Critical Vulnerability in JetBrains TeamCity Allows Unauthenticated Remote Code Execution
JetBrains has addressed a critical vulnerability in its TeamCity CI/CD server that enables unauthenticated remote code execution on affected on-premises installations.
The flaw, identified as CVE-2026-63077, resides in the product’s agent polling protocol. Attackers who can reach the TeamCity Server over HTTP or HTTPS can bypass authentication checks and execute arbitrary operating-system commands.
Depending on the privileges assigned to the server process, successful exploitation may result in leakage of stored data, configuration files, and credentials. Attackers could also alter server state or undermine the integrity of build artifacts and downstream CI/CD pipelines.
The vulnerability received a CVSSv3.1 base score of 9.8 and was rated Critical, the highest severity level. At the time the advisory was published, no exploitation attempts had been observed in the wild.
JetBrains released patched versions TeamCity 2026.1.3 and TeamCity 2025.11.7. A patch plugin is also available for all supported releases from TeamCity 2017.1 onward. Organizations unable to apply updates immediately are advised to restrict external network access to the server as a temporary mitigation.
Related articles
WireGuard Kernel Module Silently Overwrites AllowedIPs in Trie, Breaking Peer Routing Without Errors
The WireGuard kernel module stores AllowedIPs in a single prefix trie per device rather than per peer, causing exact-match insertions of identical CIDR prefixes to reassign nodes and remove them from the previous peer's list. This behavior silently drops routing for affected peers while handshakes and inbound traffic continue, leading to one-way connectivity failures and frame errors. The issue affects road-warrior setups using 0.0.0.0/0, mesh networks, Kubernetes CNI plugins such as Cilium and Calico, and network operating systems including VyOS and OPNsense. No warning is emitted by wg, wg-quick, or the kernel on overwrite, and the longest-prefix-match lookup ensures only equal-length prefixes collide. The root cause resides in allowedips.c where rcu_assign_pointer redirects the trie node and list_move_tail detaches it from the original peer. The same logic appears across Linux, wireguard-go, wireguard-nt, FreeBSD, and OpenBSD implementations.
RCQ Messenger Duress PIN Flaw Gave Full Access to Real Database on Android
RCQ developers discovered that their duress PIN feature on Android used the same dataKey for both real and decoy accounts, allowing anyone entering the panic code to unlock the entire message history. The original design aimed to present a believable second account but resulted in the decoy PIN acting as a master key rather than a protective boundary. On iOS the implementation was cryptographically separate yet suffered from contact wiping that made the decoy mode look suspiciously empty. After review the team switched both platforms to independent random keys, generated realistic conversation histories, and disabled network features in decoy mode to avoid server-side linkage. Legacy slots created before the fix remain marked as such and require users to set a new decoy PIN. The post-mortem also covers desktop Argon2id vault encryption, notification leakage risks, and why short PINs remain vulnerable to offline brute-force even with strong KDF parameters.
Multiple Critical Vulnerabilities Patched in IBM Db2 Mirror for i
IBM has disclosed 18 vulnerabilities affecting the graphical user interface of its Db2 Mirror for i database synchronization product, which replicates Db2 for i databases across multiple systems. The most severe issue, CVE-2026-17186, carries a CVSSv3.1 base score of 9.9 and allows remote execution of arbitrary CL commands due to improper neutralization of specific elements within commands. Additional high-severity flaws include CVE-2026-17184 (CVSS 9.8) enabling arbitrary code execution through external file and path control, and CVE-2026-17182 (CVSS 9.8) permitting authentication bypass via URI path validation failures to access or modify sensitive data. Further issues encompass path traversal for writing files to arbitrary locations (CVE-2026-17181, CVSS 9.3) and an authorization bypass (CVE-2026-16879, CVSS 8.8). The vulnerabilities impact versions 7.6, 7.5, and 7.4, with fixes released in the August 11 security advisory.
Top Cybersecurity Stories of the Week: WordPress XSS Flaw, Microsoft Patch Tuesday, Cisco Zero-Day and More
Security NEXT has published its weekly ranking of the most viewed articles between August 9 and August 15 2026. The list is dominated by critical vulnerabilities affecting widely deployed platforms including WordPress, Microsoft products, Cisco networking gear and Fortinet FortiOS. A cross-site scripting issue in the WordPress login screen and a remote code execution flaw in WordPress 7.0.4 both received immediate patches. Microsoft released updates addressing more than 400 vulnerabilities, while Cisco disclosed a zero-day denial-of-service flaw in its SSL VPN implementation. Additional high-impact issues were reported in FortiOS, Google Chrome, Zoom and Jenkins, prompting urgent remediation guidance from vendors.