--- title: DIVD gets popped by a rogue AI agent, Pentagon breach... description: DIVD, a vulnerability disclosure nonprofit, says an autonomous AI agent chained two Zammad zero-days to get root in seconds on its own network. Microsoft... canonical: https://daily.dev/posts/divd-gets-popped-by-a-rogue-ai-agent-pentagon-breach-grows-to-3-million-y5usd4qoc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: DIVD gets popped by a rogue AI agent, Pentagon breach grows to 3 million | daily.dev og:description: DIVD, a vulnerability disclosure nonprofit, says an autonomous AI agent chained two Zammad zero-days to get root in seconds on its own network. Microsoft... og:url: https://daily.dev/posts/divd-gets-popped-by-a-rogue-ai-agent-pentagon-breach-grows-to-3-million-y5usd4qoc og:image: https://api.daily.dev/og/posts/y5uSd4QOc.png og:image:alt: DIVD gets popped by a rogue AI agent, Pentagon breach grows to 3 million og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # DIVD gets popped by a rogue AI agent, Pentagon breach grows to 3 million **[Security Digest](https://daily.dev/sources/security_digest)** · 4 min read · 0 upvotes · 0 comments ## Summary DIVD, a vulnerability disclosure nonprofit, says an autonomous AI agent chained two Zammad zero-days to get root in seconds on its own network. Microsoft confirms attackers hit Zimbra's unauthenticated CVE-2026-73570 weeks before disclosure, and the Pentagon's personnel breach now stands at over 3 million records. Bishop Fox weaponized a critical Check Point management RCE that the vendor's own advisory doesn't fully describe, and Kevin Mandia's Armadin raised $255M more to build autonomous pentesting agents. Also today: a German teenager allegedly ran a 500-victim ransomware operation, and a $300M GPU-smuggling case lands criminal charges. ## Content **TLDR:** DIVD, a vulnerability disclosure nonprofit, says an autonomous AI agent chained two Zammad zero-days to get root in seconds on its own network. Microsoft confirms attackers hit Zimbra's unauthenticated CVE-2026-73570 weeks before disclosure, and the Pentagon's personnel breach now stands at over 3 million records. Bishop Fox weaponized a critical Check Point management RCE that the vendor's own advisory doesn't fully describe, and Kevin Mandia's Armadin raised $255M more to build autonomous pentesting agents. Also today: a German teenager allegedly ran a 500-victim ransomware operation, and a $300M GPU-smuggling case lands criminal charges. --- ## DIVD breached by what looks like an autonomous AI agent chaining Zammad zero-days The Dutch vulnerability-disclosure nonprofit says an intruder chained CVE-2026-102489 (unauthenticated RCE) and CVE-2026-102490 (local privilege escalation) in Zammad to go from session hijacking to root in seconds. DIVD thinks it was an AI agent because the logs show iterative automated decision-making and the attack scripts contain self-justifying comments nobody would bother writing by hand. The agent was reportedly sloppy and left a mess of evidence, which is a thin comfort given it still reached root. All Zammad versions are affected by the privilege escalation bug; DIVD recommends upgrading to version 7 or pulling vulnerable instances offline now. [Read more](https://daily.dev/posts/vbwMhial1) ## Zimbra command injection was exploited weeks before anyone disclosed it Microsoft Threat Intelligence says attackers were running OS commands via a crafted email against Zimbra's SNMP notification path (CVE-2026-73570) starting in late July, three weeks before Synacor's patch became public on August 13. Shadowserver still found 274 compromised instances among roughly 10,000 exposed servers. Post-compromise activity included JSP web shells, root privilege escalation, lateral movement over SSH trust between Zimbra servers, and attempts to exfiltrate mailbox backups to Azure via AzCopy. If you're running zimbra-snmp with notifications on and haven't patched past 10.1.20, assume you were in the blast radius. [Read more](https://daily.dev/posts/DzZEzYfpd) ## Pentagon breach notification hits over 3 million people The Defense Manpower Data Center is notifying more than 3 million people, about 2.8 million living and 294,000 deceased, that unencrypted Social Security numbers, birth dates, and military service details were stolen between October 2025 and mid-July 2026. The DoD hasn't named the vulnerable file-sharing system and says there's no indication the data was misused, without explaining how it reached that conclusion for a breach that ran nine months. This comes weeks after the FBI's ShinyHunters incident, and a dataset linking SSNs to military specialties is exactly the kind of thing a