One unpatched JetBrains server has turned into a point of entry immediately to cloud infrastructure, backups and developer secrets. The company has revealed the hacking of the Cadence service, which integrates with PyCharm and allows you to run projects on cloud computing resources. The attackers took advantage of the critical vulnerability of CVE-2026-63077 in TeamCity installed on the api.cadence.jetbrains.com server.
According to JetBrains, malicious activity continued from at least August 8 to August 24. During the presence in the infrastructure, attackers gained access to personal data of users, a full Cadence backup for 2024, AWS IAM accounts of the company's employees and Amazon S3 storage.
The scale of the potential leakage was much wider than the content of the server itself. Cadence worked as a link between the development environment and external services, so the system could pass the source code of projects, cloud credentials, GitHub, GitLab and Bitbucket tokens, access keys to npm, PyPI and Maven, secrets of container registers, SSH keys, signature keys and other sensitive data.
JetBrains admits that the compromised server was supposed to get a fix for CVE-2026-63077, but the update was never installed. As a result, the already known critical vulnerability has remained available for exploitation on the company's public service.
The incident shows well why developer infrastructure compromise often has a much larger lesion radius than hacking a conventional web server. CI/CD systems and cloud development environments store secrets that open access to several levels of infrastructure. One stolen token can lead to the Git-repository, the other will allow to publish packages, the third will give access to the cloud or container register.
The origin of a vulnerable product makes the origin of a vulnerable product particularly unpleasant. TeamCity develops JetBrains itself, but the company's own server is left without the necessary patch. As a result, the problem that JetBrains was supposed to protect TeamCity’s customers from led to a real hack of its own infrastructure.
The company investigates the consequences of the attack and assesses which user secrets could get to intruders. Project owners who have passed on Cadence tokens, keys, or other credentials will need to consider such secrets as potentially compromised and replace them, especially if they have given access to cloud resources, repositories, or package publishing systems.
According to JetBrains, malicious activity continued from at least August 8 to August 24. During the presence in the infrastructure, attackers gained access to personal data of users, a full Cadence backup for 2024, AWS IAM accounts of the company's employees and Amazon S3 storage.
The scale of the potential leakage was much wider than the content of the server itself. Cadence worked as a link between the development environment and external services, so the system could pass the source code of projects, cloud credentials, GitHub, GitLab and Bitbucket tokens, access keys to npm, PyPI and Maven, secrets of container registers, SSH keys, signature keys and other sensitive data.
JetBrains admits that the compromised server was supposed to get a fix for CVE-2026-63077, but the update was never installed. As a result, the already known critical vulnerability has remained available for exploitation on the company's public service.
The incident shows well why developer infrastructure compromise often has a much larger lesion radius than hacking a conventional web server. CI/CD systems and cloud development environments store secrets that open access to several levels of infrastructure. One stolen token can lead to the Git-repository, the other will allow to publish packages, the third will give access to the cloud or container register.
The origin of a vulnerable product makes the origin of a vulnerable product particularly unpleasant. TeamCity develops JetBrains itself, but the company's own server is left without the necessary patch. As a result, the problem that JetBrains was supposed to protect TeamCity’s customers from led to a real hack of its own infrastructure.
The company investigates the consequences of the attack and assesses which user secrets could get to intruders. Project owners who have passed on Cadence tokens, keys, or other credentials will need to consider such secrets as potentially compromised and replace them, especially if they have given access to cloud resources, repositories, or package publishing systems.
