Liquibase today announced the general availability of Liquibase Secure 6.0, a major release that makes it easier for enterprises to automate and govern database change across mission-critical applications, data products, and AI initiatives.
The way enterprises build and deliver technology is changing quickly. Application and data teams are releasing more often, developers have more autonomy, and AI is dramatically increasing the volume of code and database change enterprises produce. But the controls around database change have not kept pace. Policies are still often scattered across pipelines, configuration files, repositories, and teams, making them difficult to manage consistently as organizations scale.
Liquibase Secure 6.0 changes that model by moving database change governance from pipeline-by-pipeline configuration to enterprise scale. Organizations can see database change across the enterprise, understand and remediate issues when they occur, define and manage policies from one place, set governed exceptions when they are needed, and control who has the authority to manage those policies. It gives enterprises a simpler way to answer three questions that become harder as the volume of change grows: What changed? Was it allowed? Who controls the rules?
Change Intelligence Turns Database Change Visibility Into Action
At the center of Liquibase Secure 6.0 is Change Intelligence, a completely new capability that gives enterprises a clearer picture of database change across applications, pipelines, teams, and environments.
Database teams have historically had to reconstruct what happened from pipeline logs, tickets, screenshots, and other disconnected sources. That becomes especially painful when something goes wrong. Teams need to understand what changed, where it failed, whether environments have drifted, what risk was introduced, and what they should do next.
Change Intelligence brings deployment activity, environment status, drift, policy outcomes, failures, and change history together in one place. Teams can understand how changes are moving across environments, identify where risk is building, and see what needs attention without manually piecing together the story across individual pipelines and tools.
More importantly, Change Intelligence helps teams move from visibility to action. When a deployment fails, AI-driven analysis helps teams understand what happened and provides remediation guidance to resolve the issue faster. Change Intelligence also centralizes audit evidence, giving engineering, security, and compliance teams a structured record of database change throughout the delivery lifecycle.
For executives and operators alike, Change Intelligence helps enterprises understand what is happening across the database estate, identify problems faster, and determine what to do next.
Making Enterprise Database Change Governance Easier
Governance has traditionally come with a tradeoff. Enterprises want consistent standards and stronger controls but they don’t want to create another layer of process that slows down delivery.
Liquibase Secure 6.0 also introduces a new graphical interface for policy management that makes governing database change much easier. Teams can create, organize, apply, and manage policies from one place instead of relying on pipeline-by-pipeline configuration or specialized command-line knowledge.
The new experience includes 50+ prebuilt policy rules based on years of working with some of the world’s largest and most complex enterprises. Teams can start with proven controls, organize them into reusable policy packages, and apply them across the applications and environments where they are needed.
The new experience also makes exceptions part of the governance model rather than something teams have to work around. When a legitimate exception is needed, teams can scope where it applies, document why it exists, control who can make it, and retain the decision in the audit history. Organizations can maintain consistent standards without pretending every application, data product, team, or database operates exactly the same way.
Controlling Who Can Change the Rules
As database change governance moves from individual pipelines to the enterprise, organizations also need control over who owns and manages those standards.
Liquibase Secure 6.0 introduces role-based access control that determines who can manage policies, assignments, exceptions, and governed assets. Organizations can separate ownership of governance from application and data delivery, creating clear responsibilities around who defines the rules and who works within them.
This allows enterprises to maintain separation of duties without taking autonomy away from development teams. Developers can continue moving quickly inside established boundaries, while database, platform, security, and compliance teams maintain control over the standards that protect the organization.
Together, Change Intelligence, centralized policy management, and role-based access control create a new operating model for database change. Enterprises can see what changed, govern what is allowed, and control who owns the rules from one platform rather than stitching together controls across individual pipelines.
Governance as a Force Multiplier for AI
AI is increasing how quickly enterprises can build and deliver applications and data products. But that advantage erodes if every increase in development speed creates a corresponding increase in manual review, operational risk, and governance overhead.
That is why governance becomes a force multiplier for AI. When database standards are defined up front and enforced automatically, enterprises can move faster with AI without requiring a human to review every database change it helps create. Whether a change is written by a developer or generated with AI assistance, the same policies and controls can be applied before it reaches production.
The goal is not to slow AI down so existing governance processes can keep up. Liquibase Secure 6.0 makes it possible for governance to operate at the speed of development, giving teams the freedom to increase the speed and volume of change while maintaining the controls the enterprise requires.
That model extends beyond AI. Liquibase Secure supports more than 65 database platforms, giving organizations a consistent governance layer across heterogeneous database environments. Platform and DevOps teams can scale database self-service without scaling governance overhead, database teams can spend less time rebuilding controls and reviewing routine changes, and security and compliance teams can put controls and evidence closer to the point of change.
