Another week, another pile of CVEs, exploits and security incidents.
Some deserved the headlines. Others didn’t. A few showed something more interesting: attackers don’t necessarily need to break into your most important system. They just need to find a vulnerable system that already has trust.
TeamCity: patching is not enough
CVE-2026-63077 stood out this week because attackers can hit vulnerable TeamCity On-Premises servers without authentication.
We covered the story in TeamCity RCE Is Under Attack. Your CI/CD Server Could Be the Backdoor.
For us, the interesting part isn’t just the RCE. It’s what TeamCity can reach.
A CI/CD server can have access to source code, build agents, credentials and deployment systems.
Our take: if TeamCity can reach production, treat TeamCity like production.
NetScaler: the front door problem
Authentication bypasses are bad.
An authentication bypass on a VPN or application gateway is worse.
We looked at the issue in Citrix NetScaler Is Under Attack. Hackers Are Already Dropping Web Shells.
NetScaler sits at the edge of the network. That’s exactly where you don’t want an attacker finding a shortcut around authentication.
Our take: stop calling Internet-facing gateways “just appliances”. They are the front door.
Gitea: developers are targets too
Gitea was another interesting case this week. A Git server might not look as exciting as a VPN gateway, but it can contain something attackers value even more: trust.
Our report, Gitea RCE Is Being Exploited. Attackers Are Already Dropping Payloads, covered the exploitation.
Repositories, credentials and automation can all connect the compromised server to other parts of the environment.
Our take: the Git server doesn’t need to be the final target. It can simply be the place where the attacker starts.
The pattern we saw this week
Different products. Different vulnerabilities.
Same problem.
Too much trust. Too much access. Too many systems exposed because “that’s how the environment works”.
A CVE gets patched. The ticket gets closed.
But the architecture that made the vulnerability useful remains.
That’s the part we think deserves more attention.
Don’t ask only:
“How serious is this CVE?”
Ask:
“What happens if someone actually exploits it?”
That answer tells you much more than the CVSS score.
Bugstoday take
This week’s stories weren’t interesting simply because there were a lot of vulnerabilities.
They were interesting because they showed the same uncomfortable pattern again and again:
attackers don’t need every system to be vulnerable. They need one trusted system to be vulnerable enough.
Patch the software.
Then look at what that software can touch.
Because that’s where a bug stops being a bug and starts becoming a breach.
Today’s bugs. Tomorrow’s breaches.