foreign intelligence service would want. [Read more](https://daily.dev/posts/QUNxIkAEq) ## Bishop Fox weaponizes Check Point's unauthenticated root RCE CVE-2026-93616, rated 9.8 and already exploited in the wild, combines a forged login that impersonates the Check Point management server's own TLS identity with an unbounded root file write, chained through /etc/cron.d for root execution with no credentials needed. Bishop Fox found the vendor's advisory and IoCs only cover the directory traversal and file upload pieces, missing the forged-login defect that actually makes the chain work without auth. Check Point's Take 45 hotfix covers all three bugs; Bishop Fox also released a safe external patch-state detection tool. [Read more](https://daily.dev/posts/FOY8qULzb) --- ## Also notable - **Armadin raises $255.5M more for autonomous pentest agents:** Kevin Mandia's new startup hit a $2.5B valuation just six months after its Series A, bringing total funding past $445M to build always-on agent swarms that chain vulnerabilities the way a human pentester would. [Read more](https://daily.dev/posts/nukUFrNpO) - **16-year-old allegedly ran KillSec ransomware operation:** Operation KillSwitch identified a 16-year-old Romanian national as the alleged administrator behind roughly 500 confirmed KillSec victims, including 70 government targets, out of 1,000 suspected attacks since 2024. [Read more](https://daily.dev/posts/aYzmrwGwm) - **$300M GPU-smuggling case lands criminal charges:** Prosecutors allege Earthmade Computer owner Greg Lui routed Nvidia H100 servers through Malaysia and Singapore to China using falsified end-user paperwork, with Earthmade receiving over $176M from shippers in 2024 alone and Lui facing up to 20 years on the top charges. [Read more](https://daily.dev/posts/AmL6jXbJr) - **Better Auth has a critical auth bypass:** A library with over 9.5 million weekly downloads has a disclosed authentication bypass, though the retweet alert doesn't include the technical details or a CVE. [Read more](https://daily.dev/posts/NzaWMiv4s) - **GitSpawn attack hijacks AI coding agents via git status:** A malicious .git/config reaching you through a zip or USB drive can trigger command execution the moment an AI agent runs a routine git status, with Manifold Security finding eight such flaws across seven agents including Claude Code, Codex, Cursor, and Grok. [Read more](https://daily.dev/posts/1JnsDhmeN) ## Similar posts on daily.dev - [Attacker gets into France's DB listing all bank accounts](https://daily.dev/posts/attacker-gets-into-france-s-db-listing-all-bank-accounts-w9x51rgws) · The Register · 1 upvotes · 0 comments - [Pwn2Own Berlin 2026: On the Ground with ZDI's Biggest AI Showdown Yet](https://daily.dev/posts/pwn2own-berlin-2026-on-the-ground-with-zdi-s-biggest-ai-showdown-yet-xfyxuypgz) · Trend Micro · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#data-breach](https://daily.dev/tags/data-breach), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/divd-gets-popped-by-a-rogue-ai-agent-pentagon-breach-grows-to-3-million-y5usd4qoc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/divd-gets-popped-by-a-rogue-ai-agent-pentagon-breach-grows-to-3-million-y5usd4qoc","headline":"DIVD gets popped by a rogue AI agent, Pentagon breach grows to 3 million","text":"DIVD, a vulnerability disclosure nonprofit, says an autonomous AI agent chained two Zammad zero-days to get root in seconds on its own network. Microsoft confirms attackers hit Zimbra's unauthenticated CVE-2026-73570 weeks before disclosure, and the Pentagon's personnel breach now stands at over 3 million records. Bishop Fox weaponized a critical Check Point management RCE that the vendor's own advisory doesn't fully describe, and Kevin Mandia's Armadin raised $255M more to build autonomous pentesting agents. Also today: a German teenager allegedly ran a 500-victim ransomware operation, and a $300M GPU-smuggling case lands criminal charges.","url":"https://daily.dev/posts/divd-gets-popped-by-a-rogue-ai-agent-pentagon-breach-grows-to-3-million-y5usd4qoc","datePublished":"2026-10-02T04:17:34.110Z","dateModified":"2026-10-02T04:17:56.955Z","author":{"@type":"Organization","name":"Security Digest","logo":"https://media.daily.dev/image/upload/s--m4ZKB_C0--/f_auto,q_auto/v1779959612/logos/security_digest","url":"https://daily.dev/sources/security_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/security_digest","name":"Security Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Digest","item":"https://daily.dev/sources/security_digest"},{"@type":"ListItem","position":3,"name":"DIVD gets popped by a rogue AI agent, Pentagon breach grows to 3 million"}]} ```