Topic
PostgreSQL
Data Masking: 8 Critical Questions Businesses and Developers Ask About Protecting Sensitive Data
Privacy & Surveillance
pg_anon Open-Source Tool Receives Major Updates for PostgreSQL Data Masking and Partial Database Operations
Privacy & Surveillance
OTUS Publishes September Digest of Free Lessons on Linux Administration, PostgreSQL, CI/CD and Infrastructure Security
OtherAttackers Exploit Critical Sangoma Switchvox SQL Injection Flaw CVE-2026-9586 to Deploy Reverse Shells Without Credentials
A critical vulnerability in Sangoma Switchvox allows unauthenticated remote code execution through SQL injection in the /pa HTTP endpoint. The flaw, tracked as CVE-2026-9586 with a CVSS score of 9.3, affects internet-exposed VoIP deployments common in SMB environments. Attackers have already leveraged the issue in active campaigns since August 30, 2026, to open reverse shells and perform reconnaissance using Base64-encoded commands. The root cause is improper handling of the PhoneIP parameter in PostgreSQL queries, classified as CWE-89, which grants superuser database privileges. Sangoma released the fix in Switchvox 8.4.0.2 on July 14, 2026, following initial disclosure in April. Administrators are urged to patch immediately, restrict access, and monitor for indicators such as connections to 176.65.148.184 and suspicious entries in /var/log/switchvox/db-quirks.log.
Weekly Roundup: Next.js Leads Critical Vulnerability Reports as Chrome, Tomcat, and PostgreSQL See Major Patches
Security NEXT has published its list of the ten most-read articles for the week of August 23-29, 2026. The top story covered multiple serious vulnerabilities in Next.js that prompted an accelerated release schedule. Other high-interest items included a critical flaw in Zscaler Client Connector, several issues in Apache Tomcat rated critical, and Google’s Chrome 152 update fixing 327 vulnerabilities. Additional reports highlighted a ransomware incident at a systems development firm, flaws in SKYSEA Client View, 28 vulnerabilities fixed in PostgreSQL, and confirmed exploitation of six known flaws in SQL Server and NetScaler. The list also featured a vulnerability in the Android version of the Digital Agency’s My Number Point app and warnings about active exploitation of a WebLogic module flaw.
Deleted Database Records Remain Recoverable in SQLite Files Despite DELETE Operations
A standard DELETE query in SQLite removes rows from the table view but leaves the actual data intact inside the database file until pages are reused. The pragma secure_delete setting controls whether freed pages are zeroed immediately or simply marked as available. With the default setting of 0, strings containing names and credit card numbers can still be extracted using grep even after deletion. The same behavior appears in PostgreSQL through dead row versions until VACUUM runs and in MySQL InnoDB through undo logs and the binary log. The issue directly affects compliance with personal data deletion requests because backups, replicas, and analytics exports often retain the original records. Proper mitigation requires enabling secure_delete, running VACUUM after bulk deletions, or encrypting sensitive fields with per-record keys that can be destroyed on request.
Bitrix24 Releases Fully On-Premise BI Constructor for Regulated Enterprises
Bitrix24 has introduced a new delivery model for its BI Constructor that allows complete deployment inside a customer's own infrastructure. The update eliminates any requirement for external servers, cloud APIs, or internet connectivity, ensuring that all corporate data remains within the organization's closed perimeter. Previously, even the boxed version of the platform needed access to external infrastructure for updates and auxiliary services, creating conflicts with internal security policies and regulatory demands in highly regulated sectors. The new on-premise variant performs all data processing and storage exclusively on customer servers, giving organizations full control over access rights, backups, updates, and integration with internal protection tools. The solution is compatible with the boxed edition of Bitrix24 running on PostgreSQL and does not connect to external CDNs or cloud services. Bitrix24 expects strong interest from large enterprises and organizations handling restricted-access data that must stay inside the corporate network. Pilot implementations have already been completed, with broader customer pilots planned in the coming months.
PostgreSQL Releases Security Update Fixing 28 Vulnerabilities and Over 110 Bugs
The PostgreSQL development team issued a major security update on August 13, 2026, addressing 28 vulnerabilities along with more than 110 bugs. While no issues reached a CVSSv3.1 base score of 9.0 or higher, 18 vulnerabilities scored 7.0 or above, with 14 rated at 8.8. Several flaws enable arbitrary code execution, including heap buffer overflows in regular expression processing and the to_char function. Additional fixes cover heap buffer overflows in pg_stat_statements and pg_dump, type confusion issues, and an SQL injection vulnerability. The update resolves specific CVEs such as CVE-2026-14664, CVE-2026-14669, CVE-2026-14670, CVE-2026-16238, CVE-2026-16239, and CVE-2026-15741.
pgAdmin 4 Issues Critical Security Update Addressing Seven Vulnerabilities Including Prior Patch Failures
The pgAdmin 4 development team has released version 9.17 to resolve seven vulnerabilities in the popular PostgreSQL database management tool. The update covers two newly discovered issues rated Critical, one Critical flaw stemming from incomplete remediation in the previous 9.16 release, and four additional vulnerabilities. Among the new flaws is CVE-2026-17566, an OS command injection vulnerability in the query-based data export feature caused by insufficient SQL validation. Another Critical issue, CVE-2026-17349, allows duplication of shared servers to inadvertently copy stored database credentials belonging to other users. The incomplete fix for CVE-2026-12045 led to CVE-2026-17351, which bypasses the read-only restrictions of the AI Assistant due to differing string literal interpretations between the SQL parsing library and PostgreSQL.
Dell Releases Security Update for PowerProtect Data Manager Fixing 359 Vulnerabilities
Dell has issued a security update for its data protection solution Dell PowerProtect Data Manager to address a total of 359 vulnerabilities. The company published security advisory DSA-2026-287 on July 14, 2026, rating the issues as Critical and urging users to apply the fixes immediately. Six product-specific flaws were resolved, including CVE-2026-40712 in the REST API that allows privilege escalation after input validation bypass and CVE-2026-49499 stemming from improper security token generation. The remaining four native vulnerabilities received CVSS v3.1 base scores between 6.0 and 7.2. In addition, 353 third-party component vulnerabilities were patched, covering 130 issues in the Linux kernel along with flaws in Apache Log4j, Apache Tomcat, Samba, PostgreSQL, OpenSSL, glibc, and Vim. Administrators are advised to upgrade to version 20.2.0.0 or later to mitigate the risks.
OTUS Publishes Extensive Digest Covering Kubernetes, GitLab CI, DevSecOps and Infrastructure Reliability
OTUS has released a large-scale digest that compiles free lessons, practical articles and advanced courses focused on real-world infrastructure challenges. The collection addresses interconnected topics including Kubernetes container orchestration, GitLab CI pipeline automation, observability with OpenTelemetry, network troubleshooting, and DevSecOps practices. Readers can explore specific lessons on secrets management with Vault, load testing, RAID recovery, and kernel-level protections in Linux. The digest also features in-depth articles on Docker Compose configuration, CrowdSec migration, L2 network loops, and self-service deployment models. For experienced professionals, OTUS offers specialized courses on high-load systems, PostgreSQL administration, Linux kernel development, and advanced networking with BGP and OSPF.