JetBrains confirms its Cadence cloud service was breached through a TeamCity vulnerability it had itself disclosed. CVE-2026-63077 is critical: unauthenticated attackers could run commands on it. Cadence stayed unpatched, and attackers were inside from 8 to 24 August.
Their own sentence: "The server should have been patched as part of our response to the vulnerability, but it was not."
The exposure is what build infrastructure concentrates: a full 2024 server backup, multiple AWS IAM credentials, potentially source code synced from developers' machines. Everything in reach now needs rotating.
Two lessons travel. CI/CD is crown jewels, not plumbing. The patch that counts is the one verified applied, on your estate as much as a supplier's.
https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026/
#SupplyChainSecurity #InfoSec #CyberSecurity