Project
TeamCity is a JetBrains continuous integration and delivery (CI/CD) server used to automate building, testing, and deploying software.
CISA said Sept. 23 that ransomware crews are exploiting CVE-2026-63077, an unauthenticated 9.8 RCE in JetBrains TeamCity patched July 25. Any build server patched late has to be handled as breached, including the credentials and signing keys it held.
Reality
The September 3 note closed the investigation without adding a single affected user, but it put project source code and credentials in current Cadence storage inside a blast radius that had been limited to a 2024 backup.
Reality
CVE-2026-63077 was in CISA's KEV catalog on August 5. JetBrains dates the intrusion into its own Cadence environment from August 8 to August 24, and every secret that touched the service now needs rotating.
Reality
The reductions run deepest on the largest machines. That redoes the arithmetic that sent heavy jobs to hardware you own. The per-minute charge GitHub proposed for self-hosted runners still has no new date.
Reality
Build configurations can now authenticate to AWS and Google Cloud without stored keys, provided you accept that the TeamCity server holds the signing key and that rotating it leaves already-issued tokens valid.
Reality
JetBrains says CVE-2026-63077 lets an unauthenticated attacker run arbitrary commands on a TeamCity server. The rotation list it handed Cadence users doubles as the recovery scope for anyone self-hosting.
Reality
Wiz says a TeamCity honeypot exposing JDWP was mining Monero within hours, and GreyNoise counted more than 6,000 unique IPs scanning for the protocol in 90 days.
Reality