--- title: Metabase breach hits Framework customers, pgrust 0.2... description: The Metabase SQL injection 0-day from yesterday's digest has claimed real victims: Framework confirmed customer PII was stolen, and Tally had emails and hashed... canonical: https://daily.dev/posts/metabase-breach-hits-framework-customers-pgrust-0-2-hits-300x-analytics-speedup-pflnvuh01 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Metabase breach hits Framework customers, pgrust 0.2 hits 300x analytics speedup | daily.dev og:description: The Metabase SQL injection 0-day from yesterday's digest has claimed real victims: Framework confirmed customer PII was stolen, and Tally had emails and hashed... og:url: https://daily.dev/posts/metabase-breach-hits-framework-customers-pgrust-0-2-hits-300x-analytics-speedup-pflnvuh01 og:image: https://api.daily.dev/og/posts/pflNvUh01.png og:image:alt: Metabase breach hits Framework customers, pgrust 0.2 hits 300x analytics speedup og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Metabase breach hits Framework customers, pgrust 0.2 hits 300x analytics speedup **[Databases Digest](https://daily.dev/sources/databases_digest)** · 5 min read · 3 upvotes · 0 comments ## Summary The Metabase SQL injection 0-day from yesterday's digest has claimed real victims: Framework confirmed customer PII was stolen, and Tally had emails and hashed passwords exposed. On the performance side, pgrust 0.2 demonstrates 300x faster analytical queries than Postgres on ClickBench — beating ClickHouse — through batching, operator fusion, and SIMD. GPT-4.1 Luna's 80% price cut is reshaping how teams think about AI-assisted analytics, with the bottleneck shifting from model cost to database response time. PostgreSQL 19 beta is picking up coverage with REPACK caveats and three useful syntax additions worth knowing before it ships. ## Content **TLDR:** The Metabase SQL injection 0-day from yesterday's digest has claimed real victims: Framework confirmed customer PII was stolen, and Tally had emails and hashed passwords exposed. On the performance side, pgrust 0.2 demonstrates 300x faster analytical queries than Postgres on ClickBench — beating ClickHouse — through batching, operator fusion, and SIMD. GPT-4.1 Luna's 80% price cut is reshaping how teams think about AI-assisted analytics, with the bottleneck shifting from model cost to database response time. PostgreSQL 19 beta is picking up coverage with REPACK caveats and three useful syntax additions worth knowing before it ships. --- ## Framework, Tally, LexisNexis confirmed victims of Metabase SQL injection 0-day Yesterday's Metabase 0-day has moved from 'patch now' to 'breach confirmed.' Framework notified all customers that names, emails, phone numbers, and physical addresses were stolen — payment data was not affected. Tally had customer emails and hashed passwords exposed. LexisNexis had its Metabase API disrupted via a third-party vendor. Framework says it notified customers within six hours of receiving Metabase's disclosure, which itself came roughly three days after Metabase discovered the compromise. The community reaction is pointed: names, addresses, phone numbers, and emails is a complete phishing kit, and the word 'limited' in Framework's disclosure is getting pushback. If you haven't patched self-hosted Metabase yet, the minimum safe releases are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5 — and if that endpoint was publicly accessible before you patched, run TRUNCATE TABLE core_session after upgrading. [Read more](https://daily.dev/posts/s8tq7KMtu) ## pgrust 0.2: 300x faster analytics than Postgres, outperforms ClickHouse on ClickBench pgrust 0.2 hits 300x faster analytical query performance than Postgres on ClickBench and edges out ClickHouse. The gains come from three layered optimizations: batching replaces row-at-a-time Volcano model calls with 1024-element batches (1.3s to 480ms), operator fusion combines sequential scan and aggregation into a single node to eliminate copy overhead (480ms to 358ms), and SIMD using ARM NEON intrinsics processes 8 floats per iteration (358ms to 135ms). Those three changes alone account for roughly 10x improvement in the query engine; the rest of the 300x comes from broader architectural work. JIT compilation enabling operator fusion for arbitrary queries is flagged as the next topic. [Read more](https://daily.dev/posts/TGtPnmLYi) ## GPT-4.1 Luna's 80% price cut shifts the bottleneck from model cost to database speed OpenAI's 80% price cut on GPT-4.1 Luna is changing the cost math for AI-assisted analytics workloads. At under half a penny per answer on agentic SQL benchmarks, the model cost is no longer the constraint worth optimizing — the database response time is. The practical implication: fast analytical engines like DuckDB become the bottleneck, not the AI layer. Recommendations coming out of the discussion include ditching large models on low effort, switching to Luna on max, investing in richer business context layers, running evals more frequently, and keeping eval workflows model-agnostic given how fast pricing and capabilities are moving. [Read more](https://daily.dev/posts/s0HRuJkO1) ## PostgreSQL 19 beta: REPACK needs FILLFACTOR thought, three syntax additions