Threat video1:00
PostgreSQL 18.7 Fixes 52 CVEs: Exploitation Status & Fix
CVE-2026-6460 lets a database user who can create objects run code as the PostgreSQL OS user; 9 detection rules, 6 IOCs and a free Splunk SPL rule.
Read the full threat intel for PostgreSQL type confusion RCE →
Chapters
- 0:00The hookOne release fixes 52 vulnerabilities.
- 0:04The storyOld bytes read as new types.
- 0:11Attack pathA low-privileged role reportedly reaches the crash.
- 0:23AttributionNo threat actor is attributed.
- 0:27Indicators of compromise2 indicators to hunt: 1 file name and 1 package name.
- 0:33MITRE ATT&CK techniques6 ATT&CK techniques, from initial access to impact.
- 0:38Remediation4 steps now: Update PostgreSQL to 18.7, 17.12, 16.16, 15.20 or 14.25.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00One release fixes 52 vulnerabilities.
0:05Old bytes read as new types.
0:07Client backends crash.
0:11A low-privileged role reportedly reaches the crash.
0:14It crashes the client backend.
0:16A variant leaks a pointer.
0:18Patches are out: update now.
0:23No threat actor is attributed. Confidence: low.
0:282 indicators to hunt: 1 file name and 1 package name.
0:336 ATT&CK techniques, from initial access to impact.
0:384 steps now: Update PostgreSQL to 18.7, 17.12, 16.16, 15.20 or 14.25.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.