Loading story…
Check Point Research disclosed that a crafted SQLite database can be weaponized to achieve code execution by exploiting memory-corruption flaws in the SQLite engine itself, even when an application only performs hardcoded queries against untrusted data. The researchers described two techniques—Query Hijacking and Query Oriented Programming (QOP)—that abuse schema elements such as VIEWs and virtual-table features to redirect execution into attacker-controlled paths without requiring a surrounding scripting environment.
The report demonstrated the approach in two practical scenarios: remote code execution against a PHP7-based password-stealer backend and privileged persistence on iOS by replacing a frequently queried SQLite database. The research also pointed to risky virtual-table modules including FTS and RTREE, referenced earlier issues such as CVE-2015-7036 and CVE-2019-8457, and said Apple assigned CVE-2019-8600, CVE-2019-8598, CVE-2019-8602, and CVE-2019-8577 after responsible disclosure.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Check Point Research published findings showing that a malicious SQLite database can achieve code execution through memory-corruption bugs using SQL-language features alone. The work introduced Query Hijacking and Query Oriented Programming (QOP) and demonstrated remote code execution against a PHP7 password-stealer backend as well as iOS persistence via a malicious contacts database.
Following responsible disclosure of the iOS-related findings, Apple assigned CVE-2019-8600, CVE-2019-8598, CVE-2019-8602, and CVE-2019-8577. The reference does not explicitly anchor the date of Apple's assignment beyond the 2019 CVE identifiers.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SQLite patched **CVE-2026-11824**, a high-severity heap buffer overflow in the `FTS5` full-text search extension, in release **3.53.2**. The flaw stems from an integer underflow in `fts5ChunkIterate()` and affects SQLite versions prior to 3.53.2 when compiled with `SQLITE_ENABLE_FTS5`. According to public reporting and SQLite's vulnerability listings, the bug can be triggered when an application opens a crafted database file and runs an `FTS5 MATCH` query. Successful exploitation could cause a denial of service and may enable arbitrary code execution in affected applications. The issue requires specific conditions—most notably that the target accepts an untrusted SQLite database and uses `FTS5` search features—but SQLite's broad use across software and embedded products makes the exposure significant. SQLite addressed the bug with fixes incorporated before the 3.53.2 release and published the update in its official release log and CVE documentation.
Aug 27, 2026
Google Project Zero reported that its **Big Sleep** large language model identified a previously unknown vulnerability in **SQLite**, marking a real-world bug discovery during testing on widely used open-source software. The flaw affects `SQLite 3.47.0` and was traced to the `seriesBestIndex` function, where improper handling of `rowid`-related parameters can allow an invalid negative `iColumn` value. The bug causes a **stack buffer underflow** that can lead to **out-of-bounds heap writes**, creating conditions that may be exploitable for attacks. According to reporting cited by CSIRT.SK, the issue had not been caught by existing fuzzing tools, underscoring the significance of AI-assisted vulnerability research; defenders were advised to update SQLite to the latest available version.
Jul 24, 2026
Attackers exploited a classic SQL injection flaw in a public-facing Java application on Apache Tomcat to compromise an Oracle database server and deploy a custom post-exploitation toolkit, **`khunt`**, directly inside the database. Huntress reported that the intruders abused Oracle's `CREATE JAVA SOURCE` capability and embedded JVM to upload and compile Java modules as database objects, then exposed them through PL/SQL wrappers. The toolkit provided operating system command execution, file access, archive extraction, installation checks, and credential access from Oracle user tables, turning the database itself into a stealthy execution platform rather than limiting the intrusion to data theft or manipulation. The attackers then pivoted from the Oracle database to the underlying Windows host and executed commands with **SYSTEM-level** privileges, enumerated running services, and copied the `SAM`, `SECURITY`, and `SYSTEM` registry hives using PowerShell and native Windows tools, indicating likely preparation for credential dumping and broader lateral movement. Huntress said the activity was detected after credential-theft behavior was observed on July 27 and linked initial access to requests from `178.162.151[.]229`, warning that database-resident Java classes and PL/SQL objects can create a detection blind spot for many endpoint security tools if public-facing applications retain excessive database privileges.
Aug 25, 2026