Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

JetBrains disclosed that unidentified actors exploited a critical TeamCity deserialization vulnerability (CVE-2026-63077, CVSS 9.8) to breach a Cadence server between August 8–24, 2026, and accessed a 2024 backup containing credentials, AWS IAM users/secrets, S3 files, email addresses, and potentially synchronized PyCharm project source code; users are advised to revoke/rotate all credentials, audit connected systems (AWS, S3, repos, registries), and treat executions and stored data as potentially compromised while JetBrains invalidated Cadence plugin tokens and took the affected server offline.