Cloud roundup: unauthenticated TeamCity RCE now in KEV

If you run a self-hosted CI/CD server, stop reading and go patch it. That’s the headline today — the rest is a mix of AWS platform news and more actively-exploited flaws in tools a lot of us have sitting in our stacks.

TeamCity RCE is now under active exploitation

CISA added CVE-2026-63077, a critical (CVSS 9.8) unauthenticated remote code execution flaw in JetBrains TeamCity On-Premises, to the Known Exploited Vulnerabilities catalog on August 5 (CISA, The Hacker News). An attacker can abuse the agent polling protocol to skip authentication entirely and run arbitrary OS commands as the TeamCity server process — which means your build agents, artifacts, and any credentials TeamCity holds for deploying into AWS are all in play. JetBrains has patches out (upgrade to 2025.11.7 or 2026.1.3, per JetBrains’ advisory); federal agencies were given until August 8 to remediate under BOD 26-04. If your TeamCity server has any path to the public internet, treat this like the SolarWinds-style CI/CD compromise scenario it is and patch today, then audit what credentials that server has been handing out.

Two more KEV additions worth knowing about

The same CISA update cycle also added CVE-2026-9198, a code injection bug in Langflow (the visual builder a lot of teams use to prototype LLM pipelines) that gives unauthenticated RCE on default installs — telemetry shows 650+ exploitation attempts from 244 unique IPs since early July (The Hacker News). And CVE-2026-34486, a missing-encryption flaw in Apache Tomcat’s EncryptInterceptor, is reportedly being hit by an AI-orchestrated, China-nexus automated attack campaign. If you’ve stood up Langflow for an internal AI experiment and forgotten about it, that’s exactly the kind of exposed dev tool this campaign is scanning for — take: audit anything you spun up “just to try AI stuff” six months ago and never locked down.

AWS Lambda gets a real bandwidth bump

Less urgent, more useful: AWS Lambda functions outside a VPC with 2 GB+ of memory now scale network bandwidth proportionally, from 625 Mbps at 2 GB up to 3,000 Mbps at 10 GB, at no extra charge (AWS). That’s a meaningful jump for anything doing large payload transfers, S3 streaming, or bursty data-heavy work in Lambda — previously you were capped at 625 Mbps regardless of memory. Catch: it’s not automatic. You have to request the “Network bandwidth per execution environment” quota bump via Service Quotas before your functions see it, so if you have latency-sensitive Lambdas moving a lot of data, it’s worth requesting now even if you don’t need it yet — quota changes aren’t instant.

Also worth a look

CloudWatch now offers managed Prometheus collectors that auto-provision and scale to pull OpenTelemetry/Prometheus metrics from EKS, EC2, ECS, MSK, and OpenSearch without you running your own collector fleet — worth a look if you’re maintaining a hand-rolled Prometheus scraping setup on EKS. And separately, N-able confirmed active exploitation of an N-central authentication bypass (CVE-2026-18577) that let an attacker pivot from a compromised N-central server into managed endpoints — a reminder that RMM/MSP tooling is a high-value target precisely because of the blast radius one compromised instance gives an attacker.

Bottom line

Today’s theme is “your build and automation tooling is the target, not just your app.” Patch TeamCity if you run it, sweep for forgotten Langflow instances, and grab the free Lambda bandwidth quota bump while it’s on your mind.