PostgreSQL Archives

Tech Optimizer

September 11, 2026

12-Year-Old PostgreSQL Flaw Lets Attackers Execute Code on Database Servers

A PostgreSQL vulnerability identified as CVE-2026-6471, known as PostGREShell, allows attackers with minimal replication access to execute arbitrary code on database servers. This flaw has existed for approximately 12 years and affects non-superuser PostgreSQL accounts with the REPLICATION attribute, commonly used for backup and replication tasks. The vulnerability arises from inadequate restrictions on the library path specified as an output plugin name, enabling an attacker to exploit the logical decoding feature to load a malicious library. Exploitation requires only a PostgreSQL account with REPLICATION privileges, wal_level set to logical, and access to SMB port 445. The flaw was discovered by Cyera Research and dates back to PostgreSQL 9.4's release in 2014. Patches have been released for versions 18.6, 17.11, 16.15, 15.19, and 14.24, and organizations are advised to upgrade to these versions. Database administrators should audit accounts with the REPLICATION attribute and restrict replication connections. Limiting outbound network access and monitoring logical replication activity is also recommended to mitigate risks.

Tech Optimizer

September 11, 2026

Tom Lane on the Architectural Decisions That Shaped 30 Years of Postgres

Tom transitioned from image processing to database management, particularly contributing to the Postgres project. He was part of a group that created an open-source implementation of JPEG, leading to the development of libjpeg, where he served as the principal maintainer for about five years. NASA's Perseverance rover uses libjpeg, a fact discovered by Joe Conway through research. Tom noted that the widespread adoption of JPEG was due to its efficient compression and the availability of a free implementation, which aided its integration into early web browsers. His interest in Postgres was influenced by its liberal licensing model, similar to that of libjpeg. Tom's commitment to open-source projects stems from his passion for collaborative software development, which began during his graduate studies in the 1980s. His PhD focused on software architecture, shaping his approach to both image processing and database management.

Tech Optimizer

September 11, 2026

Improving Lakebase Postgres compute cache

Lakebase Postgres employs a disaggregated storage model that enhances data management through efficient caching, utilizing an object store like S3 for backups. The caching operates on two layers: within distributed storage for optimizing write and read performance, and on the Postgres compute side for ultra-fast access to frequently accessed pages. Traditional Postgres caching involves shared buffers and the OS page cache, which leads to double buffering and inefficiencies. Lakebase Postgres addresses these issues by implementing a local file cache (LFC) and larger shared buffers, allowing for more effective memory utilization without the drawbacks of the OS page cache. The shared buffers are set to a maximum of 1 GB, while the LFC can utilize up to 75% of DRAM. The introduction of huge pages reduces memory management overhead and improves performance, resulting in significant throughput increases and reduced latency in production environments. Recent enhancements have shown up to 2× throughput improvements and substantial reductions in CPU usage. The focus is now on extending these benefits to autoscaling Postgres computes, with plans to implement dynamic shared buffers and autoscaling huge pages.

Tech Optimizer

September 4, 2026

Object Storage + WAL: Lakebase Postgres for the agentic era

Agents interacting with traditional OLTP databases face bottlenecks at the storage layer due to data movement required for operations like deploying instances and managing replicas. Object storage solutions, such as Amazon S3, provide a more efficient and cost-effective alternative. The text discusses two OLTP models: data-centric and transaction-centric. The transaction-centric model emphasizes the importance of transaction history, which Postgres retains through its write-ahead log (WAL). The WAL records every modification before it is committed, allowing for the reconstruction of the database state as of a specific point in time. Lakebase Postgres introduces a two-layer architecture separating compute and storage. The compute layer handles SQL operations, while the storage layer ensures data durability and historical integrity. The WAL is streamed to safekeepers for replication, and the pageserver transforms WAL into materialized pages stored in object storage. This architecture allows for efficient read and write operations without direct interaction with object storage during queries. Key features of Lakebase Postgres include branching, which allows agents to create pointers to specific LSNs without copying data; instant restore capabilities that enable point-in-time recovery; time travel queries for accessing historical data; and read replicas that do not require data duplication. The system also supports scaling down idle compute nodes and eliminates the need for separate copies of data for transactional and analytical processing by storing a single durable copy in object storage. Overall, Lakebase Postgres enhances agent interactions with the database by leveraging object storage as a foundational element.

