DIVD Breach: Zammad Zero-Days Chained to Root

An attacker breached the Dutch Institute for Vulnerability Disclosure on 21 September 2026 by chaining two previously unknown Zammad vulnerabilities. DIVD says the attack showed agentic AI behaviour a