JetBrains got hit through a TeamCity flaw it had published a patch for a month earlier.

Attackers exploited CVE-2026-63077, the critical unauthenticated RCE in TeamCity On-Premises that JetBrains itself disclosed July 27, against an unpatched JetBrains-run server, reaching the Cadence cloud coding service. Because the PyCharm plugin syncs project files to Cadence before running them, customer source code, config files and embedded secrets may be exposed, along with usernames, real names, emails, last-login timestamps and last-accessed IPs. JetBrains is telling Cadence users to treat all prior executions and outputs as untrusted and rotate credentials across AWS, Azure, GCP, GitHub, GitLab, Bitbucket, npm, Maven, NuGet, PyPI, Docker Hub, ECR, GCR and ACR. (JetBrains) The uncomfortable part is the shape: cloud coding services need your source to run it, so a breach of the runner is a breach of everything it ran.