JetBrains is telling Cadence users to revoke and rotate all credentials after attackers exploited a recently disclosed critical vulnerability in TeamCity, the CI/CD server JetBrains sells to run build and deployment pipelines. The advisory does not specify which CVE, but the pattern is the one TeamCity has produced twice before: an unauthenticated remote-code-execution flaw in the on-premises server, exploited before the patch window closed, with the CI/CD server's own credential store as the payoff. A build server holds the keys to everything it deploys. That is the design.

For a Hong Kong or Singapore bank running Cadence-adjacent tooling in its software supply chain, this lands squarely on HKMA's third-party risk management expectations and the vendor risk assessment obligations under SFC's own technology circulars: a compromised CI/CD credential store is exactly the scenario those frameworks assume a firm has already inventoried, not one it discovers from a vendor's rotate-everything email. AWS credentials sitting in a build server's memory or config, reachable by anyone who popped the server, is the finding a continuous exposure programme should have flagged before JetBrains did. If your renewal register cannot say which of your CI/CD platforms hold live cloud credentials, you don't have an inventory, you have a hope.

No identity or endpoint vendor swap fixes this. The control that would have changed the outcome is credential scoping: short-lived, narrowly-permissioned AWS tokens issued per build job rather than long-lived keys sitting in a CI server's secret store, so a TeamCity compromise yields nothing durable to rotate.