconfig; print(sysconfig.get_path('purelib'))"
+ 		OUTPUT_VARIABLE PYTHON_SITE_PACKAGES_INSTALL_DIR
+ 		OUTPUT_STRIP_TRAILING_WHITESPACE
+ 	)
+-- 
+2.25.1
+
diff --git a/meta-security/recipes-compliance/openscap/openscap_1.3.9.bb b/meta-security/recipes-compliance/openscap/openscap_1.3.9.bb
index 97261df..d956ff1 100644
--- a/meta-security/recipes-compliance/openscap/openscap_1.3.9.bb
+++ b/meta-security/recipes-compliance/openscap/openscap_1.3.9.bb
@@ -11,7 +11,9 @@
 
 #Jun 22th, 2023
 SRCREV = "9b3e7563575f7e5b419f8a09999b40f30e3e7c29"
-SRC_URI = "git://github.com/OpenSCAP/openscap.git;branch=maint-1.3;protocol=https"
+SRC_URI = "git://github.com/OpenSCAP/openscap.git;branch=maint-1.3;protocol=https \
+           file://0001-Replace-distutils.sysconfig-with-sysconfig.patch \
+          "
 
 S = "${WORKDIR}/git"
 
diff --git a/meta-security/recipes-compliance/scap-security-guide/scap-security-guide_0.1.69.bb b/meta-security/recipes-compliance/scap-security-guide/scap-security-guide_0.1.71.bb
similarity index 95%
rename from meta-security/recipes-compliance/scap-security-guide/scap-security-guide_0.1.69.bb
rename to meta-security/recipes-compliance/scap-security-guide/scap-security-guide_0.1.71.bb
index 23637a5..5e45332 100644
--- a/meta-security/recipes-compliance/scap-security-guide/scap-security-guide_0.1.69.bb
+++ b/meta-security/recipes-compliance/scap-security-guide/scap-security-guide_0.1.71.bb
@@ -1,4 +1,4 @@
-# Copyright (C) 2017 - 2023 Armin Kuster  <akuster808@gmail.com>
+# Copyright (C) 2017 - 2024 Armin Kuster  <akuster808@gmail.com>
 # Released under the MIT license (see COPYING.MIT for the terms)
 
 SUMARRY = "SCAP content for various platforms, upstream version"
@@ -6,8 +6,8 @@
 LIC_FILES_CHKSUM = "file://LICENSE;md5=9bfa86579213cb4c6adaffface6b2820"
 LICENSE = "BSD-3-Clause"
 
-SRCREV = "da283b9a360f2f42ad642c0c9b08b061501bc667"
-SRC_URI = "git://github.com/ComplianceAsCode/content.git;branch=master;protocol=https \
+SRCREV = "459f0abf2ac08d36e5fc4a2619bc75cff7000da9"
+SRC_URI = "git://github.com/ComplianceAsCode/content.git;branch=stable;protocol=https \
            file://run_eval.sh \
            file://run-ptest \
            "
diff --git a/meta-security/recipes-scanners/checksec/checksec_2.6.0.bb b/meta-security/recipes-scanners/checksec/checksec_2.6.0.bb
index f4a014e..1ba3721 100644
--- a/meta-security/recipes-scanners/checksec/checksec_2.6.0.bb
+++ b/meta-security/recipes-scanners/checksec/checksec_2.6.0.bb
@@ -16,6 +16,6 @@
     install -m 0755 ${S}/checksec ${D}${bindir}
 }
 
-RDEPENDS:${PN} = "bash openssl-bin binutils"
+RDEPENDS:${PN} = "bash openssl-bin binutils findutils file procps"
 
 BBCLASSEXTEND = "native"