[CVE-2026-63077]

September 7, 2026

• JetBrains is telling Cadence users to revoke and rotate every credential and secret and to treat all executions, inputs and outputs as untrusted, after attackers exploited CVE-2026-63077 (CVSS 9.8, deserialization to unauthenticated OS command execution) against a TeamCity server in JetBrains' own environment. The flaw has been in CISA's KEV catalog since 5 August; JetBrains discovered the intrusion on 23 August. The actor reached a 2024 Cadence backup and storage containing current-user data — usernames, real names, email addresses, last-login timestamps and last-accessed IPs, project source code and credentials — and defenders should hunt authentication activity using Cadence-stored credentials from 8 August onward (The Hacker News). · CI/CD & Identity

in The Diff Is the Disclosure: MikroTik's Silent Patch Comes Apart

August 8, 2026

• JetBrains TeamCity CVE-2026-63077 continues to be exploited (earlier coverage): Rapid7 published an analysis of the unauth RCE and CISA added it to the KEV catalog. @cyb3rops, CISA KEV · Vulnerabilities & Exploits

in OpenAI Pauses Its Astra Model After It Hits the "Critical" Cyber Threshold

August 7, 2026

• JetBrains TeamCity CVE-2026-63077 (CVSS 9.8) is under active exploitation — an unauthenticated deserialization RCE now in CISA's KEV. The Hacker News · Vulnerabilities & Exploits

in Meta Becomes the Fourth Lab to Admit Its AI Hacked a Stranger

July 30, 2026

• JetBrains TeamCity has a critical unauthenticated RCE (CVE-2026-63077), with a technical analysis from Rapid7. Rapid7 · Vulnerabilities & Exploits

in OpenAI's Rogue Agent Widens: Four More Companies Caught in the Blast Radius

July 29, 2026

• JetBrains TeamCity On-Premises got a critical unauth OS-command-execution fix (CVE-2026-63077, CVSS 9.8) across all versions — a high-value target given its position in build pipelines (The Hacker News). Separately, OpenWrt 24.10.8 closes a critical DHCPv6 stack overflow (CVE-2026-53921, CVSS 9.8) letting an unauthenticated attacker on the network run code as root through odhcpd (The Hacker News). · Vulnerabilities & Exploits

in Artifactory Zero-Days Confirmed as the Hugging Face AI Agent's Escape Route