Last month, **JetBrains**, the developer behind popular IDEs like **PyCharm**, disclosed a significant security incident affecting its **Cadence** cloud computing service. Unidentified threat actors exploited a recently revealed critical vulnerability in **TeamCity** to gain unauthorized access to **JetBrains'** internal systems, prompting a widespread call for credential revocation among **Cadence** users. ### The Cadence Compromise **Cadence** is a **JetBrains**-hosted cloud service designed to integrate with **PyCharm**, enabling developers to offload machine learning and other intensive workloads to cloud GPUs directly from their IDE. The breach has led **JetBrains** to issue a strong recommendation: "**Cadence** users should immediately revoke or rotate all credentials and secrets that may have been used to run their **Cadence** executions." Users are also advised to treat all executions, including their inputs and outputs, as potentially untrusted. ### Exploitation of CVE-2026-63077 The attack vector was the exploitation of **CVE-2026-63077**, a deserialization of untrusted data vulnerability in **TeamCity** with a CVSS score of 9.8. This flaw allows an unauthenticated attacker with access to a **TeamCity** server to bypass authentication and execute arbitrary operating system commands with the privileges of the **TeamCity** server process. The vulnerability has since seen active exploitation in the wild, leading the **U.S. Cybersecurity and Infrastructure Security Agency (CISA)** to add it to its Known Exploited Vulnerabilities (**KEV**) catalog on August 5, 2026. **JetBrains** confirmed discovering the exploitation within its own environment on August 23, 2026. ### Data Exposure and Impact **JetBrains** revealed that the threat actors accessed data from a **Cadence** server backup dating back to 2024. Furthermore, unauthorized access may have extended to storage containing data associated with current **Cadence** users. The confirmed compromised information includes: * Personal data: usernames, real names, email addresses, last-login timestamps, and last accessed IP addresses. * A full backup of the **Cadence** server from 2024, containing credentials, configuration, artifacts, and logs. * Multiple **AWS IAM** users and associated credentials/secrets used with **Cadence**, including those belonging to **JetBrains** employees. * Files stored in **S3** buckets within **JetBrains AWS** accounts utilized by **Cadence**. **JetBrains** also cautioned that source code synchronized from **PyCharm** projects to the affected server might have been accessed. This implies that any code, credentials, or configurations uploaded or synchronized via **PyCharm** for **Cadence** execution could be compromised. ### Attack Timeline and Indicators of Compromise The intrusion reportedly occurred between August 8 and August 24, 2026. The exploited **Cadence** server, `api.cadence.jetbrains.com`, has since been taken offline. **JetBrains** acknowledged that the server should have been patched as part of its vulnerability response but did not elaborate on why this failed to happen. All access tokens used by the **JetBrains Cadence** plugin in **PyCharm** to connect to **Cadence** have been invalidated. **JetBrains** has also provided the following Indicators of Compromise (**IoCs**): * Activity from August 8, 2026, onwards, especially authentication or activity using credentials previously stored in or accessible through **Cadence**. * IP addresses associated with observed exploitation activity: * `150.109.230.104` * `43.153.227.206` * `62.210.127.48` * `210.247.242.190` * `15.235.225.205` * `152.233.30.18` * Authentication or other activity from unexpected IP addresses or locations. * Unexpected repository clones or downloads, and unexpected commits to repositories. * Changes to repository secrets, webhooks, collaborators, or permissions. * New or modified personal access tokens, API tokens, or SSH keys in external services. * New service accounts created in external services. * Unexpected changes to cloud **IAM** roles, policies, or permissions. * Unexpected access to cloud storage, including **S3** buckets and objects, in services such as **AWS** and **Google Cloud**. * Unexpected publication or modification of packages or releases. ### Recommended Actions Beyond rotating all credentials, users are urged to: * Review connected systems for suspicious activity, particularly **AWS** accounts, **S3** buckets, deployment environments, package/container registries, and other systems accessible using the revoked credentials. * Audit source code repositories for any unauthorized changes during the specified time period. * Treat all **Cadence** executions as potentially untrusted. **JetBrains** warns that the personal data exposure increases the risk of targeted phishing, social engineering, impersonation, and other malicious communications using the affected names and email addresses.