22-year-old PostgreSQL type-confusion bug turned into RCE (CVE-2026-6460)
Spotted 2026-11-13 07:07 (UTC+8) · original event 2026-11-12 · sources: Hacker News, researcher blog (mehmetince.net) · spreading on 1 platformHeat score
Rank score: 7540% — where it sits on the charts
Discussion score: 7040% — how much people are talking about it
Cross-platform score: 3020% — how many platforms it spread to
Composite heat score:64.0rank × 0.4 + discussion × 0.4 + cross-platform × 0.2
Why it matters
A 22-year-old hole in the world's most-used open-source database - and the researcher found it by learning internals with an AI agent; managed-Postgres providers are the exposed surface.The angle
How a researcher turned a 22-year-old Postgres type-confusion primitive into RCE - and what it says about AI-assisted vulnerability researchSuggested format: Short video · for Developers, DBAs, security watchersEvidence chain
• HN #9, 112 pts/13 cmt (2026-11-13)• researcher Mehmet Ince, part 3/6 of 'Systemic Risks in the Managed PostgreSQL Industry' (published Nov 12, 2026): changing a composite-type field between prepare and execute gives a type-confusion primitive in PostgreSQL core, built into reliable memory-corruption RCE• CVE-2026-6460• distinct from CVE-2026-6471 PostGREShell (replication flaw, patched Aug 13, 2026)• researcher learned Postgres internals with an AI agent (Claude/Opus 5) as teacher• 2026-11-13 08:07 update: HN #8, 129 pts/16 cmt• 2026-11-13 09:07 update: HN #8, 138 pts/17 cmt• 2026-11-13 10:07 update: HN #10, 146 pts/21 cmt• 2026-11-13 11:07 update: HN #11, 151 pts/23 cmt• 2026-11-13 12:07 update: HN #14, 155 pts/25 cmt• 2026-11-13 13:07 update: HN #13, 158 pts/29 cmt• 2026-11-13 14:07 update: HN #15, 164 pts/30 cmt• 2026-11-13 15:07 update: HN #16, 170 pts/31 cmt• 2026-11-13 16:07 update: HN #17, 178 pts/35 cmt• 2026-11-13 17:07 update: HN #15, 190 pts/35 cmt