organization · DiggingBeagle record
Dutch Institute for Vulnerability Disclosure (DIVD)
Dutch coordinated-vulnerability-disclosure foundation whose own September 2026 breach involved two Zammad vulnerabilities and an ARTEX-based agentic intrusion.
- Entity kind
- organization
Record description
The Dutch Institute for Vulnerability Disclosure (DIVD) coordinates vulnerability disclosure and operates security research and response activities. DIVD itself became the victim of a September 21, 2026 intrusion through two Zammad issues and maintained a dated first-party incident record. Its response material distinguishes the date of entry, later disclosure and the October 31 identification of ARTEX as the offensive agent framework observed on the affected systems.
The victim reports more than 450,000 requests, over 2,500 scripts, a path to root in twelve minutes and partial exfiltration of information connected with its helpdesk and volunteers. These are observed effects, not evidence that every automated request succeeded. The two Zammad vulnerabilities and fixed versions have different prerequisites and should remain separately traceable. DIVD explicitly cautions against equating ARTEX usage in other campaigns with the same actor. The incident Case captures the attack and data-access uncertainty; the ARTEX entity is the cross-campaign software identity. DIVD's status as the affected responder makes its logging unusually valuable but does not settle undisclosed model identity or complete operator autonomy.