RSS Feeds

The British monarch has been stalked by protesters during his visit to the Bahamas, Antigua and Guyana – and they will only become more insistent as time goes on

• Don’t get Cotton Capital delivered to your inbox? Sign up here

The sun is starting to set in the Bahamas and the loud wash of the tide, which is always audible on Nassau’s Western Esplanade, is beginning to be drowned out by the sound of excited screams. King Charles is visiting the Caribbean archipelago, for which he is still the head of state, for the first time in more than 50 years and a youth rally attended by schoolchildren makes for a particularly welcoming crowd.

Some have described the king’s nine-day tour of the Bahamas, Antigua and Guyana amid growing calls for reparations as a significant risk that may accelerate his removal as head of state from the six remaining Caribbean Commonwealth countries in which he still serves.

British people can’t be made to pay for the wrongs of slavery – but we must confront our complicated history | Andy Burnham

‘Reparations now’: King and Burnham face protests at Antigua Commonwealth summit | Natricia Duncan

Lobbying, lawyers and a media blitz: the fight to kill the Church of England’s £100m slavery compensation fund| John Collingridge

Barack Obama pays tribute to Manchester cotton workers and cites them as an inspiration | Chris Osuh

Deceptively simple’: Gullah Geechee art exhibition illustrates that beauty lies in the details | Adria R Walker

TeamCity On-Premises 2026.2.2 and 2026.1.6 bug-fix updates are now available. These updates resolve a significant number of issues, including security and performance issues, as well as the following bugs:

• Projects created by their parent projects’ versioned settings cannot collect new changes;
• Cloud agents cannot be matched to their related instances after a sever restart;
• Slow revision calculation for checkout rules affecting rarely changed files;
• Secondary nodes cannot retrieve the list of available security patches.

As always, we strongly recommend installing these updates, as they address security vulnerabilities and help keep your TeamCity On-Premises instance protected against potential threats.

See TeamCity 2026.1.6 Release Notes and TeamCity 2026.2.2 Release Notes for the complete list of resolved issues.

Why update?

Staying up to date with minor releases ensures your TeamCity instance benefits from the following:

• Performance improvements.
• Better compatibility with integrations.
• Faster, more stable builds.
• Enhanced security for your workflows.

Compatibility

All TeamCity bug-fix updates released for the same major version share data format. As a result, you can upgrade or downgrade within this series without the need for backup and restoration.

How to upgrade

1. Use the automatic update feature in your current TeamCity version.
2. Download the latest version directly from the JetBrains website.
3. Pull the updated TeamCity Docker image.

Need help?

Thank you for reporting issues and providing feedback! If you have questions or run into any problems, please let us know via the TeamCity Forum or Issue Tracker.

Happy building!

Summary

In October 2026, the private keys of eight intermediate certificate authorities operated by eMudhra were found to be weak and recoverable from public data. According to eMudhra’s official statement, none of the affected intermediate CAs had issued end-entity (leaf) certificates, and eMudhra is not aware of evidence that the weak keys were recovered or exploited before the issue was disclosed.

The issue is not a vulnerability in TeamCity itself. However, the trust stores maintained by other software components (primarily the Java runtime) that TeamCity relies on may continue to trust the compromised certificates. Starting with versions 2026.2.2 and 2026.1.6, TeamCity shows a health report if the installation still trusts affected certificates, along with remediation steps.

Recommended actions:

• TeamCity On-Premises: Review server and build agent installations and apply the necessary fixes according to the instructions below. Upgrade to v2026.2.2 or v2026.1.6 for an updated Java runtime for the Windows agent installer, updated Docker images, and the health report, or follow the instructions below to apply the same fixes to the current installation.
• TeamCity Cloud: TeamCity Cloud has already been updated. Certificates uploaded to TeamCity must be reviewed as described in Certificates uploaded to TeamCity below. Self-hosted build agents must also be reviewed according to the instructions below.

Details

On October 17, 2026, the private keys of eight eMudhra intermediate CAs, six for TLS and two for code signing, were reported as compromised. This is an industry-wide certificate authority incident, not an issue specific to TeamCity. Certificates issued with these keys would look valid to any software that still trusts them.

Browser and OS vendors have released updates that block the compromised certificates, and systems are protected once they install them. Software with its own trust store, such as a Java runtime, keeps trusting the compromised certificates until that trust store is updated. TeamCity’s server and build agents use the trust store of their Java runtime.

TeamCity downloads are not signed by an eMudhra CA and are not affected.

What you need to do

1. Update the Java runtime

1. Identify the Java runtime used by each server node and agent, including any custom trust store set with javax.net.ssl.trustStore.
2. Check the Java vendor’s release notes for CVE-2026-91403 and CVE-2026-114820. For Amazon Corretto 21, the fixed build is 21.0.13.0.11 or later.
3. Update affected runtimes and restart each server node or agent.

