The B3 read
The people who help organizations find security holes have disclosed how attackers got through their own front door. In a September 30 update, the Dutch Institute for Vulnerability Disclosure, or DIVD, identified two previously unknown flaws in Zammad, the software it used to manage support requests. DIVD says AI agents were involved in the intrusion. The new disclosure turns an unsettling account of AI-assisted hacking into a concrete warning about software running inside ordinary organizations.
The underlying breach began earlier. DIVD’s incident timeline records initial access on September 21, detection the next day, and isolation of its datacenter systems. The nonprofit brought in Merlon Security to help investigate. That chronology matters: the fresh development is the identification of the vulnerable product and attack chain, rather than a claim that the intrusion began overnight. DIVD’s investigation remains open.
The chain crosses two different security boundaries. CVE-2026-102489 can allow remote code execution under the Zammad service account. CVE-2026-102490 can let that lower-privileged account obtain root, the highest level of control on the host. The Dutch National Cyber Security Centre warns that both vulnerabilities are being actively exploited. This is more than exposure of a support inbox: the second step can turn an application compromise into control of the machine running it.
The AI element demands precision. DIVD attributes the activity to AI agents based on its investigation; the public material does not establish a named model, the operator’s identity or the exact division of work between human and software. An organization reporting agentic behavior is significant evidence. It does not establish that an AI independently discovered both flaws, chose its own target or operated without any human direction. Those claims would go beyond what has been shown.
The most consequential detail for defenders is the uneven remediation picture. NCSC’s September 30 advisory says an update addresses the remote-code-execution flaw while the privilege-escalation flaw remains unresolved. It urges administrators to preserve application and network logs before updating. DIVD advises affected users to upgrade to Zammad version 7 or take the service offline. Administrators should verify the applicable release and deployment guidance with their provider; a version change alone cannot establish that an exposed server is clean.
The wider lesson reaches beyond Zammad. A helpdesk can hold incident descriptions, customer details, attachments and clues about how an organization operates. Depending on its integrations, it may also sit close to identity systems, email and internal administration. B3 analysis: organizations should evaluate that reach as seriously as they evaluate the user-facing application. The practical questions are what the service account can access, where logs survive a host compromise, and how responders can cut access to connected systems.
For hospitals, manufacturers, financial firms and the service providers supporting them, the immediate issue is continuity and trust. Identify whether Zammad is present, preserve evidence, follow the official remediation guidance and investigate suspicious activity. Assess any sensitive information that may have been accessible rather than assuming a particular data-loss outcome. The AI headline makes this story arresting. The operational warning makes it urgent: a routine support tool can carry far more authority than its name suggests.
AI & Cybersecurity · September 30, 2026
The Hackers Got Hacked. Their Helpdesk Was the Way In.
The people who help organizations find security holes have disclosed how attackers got through their own front door. In a September 30 update, the Dutch Institute for Vulnerability Disclosure, or DIVD, identified two previously unknown flaws in Zammad, the software it used to manage support requests. DIVD says AI agents were involved in the intrusion. The new disclosure turns an unsettling account of AI-assisted hacking into a concrete warning about software running inside ordinary organizations.
The B3 read: The helpdesk belongs in the security boundary. Protect its service identity, limit its reach and preserve evidence beyond the server it runs on.
Buyer checklist: Questions to ask an MSP about access and response
Source: DIVD / Dutch NCSC