worth knowing PostgreSQL 19's REPACK command for reducing table bloat is getting attention, but the warning is clear: FILLFACTOR settings need careful consideration before using it, and it's not as simple as it looks. Separately, Postgres 19 adds three syntax improvements that are genuinely useful: ON CONFLICT DO SELECT returns the existing conflicting row for true get-or-create semantics (no more no-op updates), GROUP BY ALL infers all non-aggregate columns from the SELECT list automatically, and COPY ... TO (FORMAT JSON) exports query results as newline-delimited JSON with proper type mapping including a FORCE_ARRAY option. [Read more](https://daily.dev/feed-by-ids?id=G3Ix2qEUr&id=3r0ZiiEHV) --- ## Also notable - **DuckDB MySQL engine at 500 GB: 186s vs InnoDB's 28+ hours on TPC-H:** Percona's custom MySQL storage engine backed by DuckDB completed all 22 TPC-H queries at scale factor 500 (~500 GB, 3 billion lineitem rows) in ~186 seconds total; InnoDB finished only 18 of 22 in over 28 hours with 4 queries never completing, data load was 25x faster (36 minutes vs 15+ hours), and storage footprint was 5x smaller (132 GB vs 673 GB) — the engine and benchmark harness are on GitHub under GPLv2 with a Docker image for testing. [Read more](https://daily.dev/posts/baqJlL9PK) - **PostgreSQL ignore_system_indexes GUC: the escape hatch for catalog index corruption:** PostgreSQL's ignore_system_indexes GUC forces all internal catalog lookups to sequential scans, and it exists specifically for the scenario where REINDEX fails because it depends on the broken indexes it's trying to fix — invoke via PGOPTIONS="-P" or single-user mode, avoid DDL while active, and note that managed services without single-user mode have no equivalent escape hatch. [Read more](https://daily.dev/posts/pcn2Jtsfs) - **Databricks FILE type beta: native column type for unstructured data with Unity Catalog access controls:** Databricks is releasing FILE type in beta — a native column type storing references to documents, images, video, and audio directly in lakehouse tables, with Unity Catalog row- and column-level access controls, unified lifecycle management (deleting a row deletes the file reference), and upstream contributions to Apache Parquet and Delta Lake to keep the format portable. [Read more](https://daily.dev/posts/W9edCnr82) - **DoltHub adds push/pull/clone support for Doltgres and DoltLite:** DoltHub now supports push, pull, and clone for Doltgres (PostgreSQL-compatible, version 1.0) and DoltLite (SQLite-compatible, embedded), with authentication differing slightly: Doltgres uses dolt login while DoltLite requires manually copying a key from dolt_creds_new() into the DoltHub credentials page. [Read more](https://daily.dev/posts/FvVamvpDO) - **BigQuery DTS adds Iceberg managed table ingestion and PostgreSQL/MySQL connectors at GA:** BigQuery Data Transfer Service now supports direct ingestion into Apache Iceberg managed tables (Preview) and has promoted PostgreSQL and MySQL connectors to GA, alongside a new Microsoft SQL Server connector in Preview and Snowflake migration support at GA. [Read more](https://daily.dev/posts/R6fSzvJbC) ## Similar posts on daily.dev - [August 2026 Security Vulnerability: What happened?](https://daily.dev/posts/august-2026-security-vulnerability-what-happened--vf4dqe4hg) · Metabase · 6 upvotes · 1 comments --- Tags: [#sql](https://daily.dev/tags/sql), [#postgresql](https://daily.dev/tags/postgresql), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/metabase-breach-hits-framework-customers-pgrust-0-2-hits-300x-analytics-speedup-pflnvuh01) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/metabase-breach-hits-framework-customers-pgrust-0-2-hits-300x-analytics-speedup-pflnvuh01","headline":"Metabase breach hits Framework customers, pgrust 0.2 hits 300x analytics speedup","text":"The Metabase SQL injection 0-day from yesterday's digest has claimed real victims: Framework confirmed customer PII was stolen, and Tally had emails and hashed passwords exposed. On the performance side, pgrust 0.2 demonstrates 300x faster analytical queries than Postgres on ClickBench — beating ClickHouse — through batching, operator fusion, and SIMD. GPT-4.1 Luna's 80% price cut is reshaping how teams think about AI-assisted analytics, with the bottleneck shifting from model cost to database response time. PostgreSQL 19 beta is picking up coverage with REPACK caveats and three useful syntax additions worth knowing before it ships.","url":"https://daily.dev/posts/metabase-breach-hits-framework-customers-pgrust-0-2-hits-300x-analytics-speedup-pflnvuh01","datePublished":"2026-08-08T04:18:43.598Z","dateModified":"2026-09-13T21:22:21.865Z","author":{"@type":"Organization","name":"Databases Digest","logo":"https://media.daily.dev/image/upload/s--ir1hdV8b--/f_auto,q_auto/v1773839400/logos/databases_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/databases_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/databases_digest","name":"Databases Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Databases Digest","item":"https://daily.dev/sources/databases_digest"},{"@type":"ListItem","position":3,"name":"Metabase breach hits Framework customers, pgrust 0.2 hits 300x analytics speedup"}]} ```