--- title: "JADEPUFFER ransomware hits databases autonomously, pgcopydb v0.18 lands after 23 months" url: https://daily.dev/posts/jadepuffer-ransomware-hits-databases-autonomously-pgcopydb-v0-18-lands-after-23-months-ia5ukxutq source_url: https://daily.dev/posts/jadepuffer-ransomware-hits-databases-autonomously-pgcopydb-v0-18-lands-after-23-months-ia5ukxutq type: freeform source: "Databases Digest" published: 2026-07-02T04:18:40.688Z updated: 2026-07-02T04:19:05.124Z tags: ["backend", "postgresql", "ransomware", "clickhouse", "opensearch"] reading_time: 5 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # JADEPUFFER ransomware hits databases autonomously, pgcopydb v0.18 lands after 23 months **[Databases Digest](https://daily.dev/sources/databases_digest)** · 5 min read · 0 upvotes · 0 comments ## Summary Sysdig documented JADEPUFFER, the first known LLM-driven ransomware that autonomously compromised Postgres, MySQL, and MinIO before encrypting 1,342 Nacos config items — with an ephemeral AES key, so victims can't recover data even if they pay. On the tooling side, pgcopydb v0.18 ships after 23 months with a CDC engine rewrite and full PostgreSQL 16/17/18 support. AWS launched a new OpenSearch analytics engine claiming 70% storage cost reduction for log workloads. A multi-part deep dive into pg_stat_statements internals is worth reading if you've ever been surprised by missing queries during an incident. ## Content **TLDR:** Sysdig documented JADEPUFFER, the first known LLM-driven ransomware that autonomously compromised Postgres, MySQL, and MinIO before encrypting 1,342 Nacos config items — with an ephemeral AES key, so victims can't recover data even if they pay. On the tooling side, pgcopydb v0.18 ships after 23 months with a CDC engine rewrite and full PostgreSQL 16/17/18 support. AWS launched a new OpenSearch analytics engine claiming 70% storage cost reduction for log workloads. A multi-part deep dive into pg_stat_statements internals is worth reading if you've ever been surprised by missing queries during an incident. --- ## JADEPUFFER: LLM-driven ransomware autonomously exfiltrates and destroys database schemas Sysdig's threat research team documented what they assess as the first agentic ransomware operation. The attacker exploited CVE-2025-3248, an unauthenticated RCE in Langflow, then let an LLM autonomously handle reconnaissance, credential harvesting from MinIO and Postgres, lateral movement to a production MySQL/Nacos server, and finally encrypted 1,342 Nacos configuration items and dropped entire database schemas. The AES key was ephemeral and never stored — victims can't recover data even with payment. The 31-second failure-diagnosis-and-correction cycle and 600+ distinct payloads are the clearest evidence of autonomous operation. Patch Langflow, harden Nacos defaults, restrict database admin access, and apply egress controls. [Read more](https://daily.dev/posts/mbYiBpyQO) ## pgcopydb v0.18 ships after 23 months: CDC engine rewrite, PostgreSQL 18 support, CVE fix The largest release in pgcopydb's history lands with 88 commits, 13 new features, and 24+ bug fixes. The CDC engine drops JSON files in favor of SQLite for better reliability, pgoutput becomes the new default logical decoding plugin, and a new --all-databases flag lets you clone entire PostgreSQL instances in one shot. Full PostgreSQL 16/17/18 compatibility is confirmed, Citus-to-Citus migration is now supported, and CVE-2025-8714 is patched. If you're running any cross-version migrations or logical replication workflows, this is worth upgrading to. [Read more](https://daily.dev/posts/p5F6aBaLO) ## pg_stat_statements internals: eviction mechanics, query text storage, and configuration A multi-part series digs into pg_stat_statements well past the surface level. Part 2 covers the hidden per-query usage counter that drives eviction — deallocation drops the bottom 5% of entries by usage, sorted across the entire hash table, and the sort is linear in pg_stat_statements.max, so raising that setting isn't free. Part 3 reveals that query text lives in a separate on-disk file (pgss_query_texts.stat), not