Pstgre Archives

Tech Optimizer

September 28, 2026

What Is Happening with PostgreSQL 19?

Postgres 19 is experiencing delays in its release schedule, with Beta 4 scheduled for September 24, 2026. The development team is prioritizing quality over timelines, leading to the reversion of 53 significant features during the beta phase. Notable feature reversions include SQL Property Graph Queries, ALTER TABLE MERGE/SPLIT PARTITION(S), UPDATE/DELETE FOR PORTION OF, GROUP BY ALL, a change to default TOAST compression, nontext output formats for pg_dumpall, JSON_TABLE ON ERROR cascading, fast defaults for domains with nonvolatile constraints, logical replication database-specific snapshots, nested query tracking, and online data checksums. The majority of these reversions are due to design flaws, incorrect results, or compatibility issues. There are also at-risk features identified, including RI fast-path FK checks, REPACK / REPACK CONCURRENTLY, and Postgres_fdw statistics import. Despite these challenges, promising features such as pg_plan_advice, parallel autovacuum, ON CONFLICT DO SELECT, and logical replication enhancements are still anticipated in PG19. AI tools are being utilized in the development process to identify bugs and create test cases. Postgres 18 remains a reliable upgrade target, while features like property graphs and GROUP BY ALL are now planned for PG20.

Tech Optimizer

September 28, 2026

The Fault Line Spreads: Azure’s September CVE Cluster Now Covers PostgreSQL and Billing

Two newly identified Critical CVEs have expanded Microsoft's September identity infrastructure vulnerabilities to over ten verified weaknesses across more than ten distinct services. The Azure Database for PostgreSQL is vulnerable to CVE-2026-85878, an Improper Authorization flaw (CWE-285) with a CVSS score of 9.9. Azure Billing is impacted by CVE-2026-62874, which presents an Insufficient Data Authenticity Verification issue (CWE-345) with a CVSS score of 10.0. Both vulnerabilities were disclosed on September 18 and validated by Tenable and MITRE. CVE-2026-85878 allows an authorized attacker to elevate privileges over the network with minimal complexity, while CVE-2026-62874 requires no authentication, enabling unauthenticated attackers to jeopardize financial integrity. The vulnerability cluster first emerged during the Patch Tuesday cycles on September 3 and September 8, with initial reports highlighting critical flaws in core services. Other September disclosures include CVE-2026-83711 (Azure AD B2C, CVSS 10.0), CVE-2026-70352 (Azure AI Language, CVSS 10.0), CVE-2026-83941 (Entra ID, CVSS 9.9), CVE-2026-62916 (Entra ID, CVSS 9.1), CVE-2026-69857 (Azure Cosmos DB, CVSS 8.5), and CVE-2026-69854 (Spring Cloud Azure, CVSS 9.0). Activity heightened between September 17 and 18 with the introduction of CVE-2026-77903 (Microsoft Dataverse, CVSS 9.0) and CVE-2026-69843 (Microsoft Fabric, CVSS 10.0). The attack surface has broadened from authentication concerns to encompass trust in AI endpoints, data storage locations, and billing verification processes. Seven out of the ten vulnerabilities are unauthenticated, and all issues were addressed through server-side fixes by Microsoft. The extensive range of affected services suggests these vulnerabilities indicate a shared architectural dependency on authentication logic.

Tech Optimizer

September 28, 2026

Postgres Women India: Driving Diversity And Innovation In Open Source

Postgres Women India was launched in 2023 as a corporate social responsibility initiative under OpenSource DB, starting with 10 members and growing to over 2000 women across more than 70 countries. The community addresses the underrepresentation of women in open source and database conferences, aiming to empower, connect, and celebrate women in technology. Its core pillars include community building, nurturing future leaders, and advocating for education. The community organizes virtual and in-person meetups, mentorship programs, and collaborates with universities to enhance skills in database technologies. Key initiatives include a Career Connect Day, intensive upskill programs, and the Women for Data Summit. The community has recognized 18 women as ‘Postgres Women of the Month’ and highlighted emerging contributors. Partnerships with organizations like Google and YugaByteDB support its efforts, and it seeks further community involvement to establish local chapters and host events.

Tech Optimizer

September 28, 2026

Spinnaker launches PostgreSQL support & migration services

Spinnaker Support has launched a suite of PostgreSQL support and migration services to help organizations reduce their reliance on Oracle databases. The services include enterprise software support for PostgreSQL and migration services facilitated by HexaCluster, allowing customers to maintain their Oracle environments while transitioning workloads to PostgreSQL. Spinnaker is also developing an enterprise distribution for PostgreSQL, built around standard PostgreSQL and open-source components. The support package includes break-fix support, troubleshooting, security guidance, performance and configuration support, and lifecycle guidance. The migration service analyzes Oracle database dependencies, automates parts of the conversion process, validates production readiness, and facilitates controlled cutovers. The HexaRocket platform from HexaCluster aids in migration, data movement, and replication. The launch aligns with a trend of organizations reassessing database expenditures, with 55.6% of developers using PostgreSQL according to the 2025 Stack Overflow Developer Survey. Spinnaker aims to enhance its role in enterprise infrastructure decisions by supporting both Oracle and PostgreSQL environments. Martin Biggs has been appointed Vice President and General Manager of the PostgreSQL Practice, overseeing PostgreSQL support and migration services. Spinnaker's PostgreSQL offerings are part of its Run, Optimize, Transform framework, designed to help customers manage current systems and plan for long-term changes.

