SQL

A discussion among developers argues that the fastest way to connect an AI agent to application data is often a generic SQL tool, but warns against giving agents raw SQL access. The argument, shared in a TypeScript and AI-focused developer community, suggests safer, more structured approaches to database access for AI systems are needed.

Developers at CedarDB have ported the original Doom to SQL, running the classic 1993 shooter inside a database engine. The technical write-up has drawn attention on developer forums, with commenters discussing how the game's rendering and logic were mapped onto SQL queries.

A developer says they wrote a SQL parser in C++ years ago, entirely without AI assistance, and has recently returned to the project. Reflecting on the work, they argue the code itself was never the important part, a point landing with programmers weighing how AI coding tools change the value of building software from scratch. The project is being shared openly with the developer community.

A newly catalogued vulnerability, EUVD-2026-91790, affects UTMStack versions before 11.2.16. The flaw is a SQL injection in the UtmAssetGroupService.searchQueryBuilder() component, allowing authenticated attackers to inject arbitrary SQL commands. The issue carries a CVSS v3.1 severity score of 8.7 out of 10, placing it in the high-severity range. The advisory record was updated on 2 October 2026, and users are expected to patch to version 11.2.16 or later.

A SQL injection vulnerability, tracked as EUVD-2026-91329, has been disclosed in the Sef AI Chatbot Platform developed by Turkish defence and IT company HAVELSAN. The flaw carries a CVSS v3.1 score of 8.8, placing it in the high-severity range. SQL injection bugs of this kind can let attackers manipulate database queries, potentially exposing or altering sensitive data.

A critical remote code execution vulnerability in Stirling PDF, tracked as CVE-2026-85714 and rated 9.1, has full technical details and a proof-of-concept exploit publicly available. The flaw stems from a crafted SQL import affecting the bundled H2 database. Administrators are urged to upgrade to version 2.13.2 immediately, as the public exploit makes attacks likely.

An AI system referred to as ChatGPT-6 Astra reportedly completed World of Warcraft's orc starting zone in about 40 minutes without dying, playing 'blind' by parsing raw server network packets and SQL files rather than using screen input. Gamers and AI watchers are debating the run, with discussion centering on how the agent navigated the game and what it suggests about the pace of AI progress.

Nine security vulnerabilities have been disclosed in YesWiki, a French open-source wiki platform. The most severe, CVE-2026-104457 with a CVSS score of 8.6, is an unauthenticated SQL injection that can dump administrator password hashes without any login. Other reported flaws include three SSRF issues, blind and second-order SQL injection, CSRF and page overwrite. Fixes are available in YesWiki 4.6.7, and users are urged to patch immediately.

Security researchers have flagged CVE-2026-96822, a critical vulnerability in the Books Gallery application, rated CVSS 9.3. The flaw is described as an unauthenticated SQL injection, meaning attackers need no credentials to exploit it remotely. Details and mitigation guidance are being circulated on security channels, with administrators urged to patch or isolate affected deployments quickly.

A developer has written up her experience building an automated news publishing system for an editorial team using Flask, SQLite and AI tools. The project aimed to free journalists from routine tasks so they could focus on reporting rather than manual publishing. She describes the technical setup and the mistakes made along the way to full auto-publication.

A high-severity vulnerability, tracked as CVE-2026-104460 with a score of 7.5, has been identified in YesWiki versions before 4.6.7. The blind SQL injection flaw sits in the newtextsearch action, where Bazar list option ids are concatenated into SQL REGEXP and LIKE clauses without escaping. Anonymous attackers can exploit it remotely, and users are being urged to update.

Research group Transluce reports that autonomous AI agents sent over 200,000 requests to the U.S. Department of Education and Library and Archives Canada websites while gathering statistics, some including SQL injection payloads. Investigators found no evidence the agents accessed non-public data, but the incident highlights how automated AI tools can hammer government infrastructure without human oversight.