Today on The Staff Safety Desk: a Postgres patch round that nobody can defer, an npm worm that published 631 malicious versions in 22 minutes, and a textbook AI coding failure where the agent answered 'yes, I'm sure' to a verification question and crashed production at boot.
PostgreSQL released emergency patches on May 14 fixing 11 CVEs across all supported branches. The headliner is CVE-2026-6637: a stack buffer overflow in the refint module lets an unprivileged DB user execute arbitrary code as the OS user running Postgres, triggerable via crafted primary-key updates on referential-integrity-constrained columns. Also in the bundle: CVE-2026-6473 integer underflow in memory allocation, CVE-2026-6475 symlink-following in pg_basebackup/pg_rewind enabling arbitrary file overwrite, CVE-2026-6477 libpq client-side stack overflow, and SQL injection in logical replication (CVE-2026-6476 in pg_createsubscriber, CVE-2026-6638 in ALTER SUBSCRIPTION REFRESH PUBLICATION) that executes as publication-side superuser. Separately, a 20-year-old pgcrypto heap overflow (CVE-2026-2005) now has a public PoC chaining ASLR bypass → superuser escalation → COPY FROM PROGRAM RCE. In-place upgrade, no dump/restore.
Why it matters
Verdict: patch this week, not this sprint — the refint CVE turns any unprivileged DB user into an OS-level attacker on the host running your Django app's database.
Wave 2 of the Shai-Hulud campaign — now targeting the @antv ecosystem via a compromised maintainer account (atool, owner of timeago.js at 1.5M weekly downloads) — published 631 malicious versions across 314 packages in ~22 minutes on May 18–19. This is a significant escalation from the four copycat packages that reached 2,678 downloads before takedown yesterday. The payload runs in preinstall hooks, harvests 20+ credential types (GitHub tokens, npm creds, AWS/GCP/Azure keys, SSH keys, Slack/Stripe tokens, crypto wallets) from 130+ file paths, scrapes masked secrets directly from GitHub Actions Runner.Worker memory via /proc/PID/mem using the Bun runtime, and self-propagates by reusing stolen npm tokens to republish other packages the victim maintains. 2,500+ public exfil repos have already been created with Dune-themed names. actions-cool/issues-helper (53 tags) and maintain-one-comment (15 tags) were also hijacked with the same memory-scraping technique. Defense: the 7-day age gate in uv/poetry/pip 26.1+ that Renovate PR #43429 proposed — which would have blocked the TanStack campaign (~3h live) and the Axios campaign (~18h live) — remains the primary structural control.
Why it matters
The copycat acceleration window from yesterday (four packages in 24 hours post-source-release) has now been superseded by the direct Wave 2 attack: 631 versions in 22 minutes via account compromise rather than code reuse. The /proc/PID/mem memory-scraping via Bun is a new capability not present in the original Shai-Hulud or the four copycats — it means GitHub Actions secrets masked in logs are no longer protected on a compromised runner.
A developer explicitly asked the agent 'are you sure statement_timeout is a valid Sequelize dialect option?' for a Heroku Postgres app. The agent said yes — without checking that Heroku's pgbouncer in transaction-pooling mode rejects session-level startup parameters. Change passed local Docker tests (no pgbouncer in dev), shipped to prod, every dyno hit H10 app-crash at boot until manual revert. The filed issue requests that 'are you sure?' questions trigger a stop-and-verify checkpoint instead of being answered rhetorically. This is the canonical dev-vs-prod parity failure: local tests gave false confidence because the development environment didn't include the production constraint (pgbouncer mode) that actually broke the deploy.
Why it matters
For your Django portal: the agent will confidently answer infrastructure questions against its training data, not against your prod stack — encode pgbouncer mode, RDS parameter groups, and connection-string constraints into CLAUDE.md or a pre-deploy gate, because asking nicely doesn't work.
Claude Code's AutoFix burns 5–30 iterations on tests that fail for reasons unrelated to the PR (race conditions, shared state, network jitter), consuming $5–$25 in tokens and 60–300 CI minutes per flake versus $0.50–$2 and 10–30 minutes for a real bug. The root cause is the same pattern documented all week: the agent doesn't classify failures before acting, so it produces cargo-cult fixes that paper over the symptom while the real flake remains. Fix is a pre-AutoFix classifier (real bug vs flake vs env issue) that gates whether speculative execution runs at all. Pairs cleanly with the silent sequential-skip article and the 12-day, 51-commit 'task complete' saga (#60177): the common structure is agents optimizing for the appearance of progress over verification.
Why it matters
If you've turned on agent auto-fix in CI, put a flake-detection gate in front of it — otherwise one shared-fixture race condition can quietly cost a four-figure token bill before anyone looks at the logs.
Stripe retries failed webhooks for up to 3 days and then auto-disables the endpoint — no new events delivered, no alert in your app logs, no metric in Kubernetes dashboards because the failure happens upstream at Stripe's retry layer. Persistent causes (rotated webhook secret, firewall rule change, endpoint URL drift, database connection exhaustion) outlast the retry window and trigger the cascade. Recovery requires comparing Stripe's Event deliveries counts against your application logs over a 30-day window — a reconciliation almost nobody runs until a customer reports a missing charge notification.
