Town Square · Friday, November 13, 2026
PostgreSQL fixes 22-year-old code execution flaw and 1 more
Town Square argued over two stories today: PostgreSQL patches type-confusion flaw that lets object creators run code on the server, and New York City Council passes ban on pricing set with personal data. The PostgreSQL bug, which a researcher traced back 22 years, is confirmed and fixed in the project's own advisory, and in our view the fight over whether to call it remote code execution or privilege escalation matters less than the fact that anyone allowed to create objects can run arbitrary code on the server. The New York bill is real, banning algorithmic prices built on personal data and requiring firms to explain on request which data shaped a price, but the thread's claims about specific companies' tactics are not established.
Today's board
Story 1
PostgreSQL patches type-confusion flaw that lets object creators run code on the server
A researcher's 22-year-old PostgreSQL bug is real and fixed. The debate is whether it counts as remote code execution or privilege escalation.
The PostgreSQL project's own advisory for CVE-2026-6460 states that the type confusion lets an object creator execute arbitrary code, and the NVD record matches.
Where it was argued
What people are saying
A vulnerability researcher's write-up says the author found "a 22-year-old zero-day in PostgreSQL core." The author says that type confusion produced one of the most reliable memory-corruption exploits they have seen. The post drew discussion on Hacker News and Lobsters. On Hacker News, commenters questioned whether calling it remote code execution (RCE) overstates the danger.
What holds up
The PostgreSQL project's advisory confirms that type confusion allows an object creator to execute arbitrary code as the operating system user running the database. The main route is a column type change, and other data definition operations can also reach the flaw. Versions before 18.7, 17.12, 16.16, 15.20 and 14.25 are affected.
The project published fixes on November 12, 2026, for the supported 18, 17, 16, 15 and 14 branches. PostgreSQL says these minor updates do not require a dump, reload or pg_upgrade.
An analysis by Brandefense notes the condition is object creation privilege, rather than unauthenticated access. The 22-year age is the researcher's own figure. In our reading, the core claim is confirmed: code execution is real, but it requires a logged-in role that can create objects.
Inside the threads
Several Hacker News commenters argued the bug is closer to privilege escalation, where a database account becomes full access to the server. Another replied that the bug is reachable from the lowest-privileged roles, not only a superuser. One commenter cited a Shodan search showing about 516,000 exposed PostgreSQL results, well short of the millions of affected businesses another commenter feared. A long exchange debated whether storing a value's type apart from the value is "wrong by construction" or a sensible performance choice. On Lobsters, a commenter said the investigation was assisted by a large language model but the post text looks hand-written. One Hacker News commenter guessed MySQL and MariaDB will follow soon, which we read as speculation.
Our take
We think the RCE-versus-escalation argument is a labeling fight that misses the operational point. In our reading, any role that can create objects should be treated as a path to the database host's operating system account until patched. That puts managed and multi-tenant platforms, shared analytics clusters and applications whose service accounts own their schemas at the front of the queue. The fear of millions of exposed businesses looks overblown to us. The underrated risk is the inside path, where one stolen application credential becomes a foothold on the server. Our take is that the end of PostgreSQL 14 matters as much as the fix, since 14.25 is the final release of that branch.
What to do
- Check the server version each running instance reports after restart, not only the installed package version.
- Review object creation grants and investigate unexpected schema changes alongside database service and host activity.
- For distribution packages, confirm the maintainer's security notice for a backported fix before marking them remediated.
- Plan a supported major-version upgrade for production PostgreSQL 14 deployments after applying the available fix.