As mission-critical applications, data products, and AI initiatives increase the speed, volume, and sources of database change, Liquibase Secure 6.0 gives enterprises one place to see that change, govern how it happens, and control who can change the rules, whether the change comes from a human or AI.
Liquibase Secure 6.0 is generally available September 30, 2026. The release includes Change Intelligence, the new graphical interface for centralized policy management, role-based access control, governed exception management, and 50 prebuilt policy rules.
For more information about Liquibase Secure 6.0, visit www.liquibase.com/liquibase-secure.
The Dutch Institute for Vulnerability Disclosure Pwned By AI
Posted in Commentary with tags Hacked on October 1, 2026 by itnerdThe the Dutch Institute for Vulnerability Disclosure has apparently been pwned. That in itself is not news. What is news that is was pwned by AI:
Late last week, the organization said it had been hacked after seven years of uneventful operations, with the intrusion carried out autonomously by an AI agent.
The organization described the attack as “loud and very very messy,” leaving plenty of evidence to help them reconstruct what happened, but the incident was serious nonetheless.
“This is an attack we have not seen before. Not because it’s our first, but because the modus operandi indicates that this is an agentic AI-powered attack,” DIVD explained.
The organization launched an investigation and informed the police, the Autoriteit Persoonsgegevens (data protection), and the National Cyber Security Center (NCSC).
In an update on Monday, DIVD provided additional information about the incident but withheld full details to avoid influencing the investigation or putting more victims at risk.
John Strand, Owner, Black Hills Information Security (https://www.linkedin.com/in/john-strand-a1b4b62)
“This story highlights what AI is really, really good at. Exploit development isn’t like Hollywood. It takes a lot of fuzzing, scripting, and grinding through different possibilities. It’s tedious work, and that’s exactly the kind of research AI is suited for. Running that research in parallel to find zero-days is a natural fit. I think that’s the biggest lesson we should take from this story.”
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security (https://www.linkedin.com/in/darinfredde)
(https://www.linkedin.com/in/darinfredde)
“When a vulnerability disclosure organization gets breached, the response matters as much as the breach. DIVD detected the intrusion within a day, stopped the attackers from moving deeper, and, with Merlon Security, identified two Zammad zero-days (CVE-2026-102489 and CVE-2026-102490). They reported them to the vendor three days after the breach and began notifying exposed owners two days after that. That is coordinated disclosure doing its job: one organization’s incident becomes everyone’s early warning.
“AI-enabled offense is helping us find subtle weaknesses faster, and like every tool ethical hackers and threat actors have always shared, it cuts both ways. What’s new isn’t the dual-use nature, it’s the tempo and economics. Google’s threat intelligence team reports that likely AI-discovered vulnerabilities lead to remote code execution at nearly twice the rate of others, and Mandiant finds exploitation now arrives, on average, before the patch. DIVD itself described the attack chain reaching root ‘in seconds.’ In my view, ‘cat and mouse’ no longer describes where we are. We’re moving toward machine-speed, multi-stage attacks, and no organization is immune.
“The answer is continuous offensive rigor: test, find, fix, prove the control works, and keep testing as the environment changes. Public counts likely understate AI’s role in discovery, which makes continuous testing and coordinated disclosure more urgent, not less. We cannot do this alone.”
Steven Swift, Managing Director, Suzu Labs (https://www.linkedin.com/in/steven-swift-5238956a)
“DIVD described the agent used in this attack as being sloppy, and leaving artifacts where the agent left comments where it over-explained the activity it was performing. And that generally the agent was loud, messy, and disorganized.
“Despite that, it still successfully exploited a public host by chaining two zero days to escalate privileges to root, and then gain RCE, allowing the attacker full permissions to execute whatever follow up they wanted.
“Despite flashy headlines, there wasn’t much novel about this attack. Two zero days were burned to gain access. Its not particularly common to utilize zero days to gain access, it’s much much more common to simply exploit unpatched systems, because so many systems don’t patch promptly. So the specific CVEs were new, but the techniques were old.
“Once access into DIVD systems was gained, the attack moves to what is called the post exploitation phase. This is where the attacker has access inside the environment, and can choose what they want to do with that access. In this case, it appears they set an agent loose rather than using any of the pre-existing post exploitation toolkits. We’ve had years of sophisticated tools that skilled attackers can use in this phase of the attack. But we didn’t see that here. Instead, and agent poked around the network, made a lot of noise, connected to various systems, stole some data, and generally left a lot of logs and evidence for DIVD to alert on and respond to.
“The good news for DIVD is that the attack left a lot of evidence behind. This made detection easier, and provides adequate artifacts to review during the investigation to put together a timeline of activity.”
This attack might have been sloppy. But OpenAI for example has agents who are not sloppy. This an example of that. And make no mistake that one of those agents are coming for you real soon.
Leave a comment »