--- title: Supabase swallows Turso for agentic databases, while a... description: Supabase announced a Select 2026 wave (Multigres, OrioleDB, dbarena) and then immediately acquired Turso to handle millions of on-demand agent databases. A... canonical: https://daily.dev/posts/supabase-swallows-turso-for-agentic-databases-while-a-container-escape-cve-hits-every-distro-r5x9ue2uq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Supabase swallows Turso for agentic databases, while a container escape CVE hits every distro | daily.dev og:description: Supabase announced a Select 2026 wave (Multigres, OrioleDB, dbarena) and then immediately acquired Turso to handle millions of on-demand agent databases. A... og:url: https://daily.dev/posts/supabase-swallows-turso-for-agentic-databases-while-a-container-escape-cve-hits-every-distro-r5x9ue2uq og:image: https://api.daily.dev/og/posts/r5X9UE2uq.png og:image:alt: Supabase swallows Turso for agentic databases, while a container escape CVE hits every distro og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Supabase swallows Turso for agentic databases, while a container escape CVE hits every distro **[Backend Digest](https://daily.dev/sources/backend_digest)** · 5 min read · 0 upvotes · 0 comments ## Summary Supabase announced a Select 2026 wave (Multigres, OrioleDB, dbarena) and then immediately acquired Turso to handle millions of on-demand agent databases. A public exploit for CVE-2026-80521 breaks out of default Docker and Kubernetes containers to root on the host, and it's not just an Ubuntu problem since the bug was backported across kernel branches. Uber Eats cut end-to-end search latency in half through unglamorous infra work rather than a rewrite, and 37signals shaved gigabytes of memory and seconds of p99 latency off Basecamp by warming Puma workers before they fork. Cloudflare keeps restructuring its observability stack around agent-queryable traces and logs ahead of a December pricing change. ## Content **TLDR:** Supabase announced a Select 2026 wave (Multigres, OrioleDB, dbarena) and then immediately acquired Turso to handle millions of on-demand agent databases. A public exploit for CVE-2026-80521 breaks out of default Docker and Kubernetes containers to root on the host, and it's not just an Ubuntu problem since the bug was backported across kernel branches. Uber Eats cut end-to-end search latency in half through unglamorous infra work rather than a rewrite, and 37signals shaved gigabytes of memory and seconds of p99 latency off Basecamp by warming Puma workers before they fork. Cloudflare keeps restructuring its observability stack around agent-queryable traces and logs ahead of a December pricing change. --- ## Supabase acquires Turso right after its own Select 2026 launch wave Supabase just shipped Multigres (multi-node HA Postgres from the Vitess team, private alpha), OrioleDB (an undo-log storage engine claiming up to 1.8x throughput over heap, public beta), and dbarena, an open benchmarking site for Postgres providers. Then it announced it's acquiring Turso to build infrastructure for agents that spin up millions of databases on demand, since Turso's Rust-based SQLite platform already manages that scale on a single server. Existing users see no immediate changes: Postgres stays Postgres, Turso stays Turso, and founders Glauber Costa and Pekka Enberg join Supabase to lead the agentic infra push. [Read more](https://daily.dev/feed-by-ids?id=vKjh5o3DZ&id=EMGQDLEIi&id=b9q5iPDwk) ## CVE-2026-80521 breaks out of default containers to root, and version checks won't catch it A use-after-free in the Linux AF_UNIX socket garbage collector lets attackers escape default Docker and Kubernetes containers straight to host root. The bug landed in kernel 6.10 and got backported into 6.1.141+ and 6.6.93+, so Ubuntu 24.04/26.04 and Debian 12 were still unpatched as of October 2 even though upstream fixed it in 6.12.111, 6.18.53, and 7.1.10. Because distros backport independently of version numbers, you can't just check a kernel version string; the writeup includes a kallsyms grep and a script to detect the vulnerable GC directly. Default seccomp and user namespaces don't block this, so if you can't patch yet, move untrusted workloads to gVisor or Kata Containers. [Read more](https://daily.dev/posts/43SFMS1mb) ## Uber Eats halves search latency without a rewrite Uber rebuilt chunks of its Eats search pipeline and cut end-to-end latency 50%, through a pile of unglamorous changes: switching the north-star metric to Above-the-Fold completion, trimming retrieval with product-level embeddings, separating ranking hydration from presentation data, and moving the ad data path to column-oriented storage. An agentic coding workflow helped surface and validate some of the optimizations. The team is now chasing microbatching and product-based retrieval, with early tests already showing over 50% p99 reduction on top of this. The