A 22-year-old zero-day vulnerability in PostgreSQL's core has been discovered, which can be exploited for remote code execution (RCE) and has been assigned CVE-2026-6460. The bug, found by a researcher after months of investigation, is a type-confusion vulnerability that occurs when a value is given to a composite type and the type of one of its fields is changed, causing PostgreSQL to read the value back incorrectly. This type confusion leads to a reliable memory-corruption exploit, allowing for RCE, and is part of a series of blog posts on systemic risks in the managed PostgreSQL industry.