Optional trust-store verification can identify affected certificates still present in a trust store. If upgrading is not feasible, follow the manual mitigation commands in the same section.

Removing AAA Certificate Services can disrupt unaffected services; test dependent connections before removing that root.

2. Update your TeamCity server and review uploaded certificates

The following server maintenance recommendations apply to TeamCity On-Premises installations. JetBrains patches TeamCity Cloud, but certificates uploaded to the service still require review.

1. Upgrade TeamCity if possible. Releases 2026.2.2 and 2026.1.6 add the health report, other product improvements, and fixes for other vulnerabilities. Existing agents require an independent review.
2. Update Java on every server node. Follow Update the Java runtime, even after upgrading TeamCity.
3. Redeploy Docker installations. Pull the patched 2026.2.2 or 2026.1.6 server image from Docker Hub once published, or rebuild the existing image using the server image instructions. Recreate the containers.
4. Review uploaded certificates. Use the health report or the certificate inspection commands below and then remove affected certificates through the Root project’s SSL / HTTPS Certificates page. Updating Java does not remove uploaded certificates.

Updating the TeamCity server does not update integrations or third-party software. Review those components separately as described in Review and update supporting infrastructure.

3. Update your TeamCity agents and review trusted certificates

1. Update Java on every build agent. Follow Update the Java runtime. TeamCity Cloud customers must also review the Java runtimes used by their self-hosted agents. The health report does not check agents.
2. Update Docker installations. Pull the patched 2026.2.2 or 2026.1.6 agent image from Docker Hub. Alternatively, rebuild the existing image using the same rebuild instructions as for the server image. Recreate the containers using the updated image.
3. Review agent certificates. Run the certificate inspection commands under Technical commands from <agent home>/conf/trustedCertificates and remove any affected certificate files. Updating Java does not remove these certificates.

4. Review and update supporting infrastructure

Updating the server does not update integrations or third-party software. We recommend reviewing these components independently:

• Operating systems and build tools: Apply vendor updates to OS trust stores, other Java runtimes, Git and MinGit, Python’s certifi, Node.js, and other tools with separate trust stores.
• Custom images: Update the OS and tools inside each affected image, rebuild the image, and recreate the containers.
• Connected services: Replace eMudhra certificates used by VCS hosts, package registries, and other services through eMudhra’s migration process.

5. Update TeamCity CLI

TeamCity CLI is distributed separately from the server and agents and requires its own update. Version 1.6.1 (October 26, 2026) was rebuilt with Go 1.27.3, which includes the fix.

Run teamcity update on every machine where the CLI is used, including build agents, and confirm the version with teamcity --version. Other installation methods are listed on the release page.

Technical commands

Each script defines its environment variables at the top:

• TEAMCITY_JRE: Defaults to JAVA_HOME; change it if TeamCity runs on another JRE or JDK.
• TC_TRUSTSTORE: Set to any custom javax.net.ssl.trustStore (JDK 8 default: jre/lib/security/cacerts).
• TC_STOREPASS: Change it if the password differs.
• TC_CERT_DIR: The certificate file to inspect, where indicated.

Optional trust-store verification

Please note the result applies only to the selected trust store. The commands do not inspect blocked.certs.

Linux and macOS (Bash or zsh):

(
export TEAMCITY_JRE="${TEAMCITY_JRE:-$JAVA_HOME}"
export TC_TRUSTSTORE="$TEAMCITY_JRE/lib/security/cacerts"
export TC_STOREPASS='changeit'

keytool="${TEAMCITY_JRE:?Set TEAMCITY_JRE or JAVA_HOME to the Java home directory of the runtime in use}/bin/keytool"
[ -x "$keytool" ] || { echo "ERROR: keytool not found at $keytool. TEAMCITY_JRE must be the Java home directory (the folder that contains bin/ and lib/)." >&2; exit 1; }
output=$("$keytool" -J-Duser.language=en -list -v \
  -keystore "$TC_TRUSTSTORE" -storepass:env TC_STOREPASS) ||
  { echo "ERROR: Certificate check failed." >&2; printf '%s\n' "$output" >&2; exit 1; }

awk '
  /^Alias name:/ { alias=$0 }
  /86:A1:EC:BA:08:9C:4A:8D|D7:A7:A0:FB:5D:7E:27:31|7D:D7:8D:5F:4F:13:45:9A|F2:ED:AA:FF:3D:9B:70:1F|40:F6:AF:03:46:A9:9A:A1|1A:A0:C2:70:9E:83:1B:D6|CN=EM (DV|OV|EV) (TLS|CS) CA - G3/ {
    found=1; print alias; print
  }
  END {
    print found ? "ACTION REQUIRED: this trust store still trusts compromised eMudhra certificates (listed above). Update the Java runtime or apply the manual mitigation." \
                : "OK: no compromised eMudhra certificates found in this trust store. No action is needed for it."
  }
' <<< "$output"
)

