Critical Vulnerabilities in JetBrains IntelliJ IDEA and TeamCity Enable Remote Code Execution
JetBrains has released urgent security updates for IntelliJ IDEA and TeamCity to address several critical vulnerabilities that threaten remote development environments. The flaws could enable attackers to execute arbitrary code, modify build pipelines, and gain unauthorized access to files, making prompt patching essential for organizations using shared development setups.
In IntelliJ IDEA, the vulnerability tracked as CVE-2026-59792 stems from a directory traversal issue in the processing of workspace identifiers. This weakness may lead to remote code execution and received a maximum CVSS score of 9.8. The company has resolved the problem in versions 2026.1.4 and 2026.2.
TeamCity received multiple fixes addressing high-risk issues. CVE-2026-65907 allows code execution through specially crafted malicious Git repository configurations. Separately, CVE-2026-65906 permits attackers to escape the sandbox that protects Kotlin DSL scripts, potentially granting broader system access.
Additional vulnerabilities corrected in TeamCity include CVE-2026-59793, which enables arbitrary file access via the Perforce integration, and CVE-2026-59794, a persistent cross-site scripting flaw on the cloud profiles page. Both issues could be leveraged to compromise sensitive data or user sessions.
Administrators are strongly advised to apply the updates without delay. IntelliJ IDEA users should upgrade to the corrected releases, while TeamCity deployments should move to version 2026.1.2 or 2025.11.6 according to their current release line.
Related articles
CISA Adds Five Exploited Vulnerabilities to KEV Catalog Including AhsayCBS Authentication and Command Injection Flaws
The US Cybersecurity and Infrastructure Security Agency (CISA) has added five vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. Four vulnerabilities were registered on October 14, 2026, and one additional entry followed on October 15. Among the newly listed issues are two critical flaws affecting the AhsayCBS backup management server: CVE-2026-105133, an authentication bypass in the API, and CVE-2026-105134, a command injection vulnerability in the replication feature. When chained together, the pair allows unauthenticated remote attackers to execute arbitrary operating system commands. Vendor Ahsay has released hotfixes in versions 10.3.4.45 and 9.15.2.70 because standard patches cannot fully address the issues. The advisory also references vulnerabilities in Atlassian products and multiple network security solutions from other vendors.
Google Issues Chrome Security Update Fixing Critical Vulnerability Two Days After Previous Patch
Google has released a new set of security updates for its Chrome browser that address ten vulnerabilities, including one rated critical. The update arrives just two days after a larger patch that fixed 37 issues on October 13. The most severe flaw, tracked as CVE-2026-110922, is a use-after-free vulnerability in the Prerender feature that could allow remote code execution. The company released Chrome 155.0.8059.85 and 155.0.8059.84 for Windows and macOS, along with Chrome 155.0.8059.84 for Linux on October 15. The critical issue was reported by an external researcher on October 2. Deployment will occur gradually over the next several days to weeks.
543 Vulnerabilities in FFmpeg: Hunting Flaws in the Industry Standard
FFmpeg, the open-source library serving as the de facto standard for audio and video processing in mobile apps, carries approximately 543 registered CVEs that frequently appear in bug bounty programs. A Quokka report on over 150,000 applications found critical third-party CVEs in 11% of Android and 13% of iOS apps, with high-severity issues in 65% of Android applications. The article examines three notable vulnerabilities including PixelSmash (CVE-2026-8461), HTTP chunked overflow (CVE-2016-10190), and an AV1 RTP depacketizer flaw (DFVULN-127), each enabling remote code execution through memory corruption. It provides practical guidance on locating FFmpeg binaries inside APKs, identifying integration patterns, determining versions via strings and NDK timestamps, and extracting build configurations to confirm enabled components. Analysts are shown how to locate protocol handlers that serve as entry points without requiring malicious media files. The material targets reverse engineers experienced with ELF libraries and memory corruption issues.
Anthropic OSS Scanner Uncovers 29,439 Vulnerability Candidates in Open Source Projects, Delivering 6,157 Reports and 516 Fixes
Anthropic has published detailed metrics from its six-month coordinated vulnerability disclosure program that preceded the launch of its automated OSS Scanner service. The company’s models identified 29,439 potential vulnerabilities, of which external firms verified 6,123 candidates and confirmed 5,674 as genuine issues. From the 6,157 reports sent to maintainers across 591 projects, only 516 fixes have been merged so far, representing an 8.4 percent remediation rate among delivered reports. Anthropic emphasizes that 78 percent of reports were sent without independent human triage, and the new OSS Scanner now delivers fully model-generated findings directly to approved projects. Maintainers from PostgreSQL, curl, OpenSSL, wolfSSL and HotCRP have praised the quality of recent reports while noting that earlier AI-generated submissions were largely noise. The dashboard snapshot dated 2 October 2026 shows that 584 identifiers (219 CVE and 365 GHSA) have been issued, yet many confirmed issues remain in the triage queue due to limited human resources.