Published Saturday, October 03, 2026 at 06:05 AM PT
DIVD compromised via chained Zammad 0-day flaws exploited by agentic AI; session hijacking and RCE confirmed. Immediate patch/isolation of Zammad infrastructure required; copycat attacks anticipated.
DETAILS Target: Dutch Institute for Vulnerability Disclosure (DIVD), a critical non-profit coordinating responsible vulnerability disclosure globally. Attack vector: Multiple zero-day flaws in Zammad (support ticketing platform) chained together to hijack sessions and achieve remote code execution (RCE) on DIVD’s infrastructure. Attacker: An AI agent (agentic AI system) automated exploitation of the Zammad vulnerabilities; represents novel attack surface — autonomous LLM-driven reconnaissance and exploitation without direct human operator. Confirmed chain: Session hijacking → RCE → privilege escalation achieved. Attack timeline and scope of data access still under investigation by DIVD. Vulnerability status: Zammad zero-days remain unpatched in public advisories at time of this alert; widespread Zammad deployments likely vulnerable pending vendor remediation. IMPACT Immediate: DIVD’s ticket management, vulnerability tracking, and disclosure coordination systems compromised. Potential exposure of active vulnerability reports, researcher contacts, and disclosure timelines for unreleased security flaws. Systemic: DIVD is the coordination hub for Dutch responsible disclosure ecosystem. Breach may disrupt critical vulnerability reporting pipelines and leak sensitive zero-day information to attackers. Downstream risk: Any organizations or researchers who have submitted unpatched vulnerability reports to DIVD during the breach window may face coordinated attacks using disclosed information. Copycat indicator: Alert notes “copycat risk high” — expect immediate follow-on attacks against other organizations running vulnerable Zammad instances using the same exploit chain. RECOMMENDED ACTIONS Immediate (today): Audit all Zammad instances in your environment. If Zammad is deployed, isolate the service from external networks pending vendor patch release. Offline any ticket history if data sensitivity is high. Within 24 hours: Identify vendors/SaaS providers using Zammad backend; request patching status and timeline. Do NOT assume managed Zammad is protected — many SaaS instances lag patches by weeks. Alert partners: If you’ve submitted vulnerability reports to DIVD or any Zammad-backed disclosure system, contact your CSIRT and assume contents may be compromised; accelerate patching timelines for associated bugs. Monitor infrastructure: Log all Zammad session activity during breach window (exact dates TBD by DIVD). Watch for privilege escalation, process execution, and file exfiltration patterns. SOURCES hackread, securityweek, BleepingComputer, Help Net Security, OfficeOfInadequateSecurity — multiple independent reporting of DIVD breach and Zammad zero-day chain DIVD official investigation ongoing; additional technical details expected as post-incident analysis completes Status: DEVELOPING. Exact CVE IDs, vulnerability details, and full breach timeline pending DIVD advisory.
...
