Malicious PostgreSQL Output Plugin Exporting _PG_init with Catalog Tampering

Arnold Chan@slaz

•updated Sep 5, 2026•0•0•6

Detects the presence of PostgreSQL logical decoding output plugins (shared libraries) that export the '_PG_init' initialization function and contain strings indicative of unauthorized catalog modification, privilege escalation, or persistence attempts, often associated with PostGREShell-style attack vectors (CVE-2026-6471).