Dutch Institute for Vulnerability Disclosure (DIVD) CSIRT (24 September 2026, “It was a matter of when, not if…”): after nearly seven years the volunteer vuln-disclosure nonprofit confirmed it was breached. Modus operandi “indicates that this is an agentic AI powered attack”; infrastructure access blocked; third-party IR engaged; Autoriteit Persoonsgegevens, NCSC-NL and police notified; treat as worst-case assume-breach until proven otherwise.

Updated 29 Sep 2026: BleepingComputer (29 Sep, 11:39 pm Perth), citing DIVD's Monday update, reports DIVD described the attack as “loud and very, very messy”; after initial exploit of an undisclosed technical vulnerability (explicitly not Citrix NetScaler), an automated AI agent performed post-exploitation, choosing next steps autonomously, leaving verbose decision comments, and interfering with its own adversary-in-the-middle / password-spraying path — researchers characterise the agent as poorly trained/configured, aiding reconstruction.

Purpose and full impact still unclear; DIVD intends a more detailed public update on 1 October and victim notification for the same vulnerability when ready.

Krebs (28 Sep): DIVD says incident does not appear related to ShinyHunters / prior volunteer Umbreon matter. Updated 1 Oct 2026: BleepingComputer (30 Sep, 15:49 US Eastern; 1 Oct, 3:49 am Perth) reports initial access was a chain of two Zammad helpdesk zero-days CVE-2026-102489 and CVE-2026-102490 (discovered with Merlon Security) enabling session hijacking, RCE, and escalation to root in seconds under AI automation, then lateral access/exfiltration; segmentation limited deeper movement.

DIVD recommending Zammad users upgrade to version 7 or take instances offline; alerting other vulnerable operators; further public detail still expected. Product patch path filed separately as zammad-102489-102490-20260930. Primary: DIVD CSIRT 24 Sep; wire: BleepingComputer (29 Sep and 1 Oct, Perth). (source: BleepingComputer)