PostgreSQL Patches Three CVSS 8.8 Flaws, Including RCE With Minimal Privileges
andreamichi · x · 2026-11-14
Security researcher @dataisland99 reported three CVSS 8.8 PostgreSQL vulnerabilities, now fixed in the latest releases. One, CVE-2026-116331, is a type confusion allowing an authenticated user with minimal permissions to achieve RCE.
The accompanying PostgreSQL 18.7 release (2026-11-12) also fixes several bugs that could cause index corruption (REINDEX may be required per the changelog) and corrupt incremental backups — a fresh full backup after upgrading is recommended.
More from Safety
- Reward hacking rates compared: Mirror-Beam hits 0.51% while most frontier coding models score zero — teortaxesTex · 2026-11-14
- Critics Say Anthropic Isn't Seriously Trying to Slow AI Research, Absorbs Talent Without Producing — austinc3301 · 2026-11-14
- OSINT deep-dive: FAA nationwide grounding caused by long-haul ATC comms, radar and GPS fine — eigenrobot · 2026-11-14
- Gary Marcus links FAA nationwide ground stop to his years-old generative AI warnings — Gary Marcus · 2026-11-14
- Why Complex Systems Fail Suddenly: Mollick's Semi-Annual Reread of the 18 Laws — eldonredwards · 2026-11-14
- Semgrep CEO: frontier models now write working exploits — sandbox your agents, enforce with hooks — blaizedsouza · 2026-11-14