Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own environment. "Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions," JetBrains said.

Report facts: JetBrains disclosed that attackers exploited a critical, recently disclosed vulnerability in an unpatched TeamCity instance to breach the environment supporting Cadence and extract AWS credentials, prompting an urgent advisory for Cadence users to revoke and rotate all credentials and secrets used in executions. JetBrains is explicitly urging all Cadence customers to take immediate action to prevent further compromise. RealGround analysis: This incident highlights how vulnerabilities in upstream CI/CD infrastructure and third‑party platforms can cascade into AI workloads and pipelines, exposing cloud credentials and execution secrets used by AI services. Organizations using AI-related services should treat their CI/CD tools and SaaS integrations as part of their AI supply chain, applying strict patch management, credential hygiene, and SBOM-based dependency tracking to limit blast radius when a provider is breached.