Windows (PowerShell):

& {
$ErrorActionPreference = 'Stop'
if (-not $env:TEAMCITY_JRE) { $env:TEAMCITY_JRE = $env:JAVA_HOME }
$env:TC_TRUSTSTORE = "$env:TEAMCITY_JRE\lib\security\cacerts"
$env:TC_STOREPASS = 'changeit'

if (-not $env:TEAMCITY_JRE) { throw 'Set TEAMCITY_JRE or JAVA_HOME to the Java home directory of the runtime in use.' }
$keytool = "$env:TEAMCITY_JRE\bin\keytool.exe"
if (-not [IO.File]::Exists($keytool)) { throw "keytool not found at $keytool. TEAMCITY_JRE must be the Java home directory (the folder that contains bin\ and lib\)." }
$prev = $ErrorActionPreference; $ErrorActionPreference = 'Continue'
$output = & $keytool '-J-Duser.language=en' -list -v -keystore "$env:TC_TRUSTSTORE" -storepass:env TC_STOREPASS 2>&1
$ErrorActionPreference = $prev
if ($LASTEXITCODE -ne 0) { throw "ERROR: Certificate check failed. $output" }

$pattern = '86:A1:EC:BA:08:9C:4A:8D|D7:A7:A0:FB:5D:7E:27:31|7D:D7:8D:5F:4F:13:45:9A|F2:ED:AA:FF:3D:9B:70:1F|40:F6:AF:03:46:A9:9A:A1|1A:A0:C2:70:9E:83:1B:D6|CN=EM (DV|OV|EV) (TLS|CS) CA - G3'
$alias = ''
$found = $false
foreach ($line in $output) {
    if ($line -match '^Alias name:') { $alias = $line }
    if ($line -match $pattern) { $found = $true; $alias; $line }
}
if ($found) { 'ACTION REQUIRED: this trust store still trusts compromised eMudhra certificates (listed above). Update the Java runtime or apply the manual mitigation.' }
else { 'OK: no compromised eMudhra certificates found in this trust store. No action is needed for it.' }
}

Certificates uploaded to TeamCity

The health report in versions 2026.2.2 and 2026.1.6 lists affected server certificates. For manual inspection, check custom certificates and identify the affected ones.

Set path to the directory with custom certificates (TC_CERT_DIR) to the following and run the command:

• Server: <TeamCity Data Directory>/config/projects/_Root/pluginData/trustedCertificates
• Agent: <agent home>/conf/trustedCertificates

Linux and macOS (Bash or zsh):

(
export TEAMCITY_JRE="${TEAMCITY_JRE:-$JAVA_HOME}"
export TC_CERT_DIR="${TC_CERT_DIR:-/path/to/trusted/certificates}"

keytool="${TEAMCITY_JRE:?Set TEAMCITY_JRE or JAVA_HOME to the Java home directory of the runtime in use}/bin/keytool"
[ -x "$keytool" ] || { echo "ERROR: keytool not found at $keytool. TEAMCITY_JRE must be the Java home directory (the folder that contains bin/ and lib/)." >&2; exit 1; }
[ -d "$TC_CERT_DIR" ] || { echo "ERROR: directory not found: $TC_CERT_DIR. Either no custom certificates have been added yet (TeamCity creates the directory on the first upload), or TC_CERT_DIR is incorrect (server: <TeamCity Data Directory>/config/projects/_Root/pluginData/trustedCertificates, agent: <agent home>/conf/trustedCertificates)." >&2; exit 1; }
found=0
while IFS= read -r f; do
  output=$("$keytool" -J-Duser.language=en -printcert -v -file "$f") ||
    { echo "ERROR: Cannot read $f." >&2; printf '%s\n' "$output" >&2; exit 1; }
  if grep -Eq '86:A1:EC:BA:08:9C:4A:8D|D7:A7:A0:FB:5D:7E:27:31|7D:D7:8D:5F:4F:13:45:9A|F2:ED:AA:FF:3D:9B:70:1F|40:F6:AF:03:46:A9:9A:A1|1A:A0:C2:70:9E:83:1B:D6|CN=EM (DV|OV|EV) (TLS|CS) CA - G3' <<< "$output"; then
    echo "AFFECTED: $f"; found=1
  fi
done < <(find "$TC_CERT_DIR" -maxdepth 1 -type f)
[ "$found" = 1 ] && echo "ACTION REQUIRED: the files listed above are compromised eMudhra certificates. Remove them (server: SSL/HTTPS Certificates page; agent: delete the files)." ||
  echo "OK: no compromised eMudhra certificates found in $TC_CERT_DIR. No action is needed."
)

