SQL databases

Ultorg, a tool that presents relational databases through a direct visual interface instead of SQL queries, is drawing attention online. The project lets users browse, join and edit related tables interactively, promising spreadsheet-like ease for database work. Discussion centres on whether this approach could make relational databases accessible to non-programmers and how it compares with existing query tools.

Grist, the open-source spreadsheet-database hybrid, has published a walkthrough showing how to perform running totals and other SQL-style window function calculations directly in a spreadsheet. The feature lets users apply analytics like cumulative sums and row comparisons without exporting data to SQL tools. Spreadsheets have long lacked native window functions, and the post is drawing attention from data and developer communities interested in spreadsheet-based analytics.

A new open-source project called QueryAPIGate has been introduced, offering a self-hosted gateway that sits between databases and anything requesting their data, including apps, dashboards, partners and AI agents. Users save a SQL query and it becomes a REST endpoint, with every call subject to the same API keys, rate limits and column-level controls. The project is being shared with the Fediverse community.

A new tutorial explains how to install Osquery, an open-source agent that lets administrators query a Linux system with SQL as if it were a database, on an Ubuntu virtual private server. The guide covers what Osquery does, such as listing running processes and checking open ports, and takes readers through the installation steps on Ubuntu. It is aimed at server administrators looking to monitor system state using SQL queries.

Security reports describe seven unpatched vulnerabilities in phpMyAdmin, the widely used database administration tool. The flaws reportedly allow SQL injection and authentication bypass, potentially giving attackers access to servers and their databases. Administrators are being urged to review their phpMyAdmin deployments, restrict access, and apply hardening measures while awaiting official fixes.

A new article on Boring SQL examines TABLESAMPLE, the SQL clause that samples rows from large tables, and explains how databases actually choose which rows are returned. The piece walks through the semantics that often surprise developers, since results are not truly random and behave differently across database engines. Readers on Hacker News are discussing the nuances and practical implications for analytics queries.

Oracle has introduced Deep NL2SQL, a technology that converts natural language questions into SQL database queries. The system is knowledge-driven, drawing on stored business context, and improves over time through user feedback on query results. The approach aims to make database analytics accessible to non-technical users and reduce reliance on hand-written SQL across enterprise data environments.

PingCap has made its TiDB distributed SQL database, which supports hybrid transactional and analytical processing (HTAP), available as a cloud service. The move lets companies run transactional and analytical workloads on a single scalable database without managing their own infrastructure. It reflects the wider industry shift toward cloud-native, managed database offerings and puts PingCap in competition with established cloud database providers.

A high-severity vulnerability, EUVD-2026-107273, has been disclosed in the WordPress plugin Ajax Search Lite by vendor WPdreams. The flaw is a blind SQL injection with a CVSS v3.1 score of 9.3, meaning attackers could potentially read or manipulate the site's database through the plugin's search function. The record was updated on 21 October 2026.

A high-severity vulnerability, tracked as CVE-2026-111686 with a CVSS score of 7.5, has been disclosed in IceCMS through version 4.1.5. The flaw is an unauthenticated SQL injection in the num path parameter of the /WebArticle/findarticlesbynum endpoint, letting remote attackers append crafted SQL after the LIMIT clause and potentially access or manipulate database content.