🚨AI Agents Hack Dutch Institute via Zero-Day Bugs
AI-powered hackers breach Dutch security group
TL;DR
AI agents exploited two zero-day bugs in DIVD's Zammad platform, gaining root access in seconds. The attack highlights the growing threat of AI-driven cyberattacks.
AI agents hacked the Dutch Institute for Vulnerability Disclosure (DIVD) via two zero-day bugs in its Zammad support platform, gaining root access in just seconds. This attack underscores the escalating threat of AI-driven cyberattacks, where automated tools can rapidly exploit vulnerabilities. The stolen data, including email addresses and contact details of volunteer security researchers, could be used for social engineering attacks. Zammad versions 6.3.0 to 6.5.4 and 7.0.0 through 7.1.3 are vulnerable to the bugs, with CVSS scores of 9.4 for both chained exploits. DIVD advises all users to upgrade to version 7 or take the system offline.
Key Points
AI agents exploited two zero-day bugs in DIVD's Zammad support platform, gaining root access in seconds.
Stolen data includes email addresses and contact details of volunteer security researchers, increasing risk of social engineering attacks.
CVE-2026-102489 enables unauthenticated attackers to achieve remote code execution and leak user sessions; CVSS score: 9.4.
CVE-2026-102490 allows a local user to elevate their privileges to root; CVSS score: 9.4.
DIVD advises all users of Zammad to upgrade to version 7 or take the system offline.
Why It Matters
If you're using Zammad for support, you're vulnerable to these zero-day bugs. The attack highlights the need for robust security measures against AI-driven threats. All Zammad versions are at risk, with specific versions needing immediate updates.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.