CVE-2026-102489

The Dutch Institute for Vulnerability Disclosure was breached through its own helpdesk on 21 September using two Zammad zero-days. Its evidence for an autonomous AI agent is behavioural: scripts carrying notes that justify the attack as it runs. Neither flaw has a fix, and the advice to upgrade works by making one of them unreachable rather than by closing it.

1 article — 2026-10-02

Authoritative record

Root Notes reports on this identifier; it does not maintain it. For the vendor advisory, the affected versions and the scoring, NVD and MITRE hold the primary records.

Our coverage

The attacker left comments explaining why what it was doing was fine, and that is how DIVD decided it was not a person

2026-10-02Security

../cve — every identifier we have covered