TLDR Tech / News
DIVD Was Breached by the Very Threat Class It Exists to Coordinate Against
The Dutch Institute for Vulnerability Disclosure (DIVD) suffered a security breach on September 21, 2026, when an autonomous AI agent exploited two zero-day vulnerabilities in its internal Zammad ticketing platform. The agent chained CVE-2026-102489 and CVE-2026-102490 to gain full host control in seconds, leaving explanatory code comments after each automated step. The incident exposed volunteer contact data, though network segmentation limited further intrusion. CISA subsequently added both vulnerabilities to its Known Exploited Vulnerabilities catalog with a federal remediation deadline of October 16.
Read the full story