Windows (PowerShell):

& {
$ErrorActionPreference = 'Stop'
if (-not $env:TEAMCITY_JRE) { $env:TEAMCITY_JRE = $env:JAVA_HOME }
if (-not $env:TC_CERT_DIR) { $env:TC_CERT_DIR = 'C:\path\to\trusted\certificates' }

if (-not $env:TEAMCITY_JRE) { throw 'Set TEAMCITY_JRE or JAVA_HOME to the Java home directory of the runtime in use.' }
$keytool = "$env:TEAMCITY_JRE\bin\keytool.exe"
if (-not [IO.File]::Exists($keytool)) { throw "keytool not found at $keytool. TEAMCITY_JRE must be the Java home directory (the folder that contains bin\ and lib\)." }
if (-not [IO.Directory]::Exists($env:TC_CERT_DIR)) { throw "ERROR: directory not found: $env:TC_CERT_DIR. Either no custom certificates have been added yet (TeamCity creates the directory on the first upload), or TC_CERT_DIR is incorrect (server: <TeamCity Data Directory>\config\projects\_Root\pluginData\trustedCertificates, agent: <agent home>\conf\trustedCertificates)." }
$pattern = '86:A1:EC:BA:08:9C:4A:8D|D7:A7:A0:FB:5D:7E:27:31|7D:D7:8D:5F:4F:13:45:9A|F2:ED:AA:FF:3D:9B:70:1F|40:F6:AF:03:46:A9:9A:A1|1A:A0:C2:70:9E:83:1B:D6|CN=EM (DV|OV|EV) (TLS|CS) CA - G3'
$found = $false
foreach ($file in Get-ChildItem -LiteralPath $env:TC_CERT_DIR -File) {
    $output = & $keytool '-J-Duser.language=en' -printcert -v -file $file.FullName
    if ($LASTEXITCODE -ne 0) { throw "ERROR: Cannot read $($file.FullName). $output" }
    if ($output -match $pattern) { "AFFECTED: $($file.FullName)"; $found = $true }
}
if ($found) { 'ACTION REQUIRED: the files listed above are compromised eMudhra certificates. Remove them (server: SSL/HTTPS Certificates page; agent: delete the files).' }
else { "OK: no compromised eMudhra certificates found in $env:TC_CERT_DIR. No action is needed." }
}

Manual mitigation commands

Before execution, make sure TEAMCITY_JRE in the current terminal points to the runtime actually running the TeamCity component:

• Server: Consult this configuration reference.
• Agents: Check teamcity.agent.jvm.java.home on the agent’s Parameters tab, as described in the Java Update Guide.

1. Copy lib/security/blocked.certs from a JDK containing the fix for CVE-2026-91403 to the same location in the runtime in use. Java 8 uses jre/lib/security/blacklisted.certs, while some Java 11 and 13 builds also use blacklisted.certs, so verify the path before copying.
2. Back up the trust store. Removing AAA Certificate Services can disrupt unaffected services; test dependent connections first.
3. Run the command below. It uses the same script header as the verification commands above, finds the affected roots listed above by fingerprint, and deletes them. Running it again is safe.

Linux and macOS (Bash or zsh):

(
export TEAMCITY_JRE="${TEAMCITY_JRE:-$JAVA_HOME}"
export TC_TRUSTSTORE="$TEAMCITY_JRE/lib/security/cacerts"
export TC_STOREPASS='changeit'

keytool="${TEAMCITY_JRE:?Set TEAMCITY_JRE or JAVA_HOME to the Java home directory of the runtime in use}/bin/keytool"
[ -x "$keytool" ] || { echo "ERROR: keytool not found at $keytool. TEAMCITY_JRE must be the Java home directory (the folder that contains bin/ and lib/)." >&2; exit 1; }
[ -w "$TC_TRUSTSTORE" ] || { echo "ERROR: cannot write to $TC_TRUSTSTORE (missing or no permission). Run with sudo or as the owner of the Java installation." >&2; exit 1; }
output=$("$keytool" -J-Duser.language=en -list -v \
  -keystore "$TC_TRUSTSTORE" -storepass:env TC_STOREPASS) ||
  { echo "ERROR: Certificate check failed." >&2; printf '%s\n' "$output" >&2; exit 1; }

