POSTGRESHELL: THE DATABASE POWERING MUCH OF THE INTERNET HAD AN OPEN DOOR FOR 12 YEARS

Summary from the TLDR InfoSec newsletter

CVE-2026-6471 affects PostgreSQL 9.4 through 18. A low-privilege REPLICATION account could supply an unchecked output-plugin path, load attacker code, gain PostgreSQL superuser access, and establish persistence, while Windows targets could fetch a DLL over SMB. It is recommended to patch PostgreSQL, remove unused replication privileges, restrict pg_hba.conf, block outbound SMB and NFS, and monitor suspicious replication slots.