JetBrains Cadence incident: review credentials and connected systems
JetBrains confirmed a Cadence breach through a TeamCity vulnerability and urged affected users to rotate secrets and examine connected environments.
Confirmed incident, specific scope
JetBrains says attackers exploited CVE-2026-63077 in the TeamCity server supporting Cadence. Its stated affected period is August 8–24, 2026. The incident concerns the hosted Cadence service; it should not be presented as a compromise of every PyCharm installation.
What users should review
JetBrains advises affected users to revoke or rotate credentials available to Cadence executions, review connected systems and repositories, and treat execution inputs and outputs as untrusted. Its September 3 update distinguishes potential exposure of current storage from confirmed access to the 2024 backup.
AZTCOFW perspective
Developer services belong in the security asset inventory. A build or compute platform can hold credentials that reach far beyond the original host. Record which repositories, registries and cloud accounts each platform can access, and assign a responsible owner.
For an incident review, build a credential-to-system checklist so that rotation includes downstream dependencies. Preserve relevant logs, document the review period, and verify that replacement secrets reach legitimate workloads. An offline service does not by itself remove credentials already copied from it.
The linked vendor notice is the authority for affected-user guidance; the accompanying news report provides additional coverage.
