The Dutch Institute for Vulnerability Disclosure (DIVD) says it was hacked after attackers exploited an undisclosed technical vulnerability and then used an autonomous AI agent inside its network. DIVD says the flaw was not Citrix NetScaler, the agent chose follow-on steps on its own during post-exploitation, and the organization has notified Dutch police, the data protection authority, and the National Cyber Security Center while it investigates possible impact and other victims.
Why it matters: This matters because it is a real-world intrusion at a security organization where an attacker reportedly used AI to automate actions after getting in. Defenders should watch for DIVD’s promised follow-up on October 1, identify whether they run the same still-undisclosed vulnerable system, and be ready to patch or mitigate quickly once details emerge.
Bill Toulas
2026.09.30
98% relevant
This is a direct update to the same DIVD breach, adding the specific initial access vector and vulnerability details: the attack used a chain of two Zammad zero-days, now identified as CVE-2026-102489 and CVE-2026-102490, and DIVD advises users to upgrade to Zammad version 7 or take exposed instances offline.
Bill Toulas
2026.09.29
100% relevant
This article appears to be the first concrete report of the DIVD intrusion itself, establishing the underlying event: exploitation of an unknown vulnerability followed by AI-agent-driven post-exploitation in DIVD's environment.
← Back to all stories