Telekom Security Updates
Latest Update
From Infected Zyxel to Exposed C2: A Case Study in IoT Botnet Operations
This report documents the identification of previously concealed operational infrastructure, including an exposed operator working directory and command-and-control (C2) environment, following the investigation of low-volume authentication activity and a cu...
Read the analysis
-
SetRootLanguage: Local privilege escalation in Ubuntu via AccountsService
A two-bug chain in Ubuntu’s AccountsService language update path allows any local user to obtain local root access. We call the vulnerability chain “SetRootLanguage” because a single call to the SetLanguage D-Bus method is all it takes t...
Continue Reading -
From Dropbox to Violet RAT v5: A Multi-Stage WebDAV Delivery Chain
Threat activity clusters rarely remain static over time. Delivery methods, lure formats, and payload choices often change between campaigns, while the underlying tradecraft remains stable enough to support tracking and detection. This re...
Continue Reading -
ZipLine-linked spearphishing campaign uses PowerShell backdoor and Cloudflare Tunnel
Telekom Security investigated a spearphishing campaign targeting organizations in several European countries. The campaign ultimately enables follow-on activity that, in at least one observed case, led to the deployment of Qilin ransomwa...
Continue Reading -
Pack2TheRoot (CVE-2026-41651): Cross-Distro Local Privilege Escalation Vulnerability
Today we publicly disclose a high-severity vulnerability (CVSS 3.1: 8.8) - in coordination with distro maintainers - that affects multiple Linux distributions in their default installations.The Pack2TheRoot vulnerability can be exploited...
Continue Reading -
Mass exploitation of CVE-2026-1281 and CVE-2026-1340 in Ivanti EPMM
In early 2026, two critical zero-day vulnerabilities in Ivanti’s mobile device management platform - CVE-2026-1281 and CVE-2026-1340 - emerged as significant drivers of incident activity across multiple sectors. Both flaws, rated CVSS 9....
Continue Reading -
REDAXO Mediapool Reflected Cross-Site Scripting
A reflected Cross-Site Scripting vulnerability (CVE-2025-66026) has been identified in the REDAXO Mediapool component. The issue allows arbitrary JavaScript execution in the backend when a user visits a specially crafted link while authe...
Continue Reading -
Multiple vulnerabilities in Janitza UMG 96RM-E
Several vulnerabilities were discovered during testing of a Janitza UMG 96RM-E device.
Continue Reading