Loading today’s stories
Security1 publisher2 min readPublished
The September 3 note closed the investigation without adding a single affected user, but it put project source code and credentials in current Cadence storage inside a blast radius that had been limited to a 2024 backup.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
TeamCity is why this gets expensive. Cadence used TeamCity to orchestrate its cloud runs [2], so a bug that hands an unauthenticated attacker arbitrary commands on a TeamCity server [3] landed on the machine holding whatever credentials each execution needed. The remediation list reflects that: AWS accounts, S3 buckets, deployment environments, package and container registries [9].
The instruction to customers has not moved since August 28, when JetBrains told Cadence users to revoke and rotate every credential and secret that may have been used to run executions, and to treat all executions and their inputs and outputs as untrusted [8]. The August 31, September 1 and September 3 updates each left those actions unchanged [15]. Anyone who rotated on August 28 has already done the work.
What moved is the scope JetBrains believes the actor could read. On August 31 the company said the actor had accessed a 2024 Cadence server backup, and that there was no evidence of extraction of data, secrets included, from the current environment [5]. On September 3 it said the actor obtained access that could have allowed reaching storage holding current users' email addresses, project source code and credentials, and that it is treating that data as potentially exposed [7]. The wording stops at access that could have allowed reach. JetBrains does not assert that data left current storage, does not name the actor, and gives no user count [18]. It does say the September 3 findings identified no affected users beyond those already contacted directly [12].
The review window is the part customers pay for. JetBrains dates indicator activity from August 8, 2026 [11], confirmed exploitation on August 28 [4], and closed the investigation on September 3 [6]. That is 20 days between the first indicator date and public confirmation [13], and 26 days of authentication history to walk against every credential that sat in Cadence [14]. The published indicator set is two IP addresses, 150.109.230.104 and 43.153.227.20, and JetBrains says the absence of its indicators does not confirm an account was unaffected [11].
Two limits on scoping any of this from the vendor. The inventory of credentials and secrets JetBrains will supply on request is explicitly not exhaustive [10]. And the secrets most likely to survive a rotation pass are the ones written into project files that PyCharm synchronized to Cadence, which JetBrains asks users to find and rotate themselves, alongside reviewing repositories for unauthorized changes during the affected period [9]. A team that rotates its Cadence execution secrets and skips that second pass has rotated only the credentials it already knew about.
Ranked by verification strength, evidence, and original report placement.
In an update dated August 28, 2026, 11:50 CEST, JetBrains confirmed the Cadence environment was vulnerable to CVE-2026-63077 and was exploited through that vulnerability.
In an update dated August 31, 2026, 12:56 CEST, JetBrains confirmed the threat actor accessed data contained in the Cadence server backup from 2024, and said there was no evidence at that time that the actor extracted data, including secrets, from the current Cadence environment.
Cadence is a JetBrains-hosted service that integrates with PyCharm through an optional plugin and lets users run their projects on cloud compute resources.
Cadence uses JetBrains TeamCity to orchestrate its cloud compute work.
CVE-2026-63077, recently disclosed by JetBrains, is a critical TeamCity vulnerability that can allow an unauthenticated attacker to execute arbitrary commands on a vulnerable server.
In an update dated September 3, 2026, 19:00 CEST, JetBrains said its investigation had concluded.
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
A single first-party account that is unusually specific
JetBrains gives the things advisories often withhold: a named CVE, the exploited host, six exploitation IPs, a bounded affected period, and every update timestamped to the minute. What it does not give is anyone else's look at the same forensics, and the September 3 finding that carries the most weight is phrased as access that could have allowed the actor to reach current-user storage, not as retrieval anyone observed.
A confirmed incident with an undisclosed scale
The events are real and dated: exploitation found August 23, the server pulled August 24, affected users contacted directly, storage of current users reclassified as potentially exposed on September 3. What is absent is any measure of reach. JetBrains publishes no user, account or record count, and no downstream compromise in an AWS account, registry or repository has been reported by anyone using the credentials described here.
Scope widened while the tone stayed the same
The September 3 note moves project source code and credentials in live storage into the blast radius, then closes the investigation and repeats that recommended actions are unchanged. An enlargement of scope is delivered in the register of a wrap-up. Read on its own terms, the disclosure asks less of the reader than its content warrants.
Vendor of the flaw is the sole narrator
JetBrains sells TeamCity, which carried CVE-2026-63077, and hosted Cadence, which was exploited through it. The same company sets the timeline, defines the indicators, decides the affected group is final and declares the matter closed. Disclosure duty pushes toward publishing detail; the commercial position pushes toward conditional verbs and no numbers, and both pressures are visible in the text.
Dates are firm but the boundary is soft
Chronology and remediation steps are about as reliable as a primary source gets, and JetBrains twice undercuts its own outer edges by saying the indicator list is not exhaustive and the credential inventory may be incomplete. That is why confidence in the individual facts sits well above confidence in where this incident actually ends.
security
Unpatched TeamCity server gave attackers AWS IAM credentials from JetBrains' Cadence backup1 publisher
build
TeamCity's new OIDC plugin turns your build server into the credential issuer1 publisher
science
Unit 42 timed an agentic intrusion at fifty ATT&CK techniques in under ten hours2 publishers
build
Attackers exploited JetBrains' own TeamCity bug to operate inside Cadence for 16 days2 publishers
Publishers with included, body-backed reporting in this cluster.
1 article · September 7, 2026