DIVD says Zammad zero-days enabled AI-driven network breach

The Dutch Institute for Vulnerability Disclosure (DIVD) confirmed that its own network was breached through the exploitation of a chain of two zero-day vulnerabilities in Zammad, an open-source ticketing system. The attack leveraged AI-driven techniques to facilitate the breach. DIVD, known for responsible disclosure of vulnerabilities in third-party systems, found itself as the victim in this incident. The chaining of two zero-days in Zammad allowed attackers to gain unauthorized access to the DIVD network. The incident highlights the risk of vulnerabilities in open-source helpdesk and ticketing software used by security organizations. This breach is particularly notable given DIVD's role in the security community as a vulnerability disclosure body. The AI-driven element of the attack suggests an advanced threat actor was involved. No specific CVE identifiers were mentioned in the available content.