GoKawiil
Tech News
A technical commentary warns analysts against using the 'ntile()' function from R's dplyr package when preparing statistical analyses meant for regulatory submission. The author explains that ntile() originated as a SQL utility and behaves in ways that do not align with standard statistical quantile calculations, potentially producing misleading results.
Cisco released fixes for CVE-2026-76461, a critical flaw in AsyncOS Software for Secure Email Gateway that lets unauthenticated attackers run root-level commands by sending crafted emails with malicious SQL statements. The company confirmed it detected active exploitation of the bug in September 2026 and issued indicators of compromise for defenders to check mail logs and network traffic. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until September 17 to patch.
Microsoft has acknowledged that a memory-management change in Windows Server 2025 is causing crashes, memory corruption, and access violations in applications using Address Windowing Extensions (AWE), including SQL Server instances with Lock Pages in Memory enabled. Affected systems may show error code 0xC0000005, failed database maintenance tasks, crash dumps, and unexpected service restarts.
PostgreSQL 19, now in beta ahead of a general release expected around September or October 2026, introduces support for SQL/PGQ, the property-graph portion of the SQL:2023 standard. The feature lets developers define a graph structure over existing relational tables and query it with pattern-matching syntax rather than manually writing joins. A hands-on walkthrough tested against PostgreSQL 19 beta 3 demonstrates how tables can be declared as vertices and edges and then queried using the new GRAPH_TABLE construct.
Security firm Horizon3 says hackers are exploiting CVE-2026-9586, an unauthenticated SQL injection bug in Sangoma Switchvox's /pa endpoint that allows remote code execution. Honeypot data shows a single source IP rapidly hitting multiple exposed systems, deploying reverse shells and exfiltrating process data. Sangoma patched the flaw, one of 12 reported by Horizon3, in version 8.4.0.2 released July 14.
Researcher Jack Taylor found a second-order SQL injection flaw, CVE-2026-19949, in the All-in-One WP Migration and Backup WordPress plugin, used on over five million sites. Attackers can plant malicious data via trackbacks that activates when an admin exports or imports a site, exposing a secret key that lets them upload a malicious archive containing executable code and seize control of the website.
Researchers at UCLA's RePL lab are developing Prela, a query language that replaces SQL's multi-column tables with simple binary relations of just two columns. A tutorial shows how a wide table, such as one listing movie IDs, titles and years, can be broken into three binary relations, each pairing a row number with a single column's value, and demonstrates a movie-search query that takes 11 lines in Prela versus more than 20 in equivalent SQL.
ServiceNow issued fixes for three critical vulnerabilities in its AI Platform that could let unauthenticated attackers run arbitrary code, escalate privileges, or manipulate data via SQL injection, all without user interaction. The company also patched a separate high-severity sandbox escape bug that could allow low-privileged users to achieve remote code execution. ServiceNow says it has no evidence of active exploitation but is urging customers to apply the updates immediately.
A developer has published an early version of LeanDB, an experimental SQL frontend built in the Lean 4 programming language that lets database schemas, queries and migrations be expressed as strongly typed constructs the compiler can verify. The post walks through Lean 4's dependent type system, showing how types can carry provable conditions—like an age under 150 or a validated email—so invalid data is rejected before code ever runs. It's presented as a first version, with the author inviting feedback on where the design falls short.
A new open-source project called Typebase proposes replacing SQL-based Row Level Security policies with backend logic written entirely in TypeScript, organized in a single folder. The developer argues traditional RLS policies are implicit, not type-checked by editors, and prone to silently granting overly broad access when new columns are added or when subtle errors go unnoticed during code review.