3 posts tagged with "database security"

PostgreSQL 19 is scheduled for general availability on November 19, 2026, one week after PostgreSQL 14 reaches end of life on November 12. From then on, servers on PostgreSQL 14 get no more security fixes. Versions 15 through 18 are still supported, but version 19 will be supported the longest, into late 2031.

This post covers what version 19 changes for security and the schema objects that block an upgrade to it, and how to use the week before GA to prepare with Atlas: scan your servers for their versions and CVEs, keep upgrade blockers out with schema rules, and apply the same schema, roles, and grants to the new instance from code.

On October 30, 2026, ClickHouse published CVE-2026-116366, an unauthenticated remote code execution vulnerability in ClickHouse Server. Under certain conditions, a user with network access to the server can run arbitrary code on it without logging in. ClickHouse rates it Critical, with a CVSS v4.0 score of 9.5.

ClickHouse Cloud and BYOC deployments are already patched. Self-managed servers are not, and finding every one of them across your environments is the hard part. Atlas can do that for you: atlas security scan now checks the server version of each ClickHouse server against the Atlas Security Graph, and reports every published CVE that affects it, this one included, along with the release that fixes it.

As of April 2026, MySQL 8.0 has reached End of Life (EOL), marking a critical security and operational milestone. When a database reaches EOL, the safety net is pulled away. Oracle will no longer release security patches, bug fixes, or performance improvements for the community edition. If a vulnerability is discovered tomorrow, your 8.0 instances will remain exposed.

In this post, we’ll explore what this means and how cloud platforms are responding to it.