Fabian Marquardt

🚨 Our Red Team discovered a new Linux vulnerability: “Pack2TheRoot” (CVE-2026-41651) It affects PackageKit versions 1.0.2–1.3.4 across major distros like Ubuntu, Debian, Fedora & Rocky Linux -potentially impacting servers running Cockpit. Details 👇github.security.telekom.com/2026/04/pack2t…

This is what happens when you give our Red Team a bit of free time to do some research.. #CVE-2026-41651 github.security.telekom.com/2026/04/pack2t…

1/12 Lots of people asking if I make every Asian male I interview insult Kim Jong Un - for the avoidance of doubt, I only ask someone to insult Marshal Kim when I'm already confident they're North Korean and trying to defraud. But how did I know Taro was North Korean? 🧵

Targeting NET 9 April for the launch of Mission ‘Onward and Upward’ during the available launch window, which opens at 8pm UTC; 10pm CEST. The final date remains subject to weather, safety and range infrastructure.

@HaifeiLi That sample seems to contact 188.214.34[.]20 and there is a domain ado-read-parser[.]com pointing to that IP, registered already on 2025-02-06. So maybe this has been ongoing even longer!

Whoa! This does seem to be a variant if you look at the Relations on VT, and this sample appeared on VT since 2025-11-28, (if confirmed) showing how long this advanced zero-day attack campaign has been ongoing! However, I don't have a VT account, could someone share the sample w/ me or just submit it to pub.expmon.com ? Thanks! x.com/greglesnewich/…

“You can see the surface of the Moon…we just went sci-fi.” On flight day seven, images from our @NASAArtemis II crew amazed, turning science fiction to reality. From the lunar far side to a solar eclipse from the Moon, the views are EVERYTHING. No pressure to pick a favorite.

⬇️ Check out our new blog post on recent exploitation of Ivanti EPMM appliances

Fun IP overlap spotted 🔍 🇮🇷 MuddyWater IP {209.74.87[.]100} reported by @polygonben in his blog (ctrlaltintel.com/threat%20resea…) That same IP appeared in Telekom Security’s list of IOCs (github.com/telekom-securi…) from their blog (github.security.telekom.com/2026/03/ivanti…) on Ivanti VPN exploitation.

For some reason, our incident response team was overwhelmed with Ivanti EPMM exploitation cases at the end of February (almost one month later after Ivanti's security advisory). Here are our findings: github.security.telekom.com/2026/03/ivanti… #ivanti

We're bringing progress and ambition back to Europe: Spectrum’s stages for Flight 2 have arrived at our launch pad at @AndoyaSpace , gearing up for pre-flight testing.

Today I had a surprise video debate at an AI company apparently in a conference hall. Asked why I for decades said The Keepers Of The Status Quo at Wikipedia is really bad training to reach AGI. I played this James Burke video. It silenced the room!

My regular reminder whenever a vendor discloses a 0-day on an edge device: Patching it doesn’t fix the breach that already happened. If it was exposed for months, patching it is like changing the front door lock while the burglars are already in your living room.

🚨 ALERT: Cybercriminals are sending out fake Telekom invoices via phishing emails to deliver multiple malicious RAT payloads. The activity originates from an attack cluster tracked by Telekom Security under the name "Rodent Weed". 🧵1/6

It's tough being a mom.

Wondering if a code-signing certificate has been reported? See it in one of your favorite tools: Cert Central's blocklist is now appears in MalwareBazaar! We've reported ~300 certs so far this year; it is on pace for a record. Keep an eye out and keep uploading. :)

I often am asked for pointers on building a VM for malware analysis. I wrote a 40+ page chapter on this in my book Evasive Malware. You can download this chapter from the book on my blog for free here: evasivemalware.com/EvasiveMalware… Thanks @nostarch for allowing me to give it away 🤓

things that bother me about working in cybersecurity (in no specific order): - glorified burn out culture - the toxic mindset of “if you’re not spending your free time studying up on cyber, you aren’t working hard enough” - the toxic mindset of “i had to spend 5 years working on help desk and 3 years as a sys admin before landing my first cyber role, so you should have it this hard too” - the gatekeeping - the weird belief that GRC isn’t as important as red or blue teaming - the insecure men who feel threatened when a female is more successful than them ick

@0x0bea @Botconf @sud0suw Thanks for your great presentation! Looking forward to meeting you again next year 👍😀

Thank you @Botconf for the warm welcome and for giving @sud0suw and I the opportunity to share our research on WIZARD SPIDER’s crypters! We had a great time connecting with everyone, hearing amazing ideas, and catching up with both new and familiar faces. Until next time!

❣️

💥 Ransomware kill chain broken – Operation Endgame strikes again 🔸 300 servers taken down 🔸 650 domains neutralised 🔸 €3.5M crypto seized 🔸 20 international arrest warrants Europol & partners deliver another blow to global cybercrime. More ⤵️ europol.europa.eu/media-press/ne…