2 posts tagged with "database security"

On October 30, 2026, ClickHouse published CVE-2026-116366, an unauthenticated remote code execution vulnerability in ClickHouse Server. Under certain conditions, a user with network access to the server can run arbitrary code on it without logging in. ClickHouse rates it Critical, with a CVSS v4.0 score of 9.5.

ClickHouse Cloud and BYOC deployments are already patched. Self-managed servers are not, and finding every one of them across your environments is the hard part. Atlas can do that for you: atlas security scan now checks the server version of each ClickHouse server against the Atlas Security Graph, and reports every published CVE that affects it, this one included, along with the release that fixes it.

As of April 2026, MySQL 8.0 has reached End of Life (EOL), marking a critical security and operational milestone. When a database reaches EOL, the safety net is pulled away. Oracle will no longer release security patches, bug fixes, or performance improvements for the community edition. If a vulnerability is discovered tomorrow, your 8.0 instances will remain exposed.

In this post, we’ll explore what this means and how cloud platforms are responding to it.