PostgreSQL Patches 52 Flaws Including 22-Year-Old Bug Enabling Authenticated RCE

The PostgreSQL Global Development Group has released updates addressing 52 security vulnerabilities, one of which is a type confusion flaw dating back to 2004 that allows authenticated remote code execution. Tracked as CVE-2026-6460 with a CVSS score of 8.8, the issue affects composite types and can be exploited by users with object creation privileges. Researcher Mehmet Ince published a working exploit that involves preparing queries, altering field types, and triggering memory operations leading to code execution. All versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25 are impacted, and administrators must also rebuild C-language extensions. Additional fixes cover client tools such as pg_restore and psql, while one unauthenticated flaw can restart PostgreSQL 18 servers. No in-the-wild exploitation has been observed according to CISA and project assessments.

The Hacker NewsNovember 13, 2026Translated from English

Read at source

The PostgreSQL Global Development Group released updates yesterday that address 52 security flaws, including a type confusion vulnerability tracked as CVE-2026-6460 that enables authenticated remote code execution on database servers.

The flaw, which carries a CVSS score of 8.8, stems from composite types whose field definitions can be altered while older values remain cached elsewhere in the server. This mismatch allows an attacker to cause the server to interpret legacy data under a new type, potentially leading to arbitrary code execution with the privileges of the operating system user running PostgreSQL.

Security researcher Mehmet Ince published a technical write-up detailing a working exploit demonstrated on PostgreSQL 18.6. The technique involves preparing a query that holds a composite value, changing one of its field types, and then executing the query to trigger a crash followed by memory address leakage. Ince noted that the attack can be performed by a lowest-privileged login role.

All versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. Full mitigation also requires rebuilding every C-language extension, as extensions compiled against older releases may remain vulnerable. Red Hat and the project advisory indicate that an attacker needs at minimum a database login with the ability to create or modify objects.

The root cause traces to May 2004 when PostgreSQL added support for altering column types, with the final exploitation path enabled by a 2015 change. Ince privately shared proofs of concept with managed service providers including AWS, Microsoft, Google, Supabase, Databricks, and Ubicloud.

Among the remaining issues, CVE-2026-116322 allows an unauthenticated client to trigger a restart of PostgreSQL 18 servers. Several client tools also received fixes: crafted archives can cause pg_restore to execute code, and compromised sources can make psql run arbitrary commands via pg_dump tar output.

Administrators should update to the latest minor releases, rebuild extensions, restart services if not using the official unit file, and reindex databases as specified in the release announcement. The project warns against disabling the new composite_type_mismatch checks.

PostgreSQL Red Hat CVE-2026-6460 Mehmet Ince CVE-2026-116322

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

Vulns & Exploits

Check Point Security Gateways Compromised via PHP2Shell Exploits to Deploy VMware ESXi Data Wiper

Vulnerable Check Point Security Gateway instances were targeted in PHP2Shell attacks that deployed data-wiping malware on VMware ESXi hosts. The campaign began on October 30 against Israeli organizations and later expanded to multiple countries. Attackers exploited two critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 for unauthenticated remote code execution, then chained them with a zero-day tracked as CVE-2026-123039 for root access. They installed PHP webshells and the TSGA backdoor with TSProxy networking component before moving laterally to ESXi hosts using the gogo scanner. In the final stage, the destroy_v6 wiper was deployed to recursively delete data with optional zero-fill overwriting. Political messages referencing Dream Security Ltd. were left on some systems, raising false-flag concerns. Check Point linked elements to the PhiliKit framework associated with UNC5221 but could not confirm attribution.

BleepingComputerNov 13, 2026Translated from English

Vulns & Exploits

Mior and Skyfall Attacks Expose AMD SEV-SNP VMs Allowing Rogue Hosts to Steal Secrets and Modify Memory

Two new attacks named Mior and Skyfall were disclosed this week that enable a malicious hypervisor to bypass AMD SEV-SNP protections on virtual machines. Mior, developed by researchers at ETH Zurich, corrupts the Reverse Map Table during VM startup by redirecting PSP writes through a controlled PCIe device, ultimately allowing memory reads, writes, and forged attestation reports. Skyfall, a joint effort by ETH Zurich and Google, leverages Transient Scheduler Attacks to extract register values and disk encryption keys from failed VM launches without requiring BIOS modifications. Both attacks were demonstrated on AMD EPYC processors across Zen 3, Zen 4, and Zen 5 generations, with AMD issuing corresponding CVEs and firmware updates scheduled through December 2026. The flaws highlight persistent challenges in confidential computing even when hardware memory encryption is enabled.

The Hacker NewsNov 13, 2026Translated from English

Vulns & Exploits

Microsoft November 2026 Security Updates Break Printing for Complex Documents

Microsoft has warned that its November 2026 security updates are causing printing failures on both server and client Windows systems. The issue occurs when documents contain images rendered with a height or width value of zero at the selected printing resolution. These zero-dimension images are commonly used for invisible watermarks, layout anchoring, or by generation tools that insert placeholder graphics. The problem primarily affects Microsoft Word documents printed through the Windows Graphics Device Interface but can impact other applications as well. Microsoft stated it is investigating the regression and will release additional guidance when available. This marks the latest in a series of printing-related problems introduced by recent cumulative updates, including issues from March and July 2025 as well as August 2026 .NET Framework patches.

BleepingComputerNov 13, 2026Translated from English