in the hash table, and can balloon to hundreds of megabytes on ORM-heavy workloads. Part 5 covers the deallocation counter in pg_stat_statements_info: roughly 10 deallocations per 10-minute window means losing 5% of rows per minute, and 600+ means serious locking overhead. Application-level fixes matter more than config: avoid variable-length IN lists, reduce databases per server, and don't run the same SQL under multiple roles. [Read more](https://daily.dev/feed-by-ids?id=vwgX0IUpm&id=4nyY1fxTi&id=FFzMb8BqJ&id=wtgI7rhxh) ## AWS OpenSearch gets a new analytics engine targeting 70% log storage cost reduction AWS launched a new analytics engine for Amazon OpenSearch Service built on Apache Parquet storage, Apache Calcite for query optimization, and Apache DataFusion for analytical operations alongside Lucene for search predicates. The stated motivation is a 93% increase in log volumes driven by AI and agentic workloads, which has been forcing teams to shrink retention windows or sample logs. The 70% storage cost claim is notable, but adoption isn't free: you need a new domain, migrated ingestion pipelines, and potentially rewritten dashboards since DSL isn't supported. Worth evaluating if log retention costs are already a problem, but don't underestimate the migration overhead. [Read more](https://daily.dev/posts/FL5jYsCoi) --- ## Also notable - **ClickHouse 26.6: hypothetical skip indexes and cascading materialized views:** ClickHouse 26.6 ships 56 new features including EXPLAIN WHATIF for testing skip index effectiveness before building them, cascading refreshable materialized views that trigger automatically on dependency updates, and ADD ENUM VALUES syntax — plus roughly 3x faster query startup for deeply nested queries. [Read more](https://daily.dev/posts/3hUJlqnzt) - **PostgreSQL 16.8 checkpointer bug fixed in 16.10: fsync queue overflow causes infinite retry loop:** A production postmortem details how PostgreSQL 16.8's checkpointer hit an internal 1 GB allocation ceiling under heavy write workloads, looping for four hours with no recovery path except a forced pod restart and several hours of WAL replay — fixed in 16.10 by capping the fsync request queue at 10 million entries. [Read more](https://daily.dev/posts/48qml9fr8) - **Databricks Query Tags in public preview: dbt-databricks v1.11+ auto-injects model metadata for cost attribution:** Databricks Query Tags auto-inject dbt_model_name and custom fields like team and cost_center into system.query.history, queryable via standard SQL map syntax — the dbt-databricks adapter v1.11+ supports tags at profile, project, and model levels. [Read more](https://daily.dev/posts/V07OTebQ5) - **AlloyDB AI functions: Smart Batching claims 2,400x throughput, proxy model hits 100,000 rows/sec:** AlloyDB's new Smart Batching groups LLM calls within SQL queries for up to 2,400x throughput improvement, while Optimized AI Functions train a lightweight local proxy model achieving 100,000 rows/sec and 6,000x cost reduction — both currently in preview for ai.if and ai.rank. [Read more](https://daily.dev/posts/cvsJUkeO1) - **Redpanda Cloud Topics redesigns Kafka compaction: single canonical pass against shared object storage:** Instead of each replica independently compacting its local log copy, Redpanda Cloud Topics runs compaction once against immutable objects in shared object storage, using a pull-based priority queue with dirty ratio and max.compaction.lag.ms heuristics to eliminate redundant CPU work and tombstone race conditions. [Read more](https://daily.dev/posts/kP4ux5h3R) ## Similar posts on daily.dev - [pgcopydb v0.18](https://daily.dev/posts/pgcopydb-v0-18-p5f6abalo) · Planet PostgreSQL · 0 upvotes · 0 comments --- Tags: [#backend](https://daily.dev/tags/backend), [#postgresql](https://daily.dev/tags/postgresql), [#ransomware](https://daily.dev/tags/ransomware), [#clickhouse](https://daily.dev/tags/clickhouse), [#opensearch](https://daily.dev/tags/opensearch) [View this post on daily.dev](https://daily.dev/posts/jadepuffer-ransomware-hits-databases-autonomously-pgcopydb-v0-18-lands-after-23-months-ia5ukxutq)