QEMU virtio-gpu CVE fix and PostgreSQL WAL defaults

A QEMU security patch closed a guest-triggered out-of-bounds read in virtio-gpu, while PostgreSQL hackers refined WAL compression defaults for the next major release. Both items touch core infrastructure used by virtualization and database operators.

QEMU virtio-gpu validates blob iov size

A v3 patch to QEMU's hw/display/virtio-gpu code adds validation of blob iov size. The change closes CVE-2026-66021, an out-of-bounds read driven by guest-controlled blob_size values in the create and attach paths. Operators running virtio-gpu should apply the fix to harden guest isolation.

PostgreSQL WAL compression default alignment

PostgreSQL hackers discussed a patch that would make the wal_compression 'on' setting default to lz4. The change follows the project's adoption of LZ4 as the default compressor and aims for consistency in PostgreSQL 19. Database administrators planning upgrades need to account for the new mapping when tuning write-ahead logging.