DIVD Breach: Zammad Zero-Days Chained to Root

An attacker breached the Dutch Institute for Vulnerability Disclosure on 21 September 2026 by chaining two Zammad vulnerabilities that had not been publicly disclosed. DIVD says the attack showed agen