AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit

T2Covered by 1 source · first reported by Help Net Security at 01 Oct, 13:13 UTC

An agentic AI-powered attack that hit the Dutch Institute for Vulnerability Disclosure (DIVD) on September 21 exploited two zero-day vulnerabilities in Zammad, an open-source helpdesk and customer support ticketing system. “Used together, [the two flaws] allowed the attackers to hijack sessions…