PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE

thehackernews.com Nov 13, 2026

PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE

Curated by Shubham · TechCapsules · Nov 13, 2026

AI-summarised brief · reviewed before publication

PostgreSQL released a patch addressing 52 security flaws, including CVE‑2026‑6460, a type‑confusion vulnerability that lets a database user who can create objects execute code with the operating system’s PostgreSQL user privileges. The flaw, with a CVSS score of 8.8, affects all releases before 18.7, 17.12, 16.16, 15.20, and 14.25 and requires rebuilding any C‑language extensions. Security researcher Mehmet Ince demonstrated a working exploit on PostgreSQL 18.6, and the PostgreSQL Global Development Group has not reported any attacks yet.

💡 Why It Matters

· The vulnerability exposes a long‑standing flaw that could let privileged database users compromise entire servers, underscoring the need for timely patching and careful extension management.

Capsules Cybersecurity

Read full article on thehackernews.com

Quantum XChange Phio TX Becomes First Post-Quantum Cryptographic Management Platform to Earn…

Quantum XChange’s Phio TX‑V cryptographic‑management platform (v4.5.6) has been awarded the European Union Cybersecurity Certification (EUCC), making it the first post‑quantum cryptography (PQC) solution to hold both EUCC and U.S. FIPS validation. The EUCC, administered under the Common Criteria framework, confirms that Phio TX meets standardized third‑party testing requirements for ICT products used in regulated EU networks. The software acts as a crypto‑agile overlay, separating key generation and distribution from data transport, allowing enterprises to add PQC algorithms and quantum‑key‑distribution interfaces without replacing existing hardware. Executives from Quantum XChange and Spanish telecom operator Evolutio said the dual certification streamlines procurement and supports cross‑border data‑sovereignty mandates for financial firms, telecom carriers and government agencies. The ENISA‑issued certificate and supporting documentation are publicly available.

💡 Dual EUCC and FIPS validation gives buyers a single, trusted benchmark for PQC tools, accelerating adoption in regulated sectors that must meet both European and U.S. security standards.

thehackernews.com · Nov 13

FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using…

The FBI confirmed that North Korean threat actors, operating under the FaceStealer campaign, stole over $400 million in cryptocurrency in the past 18 months. The operation used deepfake video calls and social engineering to target individuals in the crypto and Web3 sectors, recording victims’ webcams to build trust. The U.S. government seized the cloud infrastructure that enabled the attacks, while the DOJ also seized more than $1.2 billion in assets linked to the TraderTraitor hack of Binance. The proceeds are believed to fund Pyongyang’s illicit weapons program.

💡 The case exposes how state-sponsored actors exploit emerging tech, turning deepfakes into a weaponized phishing tool that can infiltrate software supply chains. It underscores the growing threat to digital finance and open-source ecosystems, prompting urgent reassessment of security protocols across the industry.

techcrunch.com · Nov 13

Uber confirms hackers stole thousands of drivers’ license information in data breach

Uber notified thousands of drivers that their personal and driver’s license data were stolen during an October breach at its third‑party vendor, Fireworks AI. Uber learned of the incident on October 9 when Fireworks reported unauthorized access to its systems, which had stored Uber data. The breach exposed license information for 2,567 Massachusetts drivers, 3,430 in South Carolina, 1,873 in Rhode Island, and additional drivers in Illinois and California. Uber began notifying affected drivers and filed notices with several U.S. attorneys general.

💡 The incident underscores the growing risk of data exposure through cloud‑based AI services, revealing how third‑party vulnerabilities can compromise personal information of millions of users.

thehackernews.com · Nov 13

Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen…

An international police operation dubbed Operation Endgame dismantled the infrastructure behind three malware families—Gootloader, CastleRAT and StealC—seizing 235 servers, 257 domains and roughly 6.4 million stolen login credentials belonging to more than 40 000 victims. Gootloader, a loader that has infected at least 25 000 computers since 2018 and facilitated ransomware attacks causing about $28.8 million in U.S. losses, was removed from 14 servers, 218 domains and 681 hacked WordPress sites. CastleRAT’s 120 servers and 39 domains were seized, while StealC’s servers were taken down again after a June takedown, despite a brief resurgence via a bullet‑proof host. No arrests were announced, but victims can check compromised emails through a new police service and data is being shared with Have I Been Pwned and the Shadowserver Foundation.

💡 By crippling the command‑and‑control backbone of these prolific tools, law enforcement has halted a pipeline that feeds ransomware gangs with fresh victims and millions of stolen credentials.

thehackernews.com · Nov 13

PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code…

PTC has issued emergency patches for a critical vulnerability identified as CVE‑2026‑126325 affecting its Windchill product lifecycle management and FlexPLM PLM platforms. The flaw, rated 9.2 on the CVSS v4 scale, stems from improper input validation and deserialization of untrusted data, enabling remote code execution through crafted requests. PTC confirms that hosted customers receive the fix automatically, while on‑premise users must apply the update themselves. The disclosure follows a prior RCE bug (CVE‑2026‑12569) that was actively exploited and later weaponized by the Cl0p ransomware group to drop JSP web shells and exfiltrate proprietary manufacturing data. Security experts warn that compromised Windchill/FlexPLM instances can facilitate widespread network intrusion, data theft, and disruption of time‑sensitive production processes. Organizations are urged to patch immediately or enforce strict network segmentation to mitigate risk.

💡 Unpatched PLM systems give attackers a direct foothold inside manufacturing networks, turning product data into a high‑value ransom lever.

thehackernews.com · Nov 12

ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue…

ConnectWise disabled five third‑party extensions in partner environments after reports of unauthorized access. The company confirmed no evidence of a ScreenConnect software flaw and identified about 400 partner sites with the extensions installed. Cybersecurity firm Huntress traced attackers using compromised credentials or hijacked sessions to push rogue ScreenConnect clients to at least 288 endpoints across 48 organizations. The malware, named SCKit, establishes persistent remote access, installs a second attacker‑controlled client, and creates a relay trap to intercept session cookies. The attack spreads in a worm‑like two‑step process from infected endpoints to technicians and then to other endpoints.

💡 The incident exposes how vulnerable third‑party extensions can become a conduit for sophisticated lateral movement, underscoring the need for strict access controls and continuous monitoring in partner ecosystems.