affected=$(awk '
  /^Alias name:/ { alias=substr($0, 13) }
  /SHA256: (86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B|D7:A7:A0:FB:5D:7E:27:31:D7:71:E9:48:4E:BC:DE:F7:1D:5F:0C:3E:0A:29:48:78:2B:C8:3E:E0:EA:69:9E:F4|7D:D7:8D:5F:4F:13:45:9A:83:DF:F9:AB:BB:A6:2E:DB:AF:6F:2D:10:2B:F2:57:FD:71:2F:4D:9F:27:46:ED:8D|F2:ED:AA:FF:3D:9B:70:1F:B4:D1:4C:9F:28:5F:8C:0B:AD:90:FC:3B:CC:1F:A0:7D:47:F4:71:8E:DA:BA:34:A5|40:F6:AF:03:46:A9:9A:A1:CD:1D:55:5A:4E:9C:CE:62:C7:F9:63:46:03:EE:40:66:15:83:3D:C8:C8:D0:03:67|1A:A0:C2:70:9E:83:1B:D6:E3:B5:12:9A:00:BA:41:F7:EE:EF:02:08:72:F1:E6:50:4B:F0:F6:C3:F2:4F:3A:F3)/ { print alias }
' <<< "$output")
[ -n "$affected" ] || { echo "OK: this trust store contains no compromised eMudhra roots. Nothing to delete."; exit 0; }

while IFS= read -r alias; do
  echo "Deleting: $alias"
  "$keytool" -delete -alias "$alias" -keystore "$TC_TRUSTSTORE" -storepass:env TC_STOREPASS || exit 1
done <<< "$affected"
echo "DONE: removed the compromised root certificates listed above. Restart the TeamCity server node or agent, then run the verification again."
)

Windows (PowerShell):

& {
$ErrorActionPreference = 'Stop'
if (-not $env:TEAMCITY_JRE) { $env:TEAMCITY_JRE = $env:JAVA_HOME }
$env:TC_TRUSTSTORE = "$env:TEAMCITY_JRE\lib\security\cacerts"
$env:TC_STOREPASS = 'changeit'

if (-not $env:TEAMCITY_JRE) { throw 'Set TEAMCITY_JRE or JAVA_HOME to the Java home directory of the runtime in use.' }
$keytool = "$env:TEAMCITY_JRE\bin\keytool.exe"
if (-not [IO.File]::Exists($keytool)) { throw "keytool not found at $keytool. TEAMCITY_JRE must be the Java home directory (the folder that contains bin\ and lib\)." }
try { [IO.File]::Open($env:TC_TRUSTSTORE, 'Open', 'ReadWrite').Dispose() }
catch { throw "ERROR: cannot write to $env:TC_TRUSTSTORE. Run PowerShell as Administrator or as the owner of the Java installation. ($($_.Exception.Message))" }
$prev = $ErrorActionPreference; $ErrorActionPreference = 'Continue'
$output = & $keytool '-J-Duser.language=en' -list -v -keystore "$env:TC_TRUSTSTORE" -storepass:env TC_STOREPASS 2>&1
$ErrorActionPreference = $prev
if ($LASTEXITCODE -ne 0) { throw "ERROR: Certificate check failed. $output" }

$roots = '86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B|D7:A7:A0:FB:5D:7E:27:31:D7:71:E9:48:4E:BC:DE:F7:1D:5F:0C:3E:0A:29:48:78:2B:C8:3E:E0:EA:69:9E:F4|7D:D7:8D:5F:4F:13:45:9A:83:DF:F9:AB:BB:A6:2E:DB:AF:6F:2D:10:2B:F2:57:FD:71:2F:4D:9F:27:46:ED:8D|F2:ED:AA:FF:3D:9B:70:1F:B4:D1:4C:9F:28:5F:8C:0B:AD:90:FC:3B:CC:1F:A0:7D:47:F4:71:8E:DA:BA:34:A5|40:F6:AF:03:46:A9:9A:A1:CD:1D:55:5A:4E:9C:CE:62:C7:F9:63:46:03:EE:40:66:15:83:3D:C8:C8:D0:03:67|1A:A0:C2:70:9E:83:1B:D6:E3:B5:12:9A:00:BA:41:F7:EE:EF:02:08:72:F1:E6:50:4B:F0:F6:C3:F2:4F:3A:F3'
$alias = ''
$aliases = foreach ($line in $output) {
    if ($line -match '^Alias name: (.+)$') { $alias = $Matches[1] }
    if ($line -match "SHA256: ($roots)") { $alias }
}
if (-not $aliases) { 'OK: this trust store contains no compromised eMudhra roots. Nothing to delete.'; return }

foreach ($a in $aliases) {
    "Deleting: $a"
    $ErrorActionPreference = 'Continue'
    $result = & $keytool -delete -alias $a -keystore "$env:TC_TRUSTSTORE" -storepass:env TC_STOREPASS 2>&1
    $ErrorActionPreference = $prev
    if ($LASTEXITCODE -ne 0) { throw "ERROR: Failed to delete $a. $result" }
}
'DONE: removed the compromised root certificates listed above. Restart the TeamCity server node or agent, then run the verification again.'
}

Afterwards, run the verification commands above to confirm the roots are gone. Restart the server node or agent after completing the mitigation. Include any custom trust stores in the review.