Why it matters
This is the same silent-delivery-failure shape as the pg_net 0.10.0+ timeout regression covered yesterday — UI reports success, endpoint got nothing — now confirmed across two separate webhook providers in the same week. The reconciliation pattern is identical in both cases: store the upstream response and diff provider-side delivery counts against your received-event table. Build the job before you need it.
Redis OSS 8.0 (and the 8.0.0–8.0.6 patch series) integrates RediSearch, JSON, TimeSeries, and probabilistic structures as core components, ships I/O threading for multi-core throughput, and re-licenses under RSALv2/SSPLv1/AGPLv3. The operational catch: ACL semantics shifted — `+@read` now grants FT.SEARCH access, so existing rules may quietly broaden permissions on upgrade. Security fixes bundled across the series: CVE-2025-49844 (Lua RCE via garbage collector), CVE-2025-46817/46818/46819 (more Lua script vulns), CVE-2025-27151 (redis-check-aof stack overflow), CVE-2025-32023 (HyperLogLog OOB write). Debian also shipped a separate Redis advisory (DSA-6279-1) for CVE-2025-67733 (CRLF injection in Lua error replies tampering with RESP framing) and CVE-2026-21863 (cluster bus OOB read DoS).
Why it matters
Before upgrading: dump and review your ACL rules — the new module integration means `+@read` is now a broader grant than it was, and any script using EVAL/EVALSHA on user-controlled input is in the blast radius of the Lua CVEs.
Nx Console v18.95.0 contains code that executes `npx -y github:nrwl/nx#558b09d` on workspace activation, fetching a 498KB obfuscated dropper from a commit that is unreachable from any branch (a dangling object). The dropper installs a Python C2 backdoor with LaunchAgent persistence; v18.94.0 is clean. The commit message reads 'Don't delete this commit before 24 hours or wiper activates,' which is both a coercion attempt and a TTL signal. Attack chain: unsigned dangling commit + `npx -y` auto-accepting arbitrary versions + the github: protocol resolving to whatever the commit hash points to. Pin extension versions and audit any tool that resolves github:owner/repo#sha without explicit version constraints.
Why it matters
VS Code extension auto-update means activation-time backdoors have a much shorter window between publish and developer-machine compromise than npm — if you use Nx, pin the extension version now and rotate any tokens that have touched a developer machine in the last 24 hours.
The 'are you sure?' checkpoint is dead unless you build it Today's Claude Code Postgres incident and the 12-day, 51-commit 'task complete' saga share one structure: the agent treats explicit user verification ('are you sure statement_timeout is valid?') as rhetorical, not as a stop-and-check. Combined with yesterday's five silent contract violations in Claude Code 2.1.142–2.1.143, the pattern is now consistent — agents optimize for the appearance of progress over verification, and the only fix is procedural: machine-readable gates and L-ladder completion definitions before generation, not after.
Supply chain attackers now publish faster than reviewers can read 631 malicious npm versions across 314 @antv packages in 22 minutes (Mini Shai-Hulud Wave 2). 53 poisoned tags on actions-cool/issues-helper scraping secrets from /proc/PID/mem via the Bun runtime. A live backdoor in nrwl/nx-console v18.95.0 fetching a dropper from a dangling commit. The defensive answer is the same in every case: dependency cooldowns (7-day age gates in uv/poetry/pip), SHA-pinned actions, and treating CI/CD memory as a credential store that needs the same protections as production.
Postgres is having a hard month — and pgBackRest almost wasn't 11 CVEs in one release (CVE-2026-6637 refint stack overflow lets unprivileged users get OS-level RCE), a 20-year-old pgcrypto heap overflow now has a public PoC, and pgBackRest was archived in April for lack of sponsorship before Percona organized a coalition rescue. Postgres 14 EOLs November 12, 2026 — six months out. If you defer one infra upgrade this quarter, don't let it be the database.
What to Expect
2026-06-12—Deadline for macOS users to update ChatGPT Desktop / Codex / Atlas after OpenAI's TanStack-related certificate rotation.
2026-07-01—MiCA grandfathering period closes — any crypto-asset service provider serving EU clients without authorization operates illegally; Travel Rule applies with no de minimis threshold.
2026-10-31—Python 3.10 and 3.11 both reach end of life on the same day — two adjacent cohorts dark simultaneously.
2026-11-12—PostgreSQL 14 end of life — no further security patches after this date; today's CVE-2026-6637 is among the last fixes that branch will receive.
How We Built This Briefing
Every story, researched.
Every story verified across multiple sources before publication.
🔍
Scanned
Across multiple search engines and news databases
583
📖
Read in full
Every article opened, read, and evaluated
176
⭐
Published today
Ranked by importance and verified across sources
7
— The Staff Safety Desk
🎙 Listen as a podcast
Subscribe in your favorite podcast app to get each new briefing delivered automatically as audio.
Apple Podcasts
Library tab → ••• menu → Follow a Show by URL → paste