JetBrains Says Attackers Broke Into Its Cadence Cloud Through an Unpatched TeamCity Server

Key points

• JetBrains disclosed that attackers broke into its Cadence cloud build service last month by exploiting an unpatched critical flaw in TeamCity, its own product.
• The company is telling every Cadence customer to revoke and rotate all credentials and secrets that may have been used inside their build jobs.
• The attackers are unidentified and JetBrains has not named a ransom demand or extortion component to the incident.
• Cadence runs customer software builds in the cloud, so leaked secrets could include cloud keys and signing certificates.
• Users who ignore the rotation notice risk follow-on intrusions into their own cloud accounts and code repositories.

JetBrains, the Czech-Dutch software maker best known for developer tools like IntelliJ IDEA and the TeamCity build server, has told customers of its Cadence cloud service to treat every secret they ever handed the platform as burned.

Attackers got inside Cadence last month by exploiting a recently disclosed critical vulnerability in TeamCity, the very product JetBrains sells to help other companies automate their software builds. The breach was first reported by The Hacker News.

What is Cadence and why does this matter?

Cadence is JetBrains' hosted build service, meaning customers point it at their source code and it compiles and packages the software for them in the cloud. To do that job, Cadence has to hold sensitive keys belonging to its customers: cloud login tokens, code-signing certificates, deployment passwords.

If attackers rummaged through the environment running those jobs, they may have grabbed any of those secrets. That's why JetBrains isn't asking customers to change one password. It's asking them to change all of them.

"Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions," the company said in its notice.

How did the attackers get in?

The attackers exploited an unpatched TeamCity server inside JetBrains' own network. CVE-2026-63077, which we reported on 28 July carries a 9.8 severity score and lets an unauthenticated intruder take control of the server; by 6 August, attackers were already exploiting it in the wild. JetBrains hasn't confirmed whether that CVE was the entry point in its own breach, nor named the group responsible.

The irony isn't subtle. A company that ships build software to the world was breached through its own build software, left unpatched on its own infrastructure.

What should customers do right now?

Rotate every credential Cadence ever touched, and do it today. That includes cloud provider keys, container registry logins, signing keys and any environment variables holding passwords.

After rotating, audit recent activity in the accounts those credentials protected. Look for logins from unfamiliar locations, new service accounts or unexpected API calls. If a leaked key was used to exfiltrate data, the evidence sits in cloud audit logs.

Should you worry if you don't use Cadence?

Not directly, but the risk is real if a company you buy software from used Cadence and didn't rotate its signing keys. A criminal could, in theory, sign malicious updates that look genuine to your device.

For most readers the practical step is straightforward: keep automatic updates on. If a vendor issues a fix or revokes a compromised certificate, your device picks it up without you having to think about it. Supply-chain intrusions like this one, following hard on the Coder/Cloudflare poisoning we covered on 3 September, are a reminder that the weakest link in your software stack is often a tool you've never heard of.