Security Bulletin

JetBrains’ assessment and guidance on the eMudhra Certificate Authority incident is available here.

Frequently asked questions

Is TeamCity affected?

Not directly. As a CI/CD system, TeamCity connects to multiple integrations and relies on Java runtimes, build tools, and other components with separate trust stores. These trust stores require independent review and updates, as described in What you need to do.

Do I need to upgrade?

Upgrading to 2026.2.2 or 2026.1.6 is recommended. These releases add the health report, other product improvements, and fixes for other vulnerabilities.

Upgrading TeamCity does not always update Java, so review the corresponding runtime using the Optional trust-store verification section above. If upgrading TeamCity is not currently an option, apply the mitigations described in If upgrading is not feasible above.

Is TeamCity Cloud affected?

TeamCity Cloud has already been updated, but customers must still check:

• Self-hosted agents using TeamCity Agents, as described above.
• Certificates uploaded to TeamCity, as described above.

Does the health report check build agents?

No. The health report checks the server nodes only. Check and fix build agents manually, as described in TeamCity Agents above.

Which TeamCity Docker images are affected?

Images for versions 2026.2.2 and 2026.1.6 are patched, so please update if possible. Older images can be patched as described in TeamCity Server and TeamCity Agents above, and then used to recreate the containers.

Is TeamCity CLI affected?

Yes. TeamCity CLI is a Go application, and versions before 1.6.1 were built with an affected Go release. Update as described in Update TeamCity CLI.

Support

For any questions regarding this issue, please get in touch with the TeamCity Support team by submitting a ticket. To report a security issue in TeamCity, please follow our Coordinated Disclosure Policy.

References

• eMudhra Statement on Recent Certificate Security Incident
• OpenJDK advisory (CVE-2026-91403)
• Oracle security alert (CVE-2026-114820)
• eMudhra Certificate Authority Incident: Status and Guidance for JetBrains Products

Ministers propose new guided retirement scheme to help give savers protection for life

Millions of private sector workers will be offered a guaranteed pension income for life under new rules designed to help them get the most out of their retirement savings.

Over the past 30 years, the majority of final salary pension schemes offering a set payout for life have closed. Workers have instead saved into a scheme and arrived at retirement with a pot of money they have to decide what to do with.

A previously unseen family archive offers a glimpse into the Indian Nobel prize winner’s artistic process and personal relationships in his final years

• Don’t get This is India delivered to your inbox? Sign up here

It’s easy to run out of words to describe Rabindranath Tagore. The first non-European to win the Nobel prize in literature, Tagore was a Bengali poet, musician, novelist, philosopher, songwriter, painter, humanist and educator.

Born in 1861, Tagore left an indelible mark on the subcontinent’s literature, music, education and art. Among his enduring legacies are the national anthems of India and Bangladesh.

postgresweekly: plpgsql_wrap 1.0: A Way to Obfuscate PL/pgSQL Code — PostgreSQL: plpgsql_wrap v1.0 released — HexaCluster has open sourced its extension for distributing and

19th Nervous Breakdown

Приближение релиза PostgreSQL 19 к официальному вышло нервным. Появилась даже статья именно с таким названием: 19th Nervous Breakdown. Нервный срыв. Написал статью известный в сообществе человек, грамотный - Кристоф Питтус (Christophe Pettus), который ведёт свой блог The Build и возглавляет команду PGX (то есть PG Experts). Его любимая тема - разбор GUCов, но тут он сделал исключение - ведь и релиз исключительный в обоих смыслах: 1. уникальный, 2. сколько ж из него исключили!

Ну а название он придумал шикарное: оно отсылает к древней песне.

И это статья, пожалуй, самая основательная из тех, где говорят о причинах кризиса. А это даже не кризис: это Дырокалипсис (Vulnpocalypse - гибрид слов vulnerability и apocalypse). А ещё - Поезд откатов (откатов в хорошем, точнее, не в самом плохом смысле - Revert Train).

A previously unseen family archive offers a glimpse into the Indian Nobel prize winner’s artistic process and personal relationships in his final years

• Don’t get This is India delivered to your inbox? Sign up here

It’s easy to run out of words to describe Rabindranath Tagore. The first non-European to win the Nobel prize in literature, Tagore was a Bengali poet, musician, novelist, philosopher, songwriter, painter, humanist and educator.

