DIVD Breach Exploited Zero-Day Flaws in Zammad Ticketing System via AI-Driven Attack The Dutch Institute for Vulnerability Disclosure (DIVD) revealed that its network was breached through a pair of zero-day vulnerabilities in the open-source Zammad ticketing system, exploited by an autonomous AI agent. The attack, described as "loud and very, very messy," was executed without human intervention, with the AI agent leaving behind detailed logs of its decision-making process. The flaws CVE-2026-102489 and CVE-2026-102490 enabled session hijacking, remote code execution, and root privilege escalation, allowing the attacker to access additional services and exfiltrate data within seconds. DIVD’s network segmentation and incident response measures prevented deeper infiltration, though the investigation remains ongoing. Zammad, an AI-powered helpdesk platform used by over 2,000 organizations, including De’Longhi, Amnesty International, and NextCloud, was patched in version 7 following DIVD’s disclosure. The vulnerabilities were discovered in collaboration with Merlon Security, and DIVD has urged users to update or take vulnerable instances offline. Further details on the incident are expected in an upcoming update.