What the verdict rests on (4 sources)
- Part 3/6 | How I Ended Up Turning a 22-Year-Old PostgreSQL Type-Confusion Primitive into RCE (CVE-2026-6460) - Mehmet Ince @mdisec - Vulnerability Researcher | Building security products | Security Ad · Mehmet Ince @mdisec - Vulnerability Researcher | Building security products | Se
- CVE-2026-6460 detail · National Vulnerability Database (NIST) · primary source
- PostgreSQL: CVE-2026-6460: PostgreSQL type confusion after ALTER ... SET DATA TYPE executes arbitrary code · postgresql.org · primary source
- CVE-2026-6460: PostgreSQL Type Confusion, Fix Status · Brandefense
Story 2
New York City Council passes ban on pricing set with personal data
The bill bans algorithmic prices built on personal data and requires firms to explain, on request, which data shaped a price.
Gothamist reports the vote with on-record quotes and the Council's legislative record carries the bill text, but thread claims about specific companies' tactics are not established.
Where it was argued
What people are saying
A Gothamist report that the New York City Council banned so-called surveillance pricing spread on social media, including a Hacker News thread. Commenters there pointed out that New York State had acted in June and said the personal-data element is the new part. Much of the discussion turned to whether the ban will reach ride-hailing companies, Uber in particular.
What holds up
Gothamist reports that the Council passed a bill Thursday banning companies in the city from using surveillance pricing. The city would be able to fine up to $1,000 for each transaction that violates the ban. Mayor Zohran Mamdani said in a statement that he supports it.
The bill text defines the practice as pricing set fully or partly by an algorithm that uses personal data to offer different customers different prices for the same goods or services. It permits bona fide discounts that are generally available without the use of personal data. Enforcement would sit with the Department of Consumer and Worker Protection (DCWP).
Two provisions matter to security teams. Covered firms must maintain procedures that let consumers learn what personal data was considered in setting a price, and how. Those procedures and the underlying personal data must be made available to DCWP electronically on request. A first-time violator gets 30 days to show it has corrected the problem.
This sits on top of state law. New York's Algorithmic Pricing Disclosure Act took effect on November 10, 2025, and requires disclosure when personal data is used to set individualized prices. The Council has said the bills would make New York the first city with such protections.
What the reporting does not establish is how any named company prices its services. Gothamist notes that many companies that faced scrutiny have denied using the practice. Our verdict: partly confirmed.
Inside the threads
One commenter alleged that Uber prices on signals such as phone type and battery life. Another replied that the battery claim had been denied and disproven, and we would treat it as unsupported. An economics argument followed: one commenter called price controls a net welfare loss, others defended targeted rules. One commenter described the practice as "a personalized form of price gouging."
Our take
We think this is a data governance story more than a pricing story. In our reading, the access and production duties mean a company must be able to trace which personal data fields fed a given price, and that requires data lineage that most pricing and promotion stacks lack. That same trace becomes a new export of personal data to a regulator, and it needs the same controls as any other sensitive transfer. The Uber battery-life debate is a distraction. In our reading, the underrated risk sits with loyalty and personalized-offer programs, because the discount carve-out depends on the offer being available without personal data. Expect the business-group argument about discounts to shape how DCWP writes its rules.
What to do
- Inventory pricing, promotion and personalization systems that serve New York customers, and map which personal data fields each one consumes.
- Ask legal and product teams to test current personalized offers against the bona fide discount definition.
- Design a secure, logged process for answering consumer pricing-data requests and producing records to DCWP.
- Confirm that state disclosure obligations are already met where algorithmic pricing uses personal data.
What the verdict rests on (4 sources)
- NYC Council passes ban on · Gothamist
- The New York City Council - File #: Int 0891-2026 · legistar.council.nyc.gov · primary source
- NYC Council Holds Hearing on Legislation to Protect New Yorkers from Dynamic and Surveillance Pricing · Press · primary source
- Attorney General James Demands Answers from Instacart about Algorithmic Pricing · New York State Attorney General · primary source
How Town Square works
Every day we read what the security community is discussing on Hacker News, Reddit, Mastodon and Lobsters, and what search shows of the conversation on X. For each story we check the claim against primary sources, give a verdict, digest what the threads said, and say what we think.
The CISO Tribune briefing
Every verified CISO move and one piece of analysis, weekly.
Unsubscribe any time. See the privacy policy.