PostgreSQL Zero-Day Chaos: Hackers Go Treasure Hunting at US Treasury!
A new zero-day vulnerability in PostgreSQL has been linked to remote code execution attacks on BeyondTrust Remote Support systems. The flaw, CVE-2025-1094, enables SQL injection via malformed UTF-8 characters. The attack compromised systems at the US Treasury Department. The PostgreSQL team released an urgent patch to address this critical issue.
Hot Take:
Looks like PostgreSQL’s interactive terminal psql has been moonlighting as a secret agent for hackers! This zero-day bug is the latest twist in the cybersecurity saga, starring BeyondTrust, and it’s pulling off SQL injections with the finesse of a master chef. Who knew psql had a hidden talent for creating chaos? Grab your popcorn; this plot is thickening faster than grandma’s gravy!
Key Points:
- New zero-day vulnerability CVE-2025-1094 in PostgreSQL’s psql terminal discovered.
- Vulnerability exploited in attacks against BeyondTrust Remote Support product.
- U.S. Treasury Department systems compromised using this flaw.
- PostgreSQL patched the issue, affecting versions before 17.3.
- Rapid7 released a Metasploit module to automate detection of vulnerable systems.
Already a member? Log in here