Today’s digest is about the infrastructure built to move fast: a CI/CD server wired for automation, an AI assistant trusted to act on a user’s behalf, a package registry that auto-installs whatever a build script asks for, and a webmail client that renders whatever HTML lands in an inbox. All four get hit this week. Here’s what changed since yesterday’s digest.
Vulnerability watch: JetBrains TeamCity’s unauthenticated RCE is now under active exploitation, past its federal patch deadline
CVE-2026-63077 (CVSS 9.8), a critical unauthenticated remote code execution flaw in TeamCity On-Premises, has moved from “patched before exploitation” to actively exploited in the wild. JetBrains fixed the bug on July 27 after a private disclosure — a vulnerable server’s XStream allowlist incorrectly retained default deserialization permissions alongside TeamCity’s own protocol classes, letting anyone who can reach the server’s agent-polling endpoint over HTTP(S) execute OS commands with no credentials at all. CISA added it to the Known Exploited Vulnerabilities catalog on August 5 once exploitation attempts were confirmed, setting an August 8 remediation deadline for federal agencies — a deadline that passed yesterday. Fixed versions are 2025.11.7 and 2026.1.3. The Hacker News · CISA · SecurityWeek
A CI/CD server is a keys-to-the-kingdom target — compromise it and an attacker controls what your organization builds and ships. If TeamCity On-Premises isn’t already on 2025.11.7 or 2026.1.3, this is past due; also check server and agent logs for unexpected process launches since late July, since a patch now doesn’t undo exploitation that already happened.
AI security watch: A one-click flaw in Atlassian’s Rovo AI assistant could have leaked Confluence, Jira, and SharePoint data
Varonis researchers disclosed RovoBlast, a prompt-injection flaw in Rovo, Atlassian’s AI assistant, that let a single crafted link seed a full attacker-written prompt directly into a victim’s live Rovo session via the rovoChatPrompt URL parameter — no jailbreak, no permission bypass, just an assistant treating an externally supplied parameter as trusted instructions. The proof of concept told Rovo to locate information the victim could already access, embed it in an attacker-controlled image URL, and fetch that image — quietly exfiltrating the data to the attacker’s server the moment Rovo rendered it. The researcher demonstrated pulling a private Confluence API key this way; Bugcrowd testing found the same technique worked against Jira and data reachable through SharePoint and Outlook connectors. Atlassian fixed the issue before Varonis published. SecurityWeek · The Hacker News · Varonis
This one’s already patched, but the pattern isn’t Atlassian-specific: any AI assistant that reads URL parameters, email bodies, or ticket text as part of its working context is a prompt-injection surface. If you’ve rolled out enterprise AI agents wired into Jira, Confluence, SharePoint, or similar connectors, ask the vendor directly how untrusted external input is separated from instructions — “it summarizes what the user can already see” is not the same guarantee as “it can’t be told what to fetch.”
Supply chain watch: DPRK-linked npm packages hide their command-and-control address inside blank Ethereum transfers
Researchers identified NullReceiver, a new command-and-control technique used by two trojanized npm packages — bianira-ui v1.27.0 and fluid-type-ui v2.0.8 — both impersonating legitimate Tailwind CSS plugins. Instead of hardcoding a C2 domain or using a smart contract, the malware decodes its C2 IP address from the recipient address of the attacker’s most recent zero-value, zero-data Ethereum transfer — no transaction calldata, no publicly trackable fixed destination the way earlier “EtherHiding” techniques used. The campaign traces to the DPRK-linked Contagious Interview operation, and shared infrastructure led researchers to more than 20 other compromised packages across the npm, Go, and PHP ecosystems tied to a related campaign tracked as PolinRider. The Hacker News · SC Media
Blockchain-based C2 keeps getting harder to blocklist by IP or domain, which pushes detection back toward behavior — outbound calls to blockchain RPC endpoints from a build or CI process, or an npm install pulling a package that impersonates a well-known plugin name. If your org has developers on Node projects, this is a good week to remind them to check package provenance before adding a dependency, especially anything claiming to be a Tailwind or UI utility plugin.
Also noted: New CSS-based attacks can break password fields and steal session tokens across major webmail providers
At Black Hat USA 2026, PortSwigger researcher Gareth Heyes presented “CSS: the bomb inside your inbox,” showing that CSS alone — no JavaScript — can escape an email’s rendering sandbox and manipulate the surrounding webmail interface across Outlook, Gmail, Yahoo/AOL, Fastmail, and Proton Mail. The techniques abuse label elements, custom attributes, and media-query parsing quirks to disguise form fields (for example, rendering a password field as something else) and bypass HTML sanitizers. Demonstrated chains include an Outlook/Firefox attack that spoofs a Microsoft sign-in screen to capture a typed password, and a Yahoo/AOL “paste race” that exposes a login token. Fastmail and Proton Mail have already closed the specific bugs shown to researchers; as of publication, the Outlook label-jacking and a Gmail image-set() bypass still worked. The Hacker News · PortSwigger Research · Dark Reading
An attack that needs no JavaScript sails past most email security controls tuned to catch scripts and macros. There’s no customer-side patch for this yet on the still-vulnerable providers — the practical mitigation is awareness: treat an unexpected sign-in prompt that appears while reading an email as suspicious by default, and if your org’s webmail provider is on the still-vulnerable list, watch for a vendor fix.
Final thought
Every story today lives in tooling built to be helpful by default: a CI server that trusts its own protocol classes, an AI assistant that trusts the text in a URL, a package manager that trusts a plugin’s name, a webmail client that trusts the CSS in a message body. None of that trust is unreasonable on its own — it’s what makes the tools useful — but each one turned into an attack path the moment someone treated it as a hard boundary instead of a convenience. If you want help auditing which of your automation, AI, and developer tooling assumes more trust than it should, see our how-to guides or book a discovery call.