We are excited to announce our September meetup! The eighth event of 2026 will take place on Monday, November 30th at 17:30

Lightning talks Submissions => [email protected]

Agenda:
17:30 Doors open
17:45 - 18:00 Host Introductory talk
18:00 - 18:45 Extend your PostgreSQL: The world of PostgreSQL extensions by Devrim Gündüz
18:45 - 19:00 Coffee Break
19:00 - 19:45 Nobody Gets to Be Superuser (Until I Broke In) by Mehmet Ince
19:45 - 20:30 Networking
20:30 End of event

Speakers:
Devrim Gündüz is a long-time PostgreSQL, Red Hat, Fedora contributor, and also working on some more open source projects. He is responsible for the PostgreSQL YUM and ZYPP repositories for RPM based distributions.
His career started as a system administrator, and now he is working as PostgreSQL expert at EnterpriseDB. Lives in London, UK.

Mehmet Ince is a hacker at heart, with more than two decades of experience across offensive security, vulnerability research, and cybersecurity product engineering. He is the co-founder and CTO of PRODAFT, a Europe-based threat intelligence company helping organizations understand, track, and respond to advanced cyber threats.

Throughout his career, Mehmet has discovered and responsibly disclosed more than 300 zero-day vulnerabilities across widely used products, platforms, and enterprise technologies. His work sits at the intersection of research, attacker behaviour, and real-world product engineering, where building and breaking systems often inform each other.

Talks details :
Extend your PostgreSQL: The world of PostgreSQL extensions by Devrim Gündüz :
Extension concept is a big feature of PostgreSQL and users can add interesting capabilities to their database instances using them.

In this talk I will cover these topics:

How it started: "Contrib"
Introduction of extension concept
Challenges around extensions: Distribution and packaging
Developing an extension: Anything can happen?
Maintenance of existing extensions
Favourite extensions: Data from users

Nobody Gets to Be Superuser (Until I Broke In) by Mehmet Ince
Managed PostgreSQL services give each customer an apparently isolated database instance, and work hard to guarantee one thing: the customer never becomes a superuser on it. This talk examines why that boundary matters and how similarly it fails across the industry.

In this talk, I will discuss months of research and how I found ways to escalate privileges to superuser on nearly every managed Postgres provider. The bug differs each time, which could be a logical vulnerability in the privilege-relaxation extension, or cloud-native underlying software mistakes affecting vendors, memory corruption bugs on extensions that everybody installs and so on. What stays the same is the set of root causes behind them.

Looking forward to meeting you all again!

Prague Postgresql Meetup #8

Registration