Live
Scaling AI Agent Swarms: Architecture and Ops Implications for EngineersAnonymous authentication for organization‑level Dependabot registries: practical impactCloudflare Queues add immutable jurisdiction controls for data residencyOpen AI Factory Architecture: NVIDIA’s MGX 1.2 Rack Design and New DSX Tooling Arrive at OCPAgents SDK adds web_fetch tool for on‑the‑fly markdown conversionConfigurable Telemetry Identity Capture for GitHub Copilot Enhances AuditingDeploying Agentic AI at Scale in France: New NVIDIA Hardware, Open Models, and Sovereign FrameworksGuardDuty Extended Threat Detection adds five indicator types – practical impact for engineersScaling AI Agent Swarms: Architecture and Ops Implications for EngineersAnonymous authentication for organization‑level Dependabot registries: practical impactCloudflare Queues add immutable jurisdiction controls for data residencyOpen AI Factory Architecture: NVIDIA’s MGX 1.2 Rack Design and New DSX Tooling Arrive at OCPAgents SDK adds web_fetch tool for on‑the‑fly markdown conversionConfigurable Telemetry Identity Capture for GitHub Copilot Enhances AuditingDeploying Agentic AI at Scale in France: New NVIDIA Hardware, Open Models, and Sovereign FrameworksGuardDuty Extended Threat Detection adds five indicator types – practical impact for engineers
AWS

TeamCity server breach forces credential rotation and trust reassessment in CI/CD pipelines

Ninja·August 29, 2026·2 min read·via The New Stack
AI SummaryPowered by AI

JetBrains disclosed that its own TeamCity server, which powers the Cadence CI/CD service, remained unpatched for CVE‑2026‑63077 and was compromised from August 8 to August 24, exposing backups, IAM credentials, and source code. Practitioners must rotate all affected secrets, treat prior Cadence builds as untrusted, and audit cloud and source‑control logs for lateral movement.

JetBrains announced that the TeamCity instance behind its Cadence cloud development service was never patched for the critical CVE‑2026‑63077 flaw, allowing unauthenticated attackers to run OS commands and compromising the service from 8 August to 24 August.

TeamCity server breach

The vulnerability permits any HTTP/HTTPS client to execute commands with the same privileges as the TeamCity process. JetBrains disclosed the CVE on 27 July and warned that attackers were already exploiting unpatched servers by 7 August. The company’s own server, which orchestrates Cadence workloads, was missed during the remediation effort and remained exposed. Attackers accessed api.cadence.jetbrains.com, extracted a 2024 backup, and harvested AWS IAM users, S3 objects, and a range of development‑related secrets.

Why it matters to CI/CD and cloud engineers

Cadence sits at the intersection of source control, cloud compute, and artifact publishing. A compromised orchestrator can leak credentials for AWS, Azure, GCP, GitHub, GitLab, Bitbucket, npm, Maven, NuGet, PyPI, Docker Hub, ECR, GCR, and ACR. Those secrets enable lateral movement into customer accounts, unauthorized package publication, and potential supply‑chain attacks. Moreover, any build artefacts produced during the breach window may have been altered, breaking the trust model that CI/CD pipelines rely on.

Architectural and operational implications

Practitioners should treat the Cadence service as a single point of failure for secret handling. The incident highlights the need for:

  • Immediate rotation of all cloud‑provider keys, service‑account tokens, and repository access tokens that were ever used in Cadence executions.
  • Segregation of privileged credentials from build agents, preferably using short‑lived, scoped tokens.
  • Regular verification that backup data containing secrets is stored encrypted and isolated from production workloads.
  • Comprehensive audit of source‑control logs for unexpected clones, commits, or webhook changes, and cloud‑provider logs for new IAM users, role modifications, and anomalous S3 access.
  • Validation of artefacts generated during the affected period against known good hashes or reproducible builds.

Because Cadence integrates via an optional PyCharm plugin, developers may have unintentionally uploaded project files containing embedded credentials. Teams must therefore review project‑level configuration files for accidental secret leakage.

Related CloudNinjas coverage: DevOps.

What This Means For Practitioners

Actionable steps include:

  1. Revoke and re‑issue every AWS, Azure, and GCP credential that appeared in Cadence logs or backups.
  2. Rotate tokens for all supported source‑code hosts and package registries.
  3. Mark all Cadence builds from 8 August to 24 August as untrusted; rebuild critical artefacts from clean sources.
  4. Run a focused audit of IAM changes, S3 bucket access patterns, and source‑control activity for the same window.
  5. Implement automated secret‑scanning and short‑lived credential issuance for future CI/CD jobs to reduce blast radius.

Until the full scope is known, assume that any downstream system that accepted Cadence‑issued credentials may have been accessed. Continuous monitoring and rapid credential turnover are essential to limit exposure.

Tags: #ci-cd#cloud#security#credentials
Originally published atThe New Stack
Related Articles
GitHub

Anonymous authentication for organization‑level Dependabot registries: practical impact

3 min read

AI‑Assisted Development Doubles Spotify Change Rate, Triggering New Quality Controls

2 min read
GCP

Second‑Edition SRE Practices: Dynamic SLOs, OpenTelemetry Observability, and Platform Automation for Modern Workloads

3 min read