Tech Optimizer

September 4, 2026

12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover

A significant vulnerability in PostgreSQL, tracked as CVE-2026-6471, has been identified by cybersecurity firm Cyera. This flaw, present since 2014, allows attackers with minimal privileges to potentially take control of databases and servers. The vulnerability, known as PostGREShell, has a CVSS score of 7.2 and can be exploited for remote code execution and privilege escalation due to a missing authorization in the database's logical decoding mechanism. Attackers with 'Replication' privileges can load arbitrary files through the logical decoding plugin, executing code with the privileges of the postgres system user. This can lead to the elevation of privileges to superuser status, granting unrestricted access to all tables and the ability to execute operating system commands. All PostgreSQL versions from 9.4 to 18 are affected, with a patch available in versions 18.6, 17.11, 16.15, 15.19, and 14.24. Organizations are advised to update their PostgreSQL instances and audit their Replication accounts.

Tech Optimizer

September 4, 2026

Decade-old PostgreSQL flaw turns backup account into a backdoor

The vulnerability CVE-2026-6471 affects PostgreSQL installations on Windows, Linux, and macOS, impacting versions since 9.4 released in 2014. All supported releases have been patched, including versions 18.6, 17.11, 16.15, 15.19, and 14.24, updated on August 13. The vulnerability arises from PostgreSQL's management of output plugins for logical replication, which are dynamically loaded compiled code, leading to insufficient existing security measures.

Tech Optimizer

September 4, 2026

EDB Postgres® AI Gains Momentum as Customers Tell Us the Future of Their Own AI and Data Platform

Organizations are increasingly aiming to establish their own governed AI and data platforms, with 95% of enterprises planning to develop such platforms within the next three years, though only 13% have done so. EDB has reported significant traction for its EDB Postgres® AI (EDB PG AI) platform, which unifies transactional, analytical, and agentic workloads into a single system. PAC 2000A Conad has revamped its data infrastructure using EDB PG AI to support over 1,600 stores and 7,000 connected devices, ensuring compliance with NIS2 regulations. C Platform in Korea is experiencing a surge in demand for hybrid and on-premises capabilities, driven by significant investment in sovereign AI and the AI Basic Act mandating governance for AI deployment. Notable adopters of EDB PG AI include the Industrial Bank of Korea, Shinhan EZ Insurance, NTT East, MNTN, Euronext FX, and Kyobo Book Centre.

Tech Optimizer

September 4, 2026

EDB Highlights Postgres AI Growth in Regulated Enterprise Markets

EnterpriseDB (EDB) has reported advancements in the adoption of its EDB Postgres AI (EDB PG AI) platform, which integrates transactional, analytical, and AI workloads. While 95% of enterprises aspire to become their own AI and data platforms within three years, only 13% have achieved this. EDB PG AI supports existing systems and prepares enterprises for future AI capabilities. A case study highlights PAC 2000A Conad, which restructured its data infrastructure with EDB PG AI, serving over 1,600 stores and 7,000 devices. In Korea, over billion has been invested in the sovereign AI market, with organizations seeking hybrid and on-premises solutions despite challenges from fragmented data environments. Notable users of EDB PG AI include the Industrial Bank of Korea and Shinhan EZ Insurance. EDB PG AI is built on Postgres and allows enterprises to optimize data and AI capabilities with governance at the data layer.

Tech Optimizer

September 2, 2026

Connecting My LangGraph AI Agent to Postgres

A stateful LangGraph agent was developed to streamline a 15-minute booking process, mimicking a customer service representative. It features a user-friendly Streamlit UI and a backend powered by a Postgres database. The agent can respond to customer queries, calculate service prices, manage acceptance or rejection of services, propose appointment time slots, and confirm booking details. The agent operates in two persistence modes: in-memory for quick testing and Postgres for durability. Testing can be conducted locally with Streamlit or using Docker to simulate a production environment. Docker allows the application to interact with a PostgreSQL server without local installation, enhancing reproducibility. The project includes a docker-compose.yml file to initiate a PostgreSQL container, and users can also utilize a cloud-based Postgres solution. The application behavior remains consistent regardless of the database setup. The complete source code is available on GitHub for testing and further enhancements.

Tech Optimizer

September 1, 2026

Connecting My LangGraph AI Agent to Postgres

A stateful LangGraph agent was developed to streamline a 15-minute booking process, featuring a user-friendly Streamlit UI and a backend powered by a Postgres database. The agent responds to customer queries, calculates service pricing, manages service acceptance, suggests time slots, and confirms appointment details. It operates in two modes: in-memory for rapid testing and Postgres for persistent storage. Testing can be done locally using Docker, which simulates a Postgres environment, or with a hosted Postgres instance. The project includes a docker-compose.yml file to initiate a PostgreSQL 16 container, allowing the application to connect to the database. Data persistence is ensured through Docker volumes, and the application can be run with specific commands after setting up the environment variables. The system has been tested successfully, demonstrating its ability to manage bookings and maintain data integrity across sessions. Future enhancements are planned to improve the booking workflow and integrate additional communication channels.