Dutch Institute for Vulnerability Disclosure

Um, so there's a lot of interesting stuff going on on this side, and I think we're gonna have to monitor and continue to monitor this space of, you know, agent sandbox escape, what's it doing, et cetera, et cetera, as we go over time.

All right, on the, uh, theme of AI agents moving into networks, the Dutch Institute for Vulnerability Disclosure, or DIVD, uh, does now say that the breach of its network was the chaining of two zero-day vulnerabilities in the open source Zammad ticketing system, which they're using on that platform, and that it was loud and, quote, "loud and very, very messy," end quote, and it was driven by an AI agent that moved autonomously and decided its next steps through navigating the DIVD network on its own.

And they are reporting this based on log data from their side, and so they've seen, uh, actually clear explanations of the decisions allowing them to reconstruct the incident, and some of those decisions are left in plain text, and so that's kind of interesting.

It started with a hijack session, moved to m-remote code execution, uh, and then moved to root access in a matter of seconds.

According to the register, he was convicted in 2023 for hacking and extortion, and was on supervised release.

He was also working as a software engineer at an offensive security startup well known, and volunteering with the Dutch Institute for Vulnerability Disclosure.

So allegedly, someone helping an extortion crew was also sitting inside the cybersecurity community, quite literally on the defender's side of the fence.

Allegedly, and he hasn't been convicted of anything connected to this case, but the structural point holds whatever a court decides.

An intruder gained full control of a helpdesk server within seconds after an AI agent chained two previously unknown Zomid weaknesses.

The September 21st attack hijacked a session, executed code as the Zamed service account, and then escalated to root at the Dutch Institute for Vulnerability Disclosure.

The intrusion was detected the next day, and access to systems in the data center was blocked.

Volunteer email addresses were confirmed stolen.

A successful exploit grants attackers admin level access to the device's API management component.

Hackers exploited two zero days in the Zammad help desk and issue tracking platform to breach Dutch cybersecurity nonprofit DIVD.

The vulnerabilities allow attackers to hijack sessions, elevate privileges, and run remote code on Zammad servers.

DIVD has reported the issues to the vendor, who's now working on patches.

DIVD disclosed the hack over the weekend and said it suspects the attacker used AI tooling due to the speed at which the attack took place.

And finally, internet infrastructure company Cloudflare is launching a certificate authority.

The new CA will provide free certificates with automated issuance and renewal like Let's Encrypt.

It's a patch-heavy day, with active exploitation hitting enterprise network gear and an unusual breach at the very group that hunts software bugs for a living.

The Dutch Institute for Vulnerability Disclosure, a non-profit of volunteer researchers, says it was breached through two previously unknown flaws in its Xamod helpdesk software.

The group reports that an automated AI agent chained the two bugs to gain root access within seconds, steal data and start pivoting to other systems before it was stopped, a rare case of the bug hunters getting hunted.

Several security firms confirmed that attackers have spent weeks exploiting two nil-day floors in Citrix Netscaler devices, with government and financial organisations among the targets.

And he apparently admitted as much in a 2023 trial.

By day, he was a software engineer at the time at Amsterdam cybersecurity startup Hadrian and a volunteer at the Dutch Institute for Vulnerability Disclosure.

By night, he was Umbreon, extorting victims and posting their data on criminal forums.

He was convicted of data thefts and extortions that prosecutors said earned him between 1.5 and 2.7 million euros.