Evening Intelligence Dossier for September 26, 2026: Active ransomware exploitation of TeamCity, historic CFTC crypto authorization, Xbox's radical studio divestiture, and Rockstar's $400 merch drop.
Ransomware Gangs Exploit Critical TeamCity Vulnerability The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a severe warning on Wednesday, September 23, 2026: ransomware gangs are
now actively exploiting a critical vulnerability in JetBrains TeamCity. This security flaw, tracked as CVE-2026-63077, is one of the most dangerous vulnerabilities of 2026 with a CVSS score of 9.8 out
of 10. TeamCity is a popular platform for continuous integration and continuous deployment (CI/CD) developed by JetBrains, used by thousands of technology companies worldwide to automate software build,
test, and deployment processes. Now this critical tool has become a target for ransomware attacks. Nature of the Vulnerability: Unauthenticated Code Execution CVE-2026-63077 is a critical security flaw
in TeamCity On-Premises that allows attackers to execute arbitrary code on the server without any authentication whatsoever. This means anyone who can reach a TeamCity server over HTTP or HTTPS can potentially
take complete control of the system. [IMAGE_PLACEHOLDER_1] The problem lies within TeamCity's agent polling protocol the mechanism that build agents use to communicate with the server. Attackers can abuse
this protocol to bypass authentication checks and execute operating system commands with the same privileges as the TeamCity server process. CVE-2026-63077 is an unsafe deserialization vulnerability in
TeamCity's agent polling protocol. This flaw allows attackers to: No authentication required: No username or password needed Remote code execution: Can run any command they want High privilege level: Operates
Read Full Article