JetBrains got hacked through its own unpatched build tool.
Not a startup with messy ops. The vendor that sells the tool left an unpatched server running, and attackers walked away with credentials from a backup.
Attackers used a recently disclosed critical flaw in TeamCity to break into Cadence, the cloud CI service JetBrains runs for developers.
The advice JetBrains gave its own customers is unusually blunt. Revoke and rotate every credential that may have touched your builds, because attackers reached a 2024 backup packed with credentials and user data.
Security firm watchTowr showed how a default Artifactory setup could let anyone mint admin tokens. Attackers were already exploiting it days after the fix shipped.
Remote management is under the same pressure. N-able shipped its fourth emergency hotfix in five weeks for its N central platform, and its incident notice says a related flaw was already exploited in the wild.
Separately, Huntress found rogue ScreenConnect clients spreading a script chain to every machine that connected to them, in at least three incidents with different entry points.
The software that builds, stores, and remotely manages your other software now touches every secret you own, and one stale version anywhere in that chain is enough to reach all of them.
The fix is older than the trend. Nothing inside your network should earn trust just for being inside it, least of all the machinery that moves your code, which is the discipline we laid out in our guide to zero trust architecture in practice.
Three habits separate the teams that shrug from the teams that would survive this week.
- Patch build and management servers on the day a fix lands. JetBrains fell inside its own house, Artifactory was hit days after its patch, and the N central fixes arrived weekly, so treat CI/CD servers and remote management consoles like your firewall. Enable automatic updates where the vendor offers them, and run a manual upgrade the same day where it does not.
- Assume a pipeline breach means every credential is exposed. The Cadence incident exposed a backup full of credentials and user data, and the Artifactory bug minted admin tokens, because build systems accumulate secrets like barnacles. Give every job scoped tokens that expire in minutes, pull secrets from a vault at runtime, keep long lived cloud keys out of build configuration, and prove your posture with the free cloud security competence check.
- Push remote management off the open internet and watch the agents. Rogue ScreenConnect clients spread to newly connected machines, and abused support tools outrank most defenses once they run. Lock admin consoles behind multifactor and allowlists, log every agent connection, and rehearse containment at machine speed using the 60 minute containment emergency guide as your script.
The old game defended the code and the inbox, because that is where the value sat.
The new game defends the pipe that carries the code, because that is where the keys sit.
Curious where your own pipeline stands? Take the free five minute CI/CD competence check and get a verifiable receipt instead of a guess.
Question for you: if a vendor told you to rotate every credential your CI/CD has ever touched, would your team finish this week or this quarter?
<small>Field reports: The Hacker News on the JetBrains Cadence breach, The Hacker News on the JFrog Artifactory campaign, The Hacker News on the N-able hotfixes, and The Hacker News on rogue ScreenConnect clients. Images courtesy of The Hacker News.</small>