A public PoC for CVE-2026-2005 turns PostgreSQL's trusted pgcrypto PGP parser into a superuser shell through COPY FROM PROGRAM, a built-in host command.
A mid-April DDoS threw 2.45 billion requests from 1.2 million IPs, sitting far below 2025 HTTP peaks while still skipping per-IP rate limits.
Google's Android Binary Transparency logs production apps after May 1, 2026, replaying Certificate Transparency's append-only Merkle design.
Google Signals stopped controlling Ads cookies on June 15, 2026, leaving Consent Mode ad_storage as the only gate on sites that still fire it wrong.