{
  "is": "issue",
  "title": "Helpdesks taken offline as precautionary measure",
  "body": "\u003cp\u003eDue to \u003ca href=\"https://csirt.divd.nl/cases/DIVD-2026-00015/\"\u003evulnerabilities discovered\u003c/a\u003e in Zammad, the software at the foundation of Link, we have taken\nall helpdesks offline as a precautionary measure.\nWe have made this difficult decision as there have been reports of this vulnerability being exploited in the wild.\u003c/p\u003e\n\u003cp\u003eAt this time, we do not believe that sensitive data has been accessed inappropriately on the majority of helpdesks.\nWe are investigating signs of compromise on a small number of helpdesks.\nWhere your helpdesk has shown no sign of compromise, we believe there has been no data lost.\u003c/p\u003e\n\u003cp\u003eWe do not believe this is a targetted attack on any helpdesk and we have seen many other organisations observing the same patterns.\u003c/p\u003e\n\u003cp\u003eWe are working to upgrade all helpdesk instances to a newer version of Zammad that is not affected by this vulnerability.\nWe plan to reactivate most helpdesks within the next 48 hours.\u003c/p\u003e\n\u003cp\u003eWe will do this one-by-one and will be reaching out individually to you let you know when your helpdesk will be available.\nThis process has already started.\u003c/p\u003e\n\u003cp\u003eYour helpdesk may have a new URL when it is restored, which had been planned as part of the \u003ca href=\"https://www.sr2.uk/posts/2026-link-new-home/\"\u003emigration of helpdesks\u003c/a\u003e from the Centre for Digital Resilience (CDR) to SR2.\nAgents will need to be made aware of the new URL which we will share with you when the helpdesk is restored.\u003c/p\u003e\n\u003cp\u003eWe will provide updates as we work to resolve this issue.\nThe next update is scheduled for \u003cstrong\u003e2026-10-08 17:00 UTC\u003c/strong\u003e.\u003c/p\u003e\n",
  "createdAt": "2026-10-05 18:30:00 +0000 UTC",
  "lastMod": "2026-10-08 10:08:07 +0100 +0100",
  "permalink": "https://status.sr2.uk/issues/2026-10-05-zammad-vulnerability/",
  "severity": "down",
  "resolved": false,
  "informational": false,
  "resolvedAt": "<no value>",
  "affected": ["Link Helpdesks"],
  "filename": "2026-10-05-zammad-vulnerability.md"
}