When the build server gets breached: the JetBrains Cadence incident

What happened

JetBrains disclosed on August 31, 2026 that attackers had broken into Cadence, a cloud service connected to its PyCharm plugin. They used a critical flaw in TeamCity, JetBrains' build and deployment software, reported as CVE-2026-63077.

The detail that matters is that JetBrains had fixed the flaw in its products in July. The internal TeamCity server behind Cadence was the one that hadn't been updated.

The timeline, as reported: malicious activity began on August 8. JetBrains found it on August 23, took the server offline on August 24, and went public on August 31.

Exposed data included usernames, real names, email addresses, last-login times and recent IP addresses. A full 2024 backup of the Cadence server was also compromised. JetBrains said it had found no evidence of data or secrets being taken from the current environment, and that its investigation was continuing. TeamCity Cloud customers weren't affected.

So what for your business

This is a very ordinary failure. A vendor that builds the software and knows about the bug still left one of its own copies behind. Most companies have several internal tools like that: a build server someone set up years ago, a staging box, a dashboard nobody owns.

Build systems are especially sensitive. They hold the credentials to deploy your code and often to reach your cloud accounts. Whoever controls the build can change what you ship.

The two weeks between break-in and discovery is the other lesson. Fixing the patch gap helps. Noticing sooner helps more.

What to do this month

1. Inventory every internal system. Build servers, artifact stores, admin panels. If it has a login and nobody owns it, it needs an owner.
2. Patch CI on the same clock as production. Critical fixes within days, not the next maintenance window.
3. Rotate secrets after any suspicion. Keep build credentials short-lived and tightly scoped so a rotation is routine, not a crisis.
4. Check for the unexpected. In TeamCity, look for build agents nobody registered. Reporting on the incident flagged agents with names starting with "scan" as a sign to look for.
5. Keep old backups out of reach. A 2024 backup was part of the exposure. Delete what you don't need and encrypt what you keep.