An AI-driven intruder chained two Zammad zero-days to climb from a helpdesk account to root in seconds.