The vulnerability stems from how the database represents internal information using generic eight-byte structures known as Datums, which do not identify the data types they carry. By assigning a value in a composite type, changing a field type, and forcing a read, an attacker triggers memory corruption. This discovery expanded on previous research conducted in June and July that identified memory-corruption bugs within database extensions. During that earlier study, the researcher achieved code execution in the pg_clickhouse extension using value-conversion errors.
Key points
Manipulating field types within composite structures allows attackers to induce memory co…: Manipulating field types within composite structures allows attackers to induce memory corruption and achieve remote code execution.
Security analysis of third-party extensions revealed underlying architectural risks embed…: Security analysis of third-party extensions revealed underlying architectural risks embedded in the core database engine.
The vendor patched an out-of-bounds write and read chain in pg_clickhouse on June 23 prio…: The vendor patched an out-of-bounds write and read chain in pg_clickhouse on June 23 prior to the core flaw discovery.
Sources checked by our analysis pipeline: 1
If you had told me in April 2026 one question “Mehmet, can we use managed PostgreSQL for this project?” would send me into the deepest rabbit hole of my life, I would have laughed.
Months later, I finally found the bottom of that rabbit hole. It was a 22-year-old zero-day in PostgreSQL core.
In this blog post you will read a story of how I ended up uncovering a new class of type-confusion vulnerabilities in PostgreSQL.
This is the 3rd part of blog post series named “Systemic Risks in the Managed PostgreSQL Industry”. For those who have missed the first two part, feel free to start from 1st and 2nd which will give you a complete context of this madness.
TLDR:
I gave PostgreSQL a value inside a composite type, changed the type of one of its fields, and asked it to read the value back. That type confusion led to one of the most reliable memory-corruption exploit I have seen. But I did not start by looking for a PostgreSQL core vulnerability.
Multiple core enterprise services, including Outlook, Teams, and Copilot, suffered worldwide disruptions on Thursday due to unexpected server failures. The incident increased the load on the company's remaining infrastructure after systems failed automated health checks and dropped offline. Technicians restarted the affected servers and deployed configuration tests to restore normal operations across affected global regions.
A private intelligence investigation has revealed that an alleged Chinese operative maintained simultaneous business links to Nvidia and state-backed rival Huawei while engaged in a personal relationship with Nvidia's ousted leader. Through a network of intermediary entities, she reportedly enabled the transfer of advanced computing power directly to Chinese enterprises. These maneuvers have heightened regulatory scrutiny regarding potential breaches of international trade restrictions.
The upcoming broadcast will focus on evaluating the physical resilience of remote computing infrastructure against modern aerial threats. Industry observers and technical experts are increasingly examining how secure server facilities truly are during hostile physical attacks. This session will address how modern data architecture might endure targeted aerial disruptions.