Born in 1861, Tagore left an indelible mark on the subcontinent’s literature, music, education and art. Among his enduring legacies are the national anthems of India and Bangladesh.

Antananarivo, Madagascar - November 03, 2026

pgBadger

pgBadger is a PostgreSQL performance analyzer, built for speed with fully detailed reports based on your PostgreSQL log files.

pgBadger 13.3 was released today, this is a maintenance release that fixes issues and applied patches reported by users since last release.

• Add scroll on legend and mouseover graphs when the list of item is > 10.
• Fix several issues when the --explode option is used.
• Add filter of remote logs in watch mode on the remote host to not import all the log.
• Fix several issues with multiline statement in the log.
• Fix the same execution reported by both log_min_duration_statement and auto_explain resulting in counted twice.
• Add copy of explain plan.
• Handle "Query Parameters: ..." from auto_explain plan.
• Fix wrong queries dropped when filtering with --dbuser.
• Use per-run names for temporary dblist and last parsed files to prevent two pgbadger running at the same time to read the same files.

For the complete list of changes, please checkout the release note on https://github.com/darold/pgbadger/releases

Links & Credits

I would like to thank all users who submitted patches and users who reported bugs and feature requests, they are all cited the ChangeLog file.

pgBadger is an open project. Any contribution to build a better tool is welcome. You just have to send your ideas, features requests or patches using the GitHub tools or directly to pgbadger@darold.net.

Links :

• Download: http://pgbadger.darold.net/
• Support: use GitHub report tool at https://github.com/darold/pgbadger/issues or contact pgbadger@darold.net.

For a complete list of commercial support near of your place take a look at the PostgreSQL Professional Services page, they all do great job and most of them can help you.

About pgBadger :

pgBagder is a new generation log analyzer for PostgreSQL, created by Gilles Darold (also author of ora2pg, the powerful migration tool). pgBadger is a fast and easy tool to analyze your SQL traffic and create HTML5 reports with dynamics graphs. pgBadger is the perfect tool to understand the behavior of your PostgreSQL servers and identify which SQL queries need to be optimized.

Docs, Download & Demo at http://pgbadger.darold.net/

Compared to infants in the state’s low-pollution areas, the odds were 4.3 times higher for babies from toxic hotspots

A study looking at babies hospitalized in New Orleans found that babies born to mothers from neighborhoods in south-east Louisiana with high levels of industrial pollution were four times more likely to suffer from severe congenital heart defects.

Published last week, the study in the Environmental Health journal looked at medical records for 454 infants hospitalized at the two major Louisiana hospitals that can provide surgery for heart defects in babies. Researchers traced back where the mothers of these infants lived, examining the levels of industrial toxic pollution in their communities using the US Environmental Protection Agency’s risk-screening database. Compared to infants from low-pollution areas in the region, the odds of congenital heart defects were 4.3 times higher for infants from toxic hotspots, and 3.1 times higher for infants from places with intermediate levels of pollution.

The UAE’s spymaster is also one of the richest financiers on the planet. Now he has his sights on AI dominance. Jack Shenker explores the sheikh’s shadowy world

When we think about the world’s most powerful people, a few names will inevitably spring to mind: Trump, Putin, maybe some of the tech bros such as Elon Musk or Sam Altman. But what about the people we don’t see? The ones who prefer to stay in the shadows?

For the journalist Jack Shenker, this is the kind of power that most needs to be investigated. Over the past few years, his reporting has led him back, time and time again, to one man – a man who not only controls $1.5tn on the international markets but is his country’s spymaster and one of the most influential diplomats in the Middle East. He also runs the security services in one of the most politically authoritarian countries on Earth. Yet almost nobody outside the UAE knows his name: Tahnoon bin Zayed Al Nahyan.

Stopgap measure does not solve fundamental problem that millions can’t afford the healthcare they need, experts say

Some of the millions of Americans who collectively owe billions of dollars for medical expenses have seen their debt forgiven in recent years, and there has been a dramatic uptick in aid this year.

But the relief still only covers a small fraction of the outstanding balance and is just a stopgap measure that does not solve the fundamental problem: people in the US get into serious financial trouble because they can’t afford the healthcare they need, experts say.

Experts say ‘very dangerous’ move diverts attention from violence driven by far-right extremist ideologies

The US Department of Justice is funding research aimed at exploring whether there is a link between gender dysphoria and violent crime.

Last month, the National Institute of Justice (NIJ), the research arm of the justice department, said it would grant up to $1m for studies into the frequency and type of violence committed by people who have been diagnosed and treated for gender dysphoria.

From Hamilton to the ‘Epstein class’, we have long been fascinated by a charismatic yet shadowy set of power brokers. American aristocracy is alive and well

Americans remain awed by the extravagance of the super-rich, oddly enticed and generally accepting of the fact that the monied elite have privileges that they use to their own advantage.

