PostgreSQL’s November 2026 update provides versions 18.7, 17.12, 16.16, 15.20, and 14.25, alongside the second release candidate of version 19. The maintenance releases address 52 security vulnerabilities and more than 140 reported bugs. The security fixes cover serious risks including flaws that could let attackers execute arbitrary code, inject SQL, write to unintended files, bypass access controls, or expose server memory. PostgreSQL 14.25 is the final release for version 14: that branch is end-of-life and will receive no further security or bug fixes, so production users should plan an upgrade.
The bug fixes address data integrity, correctness, and reliability across indexes, backups, query planning, partitioning, replication, and SQL features. Some GIN, pg_trgm GiST, TOAST, and bpchar indexes may require reindexing after installation; the release also recommends taking a fresh full backup before continuing incremental backups. Administrators should check for and repair affected NOT NULL constraints on partitioned tables. Other significant corrections prevent corrupted or incomplete backups, missed rows or incorrect query results, crash-related data loss, and replication errors. The update also changes join-removal planning to avoid recurring problems. Because several fixes require follow-up maintenance, upgrading involves more than installing new binaries: administrators should review the release notes and complete the applicable post-update steps.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Penlink’s Webloc, which uses advertising data for surveillance, has been purchased by security agencies across multiple countries. Citizen Lab warns the system enables intrusive mass surveillance, with particular risks in authoritarian states. (citizenlab.ca)
Nvidia chips reportedly reached China in large quantities after Commerce Secretary Howard Lutnick declined to enforce export controls and failed to replace them. Lutnick should resign, the author argues, over the resulting national security risks. (nytimes.com)
DOC-foundry uses AI agents to create Sigma security detection rules, then has a simulated attacker test them. A deterministic referee checks coverage before a stakeholder review chain approves the rule and records its review trail. (github.com)
The FBI warns that the FaceStealer scheme targets cryptocurrency holders and steals their funds. Treat unsolicited offers and links with caution, and verify crypto services before sharing information or sending money. (fbi.gov)
Cloudflare’s abuse-reporting page is reportedly blank, leaving visitors unable to use the form it directs them to. The page is intended for reporting abuse hosted through Cloudflare. (news.ycombinator.com)
Home Assistant stores refresh-token secrets and signing keys in plaintext, while some tokens never expire and survive password changes. Anyone who obtains the configuration directory or a backup can retain access to the home, and restoring a backup can revive old tokens. (seclists.org)
Today's best Hacker News stories, summarized and screenshotted, one email a day.