2 Bytes Was Enough To Breach The US Treasury

In December 2024, state-sponsored Chinese hackers breached the US Treasury by exploiting a fundamental flaw in the PostgreSQL database via a remote support software, Beyond Trust. The vulnerability involved misinterpreting a special two-byte sequence that allowed harmful SQL injection, despite following security protocols. The flaw, discovered by researchers at Rapid7, was later patched by both Beyond Trust and PostgreSQL, highlighting the importance of constantly reviewing security measures.