After the Hollywood celebrity and the professional athlete, the figure who invites the most curiosity is what is colloquially termed “powerbroker”. We’re talking about the dealmaker, the inside player – or in the words of Sade’s song, a “smooth operator”.

Experts say ‘very dangerous’ move diverts attention from violence driven by far-right extremist ideologies

The US Department of Justice is funding research aimed at exploring whether there is a link between gender dysphoria and violent crime.

Last month, the National Institute of Justice (NIJ), the research arm of the justice department, said it would grant up to $1m for studies into the frequency and type of violence committed by people who have been diagnosed and treated for gender dysphoria.

Итан Сигел (американский астрофизик‑теоретик и научный журналист, автор рубрики «Спросите Итана», один из пропагандистов современных научных знаний), идёт в решительную атаку против всех, кто отрицает существование тёмной материи! Удастся ли ему убедить тех, кто сомневается в её существовании?

@avshkol перевел целых 2 статьи Итана на эту тему и сделал из них одну статью на Хабре. Итак, тёмная материя или невидимая нами обычная материя (например, чёрные дыры)? Тёмная материя или модификация ОТО в части гравитации? Тёмная материя или признание нашей неспособности здесь и сейчас точно смоделировать законы динамики звёзд и галактик? Тёмная материя или наблюдаемый результат деятельности иных цивилизаций? Добро пожаловать в дискуссию!

On 1 November, 61,000 people ran in the 2026 New York City Marathon. We asked about the running gear – and motivations – that carried them to the finish line

• The best women’s running shoes for roads and trails

The sea of orange thermal blankets, shiny medals and brightly colored running shoes is impossible to miss.

On 1 November, 61,000 people took over New York City’s streets for the 2026 NYC Marathon. Making it through the 26.2-mile race is a feat that takes grit, endurance and … the right gear.

Time: 2hr 28min 12sec

Has completed all six world marathon majors

Long, short, tailored or sporty, there’s a great jacket for everyone – here are our favourites

• Jess Cartner-Morley’s November style essentials

It’s November, which means your thick tights and cosiest jumpers have emerged from that box under the bed. And while winter weather brings with it a whole host of wardrobe-related challenges, few can’t be solved with the addition of an outstanding coat.

A coat is the easiest way to add a stamp of your signature style to an outfit. They bring sophistication, drama, and (for some, most importantly) warmth. Elevate a simple jeans-and-tee outfit with a statement jacket, or pair a classic tailored option with a skirt and your favourite boots for an evening-out cheat code.

Anonymity of individual, whose lawyers had sought injunction citing suicide risk, remains in place subject to any appeal

A “well-known individual” has failed in his attempt to stop two media organisations from publishing allegations of inappropriate sexual activities towards young women, the high court has ruled.

The legal team for the anonymous individual, known in court only as PPT, had claimed he was “highly likely” to attempt suicide if the Guardian and ITN published the allegations, which he denies.

World’s largest crypto exchange faces fallout from angry customers, and Lula wins with WhatsApp

• This was originally published in TechScape, a newsletter about how technology shapes our lives. Sign up to receive it here

This week in tech, we’re discussing the fallout from the multibillion-dollar hack of Binance and the significance of Lula’s political mobilization on WhatsApp.

And if you’ll be at Web Summit in Lisbon next week, drop me a line! I’ll be there moderating panels on open-source AI and human agency in the age of AI agents.

Tell us: have you been affected by the Binance hack?

Polymarket temporarily suspends trading on international platform due to security incident

How crypto hacking funds isolated North Korea’s nuclear programme

Ghost in the machine: how AI is haunting the search for the supernatural

Computerized clairvoyance: psychics push back against AI-generated readings

The staggering $446m Elon Musk has spent on the US midterms – visualized

Billionaire tax: how a union leader’s ‘crazy’ idea became the defining issue of California’s midterms

How tech became the villain of the US midterms

The ultra-rich are spending one million dollars a day fighting California’s proposed billionaire tax

Штатный BenBen не давал нам русского голосового управления. Разобрались с двумя компьютерами Unitree Go2, получили root основного контроллера, исправили срывы Wi-Fi и связали русские команды со штатными API. Как нашли сальто вне доступного интерфейса и добились подхода и сопровождения по UWB-пульту.

Anonymity of individual, whose lawyers had sought injunction citing suicide risk, remains in place subject to any appeal

A “well-known individual” has failed in his attempt to stop two media organisations from publishing allegations of inappropriate sexual activities towards young women, the high court has ruled.

The legal team for the anonymous individual, known in court only as PPT, had claimed he was “highly likely” to attempt suicide if the Guardian and ITN published the allegations, which he denies.