The flaws were chained to hijack sessions, achieve remote code execution, and elevate privileges to root.
Zammad Zero-Days Exploited in AI-Powered DIVD Hack
About this summary. This is a short excerpt from the description that SecurityWeek published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.securityweek.com/zammad-zero-days-exploited-in-ai-powered-divd-hack/
Source attribution: headline and facts are from SecurityWeek (securityweek.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw
Critical flaws impact the Entity List and Field UI modules, and exploit paths exist with contributed modules.
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management…
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10…
AhsayCBS Deep-Dive: Auth Bypass to RCE
On 8 August 2026, Huntress released a report detailing the in-the-wild exploitation of AhsayCBS, an on-premises backup server application. The report described two…
CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit.
php2shell in Practice: Exploitable, Conditional, and Hard to Mass-Exploit
Cutting Through the php2shell Noise On October 20, details of php2shell, two pre-auth RCE vulnerabilities in the PHP core discovered by Calif (CVE-2026-109618 and…