lesson engineers are drawing from it: incremental full-stack tuning beat a big-bang rewrite. [Read more](https://daily.dev/posts/F9nZD1CdW) ## 37signals warms Puma workers before forking, kills multi-second post-deploy spikes Basecamp's post-deploy request queues used to spike because each of 63 forked Puma workers independently had to JIT-compile code, render templates, and load the Active Record schema cache on its first real requests, backing up to 2,238 queued requests on busy hosts. Using Rack::Builder#warmup, the master process now pre-renders 1,394 templates and runs real signed-in requests through Rack::MockRequest before forking, all inside a 20-second budget, then resets connection pools and caches before the fork happens. Peak backlog dropped to 19-223 requests, p99 latency fell from roughly 10s to 2.4-4.8s, and memory usage across web containers dropped about 39GB. Worth reading just for the list of things that didn't work, including Puma's experimental fork_worker mode. [Read more](https://daily.dev/posts/UBPjZ1eKU) --- ## Also notable - **CVE-2026-47775 fixed in Envoy Gateway 1.9.1, but v1.9.0 upgraders face a TLS gap:** Envoy Gateway 1.9.1 restores the 15-second SDS/RDS fetch timeout removed in 1.9.0, switches session-cookie encryption to AES-256-GCM, and patches CVE-2026-47775, but anyone already running 1.9.0 needs to watch for TLS listeners activating without certificates during the controller upgrade. [Read more](https://daily.dev/feed-by-ids?id=1IcxWdpG2&id=DtKesdHdj) - **LiteLLM supply-chain breach traced to a stolen CI bot token:** Two backdoored LiteLLM versions (1.82.7, 1.82.8) hit PyPI in March 2026 after attackers compromised a Trivy GitHub Action to steal a publishing token, with CloudSEK estimating exposure across 2,500+ organizations and 434,000 CI/CD pipelines before a fork-bomb bug got the attack noticed within hours. [Read more](https://daily.dev/posts/YsBBrmWZU) - **GitHub's async merge API goes GA, and it's the only one that supports stacked PRs:** The two-step submit-then-poll merge API is now GitHub's recommended way to merge PRs programmatically, replacing the synchronous REST and GraphQL paths for anyone scripting or agent-driving merges against busy repositories. [Read more](https://daily.dev/posts/m1dgaiidN) - **Cloudflare's December 1 pricing switch moves logs and traces to volume-based billing:** Cloudflare is unifying logs, traces, and dashboards into one observability platform with a new SQL API and MCP server, but the free tier caps at 0.5GB/day with 7-day retention once the new ingestion-based pricing replaces event-based pricing on December 1, 2026. [Read more](https://daily.dev/feed-by-ids?id=5sQR8MGGt&id=jN3YujwOx) - **turbopuffer publishes its new architecture running 128x slower, pre-optimization:** turbopuffer is blogging through its architecture migration in public, including the embarrassing part where the new system started out up to 128x slower than the old one before a documented series of fixes closed the gap. [Read more](https://daily.dev/posts/1hG2lNQWX) ## Similar posts on daily.dev - [libSQL and Turso: SQLite for production](https://daily.dev/posts/libsql-and-turso-sqlite-for-production-eyuydll8t) · Flavio Copes · 0 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux), [#postgresql](https://daily.dev/tags/postgresql), [#containers](https://daily.dev/tags/containers), [#supabase](https://daily.dev/tags/supabase) [View this post on daily.dev](https://daily.dev/posts/supabase-swallows-turso-for-agentic-databases-while-a-container-escape-cve-hits-every-distro-r5x9ue2uq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/supabase-swallows-turso-for-agentic-databases-while-a-container-escape-cve-hits-every-distro-r5x9ue2uq","headline":"Supabase swallows Turso for agentic databases, while a container escape CVE hits every distro","text":"Supabase announced a Select 2026 wave (Multigres, OrioleDB, dbarena) and then immediately acquired Turso to handle millions of on-demand agent databases. A public exploit for CVE-2026-80521 breaks out of default Docker and Kubernetes containers to root on the host, and it's not just an Ubuntu problem since the bug was backported across kernel branches. Uber Eats cut end-to-end search latency in half through unglamorous infra work rather than a rewrite, and 37signals shaved gigabytes of memory and seconds of p99 latency off Basecamp by warming Puma workers before they fork. Cloudflare keeps restructuring its observability stack around agent-queryable traces and logs ahead of a December pricing change.","url":"https://daily.dev/posts/supabase-swallows-turso-for-agentic-databases-while-a-container-escape-cve-hits-every-distro-r5x9ue2uq","datePublished":"2026-10-03T04:18:20.485Z","dateModified":"2026-10-03T04:18:40.640Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"Supabase swallows Turso for agentic databases, while a container escape CVE hits every distro"}]} ```