22-Year-Old PostgreSQL Zero-Day Enables Remote Code Execution

A security researcher uncovered a new class of type-confusion vulnerabilities in PostgreSQL core that lay dormant for 22 years and can be exploited for highly reliable remote code execution. The discovery began not with direct kernel auditing but with questions about PostgreSQL's type system raised while exploiting the pg_clickhouse extension, with an AI agent assisting in understanding internals. The bug was reported through proper channels involving Anthropic, PostgresPro, PlanetScale and others.