CVE-2026-6460 is a type-confusion vulnerability in PostgreSQL’s core server that can let a database object creator execute arbitrary code with the operating-system privileges of the database process. The main attack route involves changing a column’s type with ALTER ... SET DATA TYPE, though other DDL sequences can also trigger the flaw, including adding a column, rolling back, and adding a column again. The underlying weakness is that PostgreSQL did not adequately track typed values, and those values did not identify their own types. As a result, stale values could be reused in data dictionary entries, PL/pgSQL variables, and other parts of the system.
Successful exploitation can compromise the confidentiality, integrity, and availability of the database host, rather than being limited to manipulating database records. The vulnerability has a CVSS 3.0 score of 8.8, with network access and low privileges required; it does not require user interaction. Affected releases are PostgreSQL 18 before 18.7, 17 before 17.12, 16 before 16.16, 15 before 15.20, and 14 before 14.25. Fixes for all listed branches were published on November 12, 2026. Administrators using an affected release should upgrade to the corresponding fixed version.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Penlink’s Webloc, which uses advertising data for surveillance, has been purchased by security agencies across multiple countries. Citizen Lab warns the system enables intrusive mass surveillance, with particular risks in authoritarian states. (citizenlab.ca)
Nvidia chips reportedly reached China in large quantities after Commerce Secretary Howard Lutnick declined to enforce export controls and failed to replace them. Lutnick should resign, the author argues, over the resulting national security risks. (nytimes.com)
DOC-foundry uses AI agents to create Sigma security detection rules, then has a simulated attacker test them. A deterministic referee checks coverage before a stakeholder review chain approves the rule and records its review trail. (github.com)
The FBI warns that the FaceStealer scheme targets cryptocurrency holders and steals their funds. Treat unsolicited offers and links with caution, and verify crypto services before sharing information or sending money. (fbi.gov)
Cloudflare’s abuse-reporting page is reportedly blank, leaving visitors unable to use the form it directs them to. The page is intended for reporting abuse hosted through Cloudflare. (news.ycombinator.com)
Home Assistant stores refresh-token secrets and signing keys in plaintext, while some tokens never expire and survive password changes. Anyone who obtains the configuration directory or a backup can retain access to the home, and restoring a backup can revive old tokens. (seclists.org)
Today's best Hacker News stories, summarized and screenshotted, one email a day.