CVE-2026-6460 – Arbitrary Code Execution in Postgres

(postgresql.org)

10 points | by basilikum 4 hours ago ago

2 comments

  • TZubiri 2 hours ago ago

    reminder that you can just use write() and read() from files instead of tables and everything will be fine, you don’t need to pull up a 100Mloc dependency to your project just to save data.

    not saying don’t use it, just saying if you have no users or less than a million, you probably don’t need it.

    if some analyst requests a database to analyze, you can easily run a batch importer into a read only sql db thing of your analyst’s or orgs preference.

    even postgres can be dropped, it’s fine

    • basilikum 2 hours ago ago

      Databases do a lot more than a regular file.

      There arw usecases that are fine with using JSON or something similar as a store rather than a database, but databases absolutely make sense below 1mio users. You could argue that a lot of those cases could do with SQLite, but no database is just not a serious option for a lot of things. You will end up reinventing a database but in shitty. Consistency, atomic transaction, indexes etc. are not niche use cases.