SELECT shell FROM postgres: Digging up a 20-year-old bug for ZeroDay.Cloud

May 15, 2026
Video

This talk follows a PostgreSQL bug from subtle UTF-8 mishandling through the database’s custom allocator to an exploit chain that turns SQL queries into a shell.

Presented with Paul Gerste at OffensiveCon 2026.