Threat Intel Bi-Weekly — April 24, 2026

An unauthenticated path traversal vulnerability in JetBrains TeamCity CI/CD server is being actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog. Attackers are using the flaw to read sensitive configuration files — including agent authentication tokens and internal API credentials — without requiring any login. The vulnerability affects TeamCity versions prior to 2023.11.4.

A remote code execution vulnerability exists in Apache ActiveMQ's Jolokia JMX-HTTP bridge. An attacker with network access to the Jolokia endpoint can invoke arbitrary MBean operations to execute code on the broker host. The Jolokia interface is enabled by default in many ActiveMQ deployments and is often inadvertently exposed. Affects all ActiveMQ versions below 5.19.4 and the 6.0.0–6.2.2 range.

An unauthenticated path traversal vulnerability in CrowdStrike LogScale (Humio) allows an attacker to read arbitrary files from the server filesystem. CrowdStrike's SaaS-hosted instances were automatically patched. However, organizations running self-hosted LogScale clusters must apply the patch manually. The vulnerability can expose log data, configuration files, and internal credentials stored on the LogScale host.

North Korean threat actor Sapphire Sleet published malicious versions of the widely-used axios npm package (versions 1.14.1 and 0.30.4) bundled with plain-crypto-js@4.2.1 which installs a Remote Access Trojan. These typosquat or version-hijack packages blend in with legitimate axios installs and establish persistent C2 channels. Any developer whose environment ran npm install axios during the window these packages were live is potentially compromised.

A command injection vulnerability in the GitHub Copilot VS Code extension allows a malicious repository to craft inputs that escape the extension's shell invocation context and execute arbitrary commands in the developer's local environment. The flaw is triggered when Copilot processes certain inline code suggestions from a repository containing specially crafted comments or docstrings. CVSS score is pending official assignment.

Attackers used Lumma Stealer malware to harvest OAuth tokens from developers' machines, then leveraged those tokens to gain lateral access to Vercel projects and Context.ai integrations. The breach exposed deployment tokens, environment variable secrets, and in some cases production API keys stored in Vercel project settings. The attack chain demonstrates how credential-stealing malware targeting developer endpoints can propagate into production infrastructure via OAuth trust relationships.