Tech Optimizer

September 11, 2026

12-Year-Old PostgreSQL Flaw Lets Attackers Execute Code on Database Servers

A PostgreSQL vulnerability identified as CVE-2026-6471, known as PostGREShell, allows attackers with minimal replication access to execute arbitrary code on database servers. This flaw has existed for approximately 12 years and affects non-superuser PostgreSQL accounts with the REPLICATION attribute, commonly used for backup and replication tasks. The vulnerability arises from inadequate restrictions on the library path specified as an output plugin name, enabling an attacker to exploit the logical decoding feature to load a malicious library. Exploitation requires only a PostgreSQL account with REPLICATION privileges, wal_level set to logical, and access to SMB port 445. The flaw was discovered by Cyera Research and dates back to PostgreSQL 9.4's release in 2014. Patches have been released for versions 18.6, 17.11, 16.15, 15.19, and 14.24, and organizations are advised to upgrade to these versions. Database administrators should audit accounts with the REPLICATION attribute and restrict replication connections. Limiting outbound network access and monitoring logical replication activity is also recommended to mitigate risks.

Tech Optimizer

September 11, 2026

Tom Lane on the Architectural Decisions That Shaped 30 Years of Postgres

Tom transitioned from image processing to database management, particularly contributing to the Postgres project. He was part of a group that created an open-source implementation of JPEG, leading to the development of libjpeg, where he served as the principal maintainer for about five years. NASA's Perseverance rover uses libjpeg, a fact discovered by Joe Conway through research. Tom noted that the widespread adoption of JPEG was due to its efficient compression and the availability of a free implementation, which aided its integration into early web browsers. His interest in Postgres was influenced by its liberal licensing model, similar to that of libjpeg. Tom's commitment to open-source projects stems from his passion for collaborative software development, which began during his graduate studies in the 1980s. His PhD focused on software architecture, shaping his approach to both image processing and database management.

Tech Optimizer

September 11, 2026

Improving Lakebase Postgres compute cache

Lakebase Postgres employs a disaggregated storage model that enhances data management through efficient caching, utilizing an object store like S3 for backups. The caching operates on two layers: within distributed storage for optimizing write and read performance, and on the Postgres compute side for ultra-fast access to frequently accessed pages. Traditional Postgres caching involves shared buffers and the OS page cache, which leads to double buffering and inefficiencies. Lakebase Postgres addresses these issues by implementing a local file cache (LFC) and larger shared buffers, allowing for more effective memory utilization without the drawbacks of the OS page cache. The shared buffers are set to a maximum of 1 GB, while the LFC can utilize up to 75% of DRAM. The introduction of huge pages reduces memory management overhead and improves performance, resulting in significant throughput increases and reduced latency in production environments. Recent enhancements have shown up to 2× throughput improvements and substantial reductions in CPU usage. The focus is now on extending these benefits to autoscaling Postgres computes, with plans to implement dynamic shared buffers and autoscaling huge pages.

Tech Optimizer

September 4, 2026

Object Storage + WAL: Lakebase Postgres for the agentic era

Agents interacting with traditional OLTP databases face bottlenecks at the storage layer due to data movement required for operations like deploying instances and managing replicas. Object storage solutions, such as Amazon S3, provide a more efficient and cost-effective alternative. The text discusses two OLTP models: data-centric and transaction-centric. The transaction-centric model emphasizes the importance of transaction history, which Postgres retains through its write-ahead log (WAL). The WAL records every modification before it is committed, allowing for the reconstruction of the database state as of a specific point in time. Lakebase Postgres introduces a two-layer architecture separating compute and storage. The compute layer handles SQL operations, while the storage layer ensures data durability and historical integrity. The WAL is streamed to safekeepers for replication, and the pageserver transforms WAL into materialized pages stored in object storage. This architecture allows for efficient read and write operations without direct interaction with object storage during queries. Key features of Lakebase Postgres include branching, which allows agents to create pointers to specific LSNs without copying data; instant restore capabilities that enable point-in-time recovery; time travel queries for accessing historical data; and read replicas that do not require data duplication. The system also supports scaling down idle compute nodes and eliminates the need for separate copies of data for transactional and analytical processing by storing a single durable copy in object storage. Overall, Lakebase Postgres enhances agent interactions with the database by leveraging object storage as a foundational element.

Tech Optimizer

September 4, 2026

12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover

A significant vulnerability in PostgreSQL, tracked as CVE-2026-6471, has been identified by cybersecurity firm Cyera. This flaw, present since 2014, allows attackers with minimal privileges to potentially take control of databases and servers. The vulnerability, known as PostGREShell, has a CVSS score of 7.2 and can be exploited for remote code execution and privilege escalation due to a missing authorization in the database's logical decoding mechanism. Attackers with 'Replication' privileges can load arbitrary files through the logical decoding plugin, executing code with the privileges of the postgres system user. This can lead to the elevation of privileges to superuser status, granting unrestricted access to all tables and the ability to execute operating system commands. All PostgreSQL versions from 9.4 to 18 are affected, with a patch available in versions 18.6, 17.11, 16.15, 15.19, and 14.24. Organizations are advised to update their PostgreSQL instances and audit their Replication accounts.

Tech Optimizer

September 4, 2026

Decade-old PostgreSQL flaw turns backup account into a backdoor

The vulnerability CVE-2026-6471 affects PostgreSQL installations on Windows, Linux, and macOS, impacting versions since 9.4 released in 2014. All supported releases have been patched, including versions 18.6, 17.11, 16.15, 15.19, and 14.24, updated on August 13. The vulnerability arises from PostgreSQL's management of output plugins for logical replication, which are dynamically loaded compiled code, leading to insufficient existing security measures.