📊 HiddenMerit Daily · Issue 11

Focus on Database Frontiers, Practical Insights for DBAs May 6, 2026 ｜ 5 Selected Global Breaking News

01｜Twenty-Year-Old Vulnerabilities Exposed: AI Security Tool Finds Core Memory Safety Flaws in PostgreSQL and MariaDB

At Wiz’s ZeroDay.Cloud security conference, security researchers using the AI‑powered security analysis tool Xint Code disclosed a set of serious vulnerabilities that have lain dormant in the PostgreSQL core extension pgcrypto for two decades, as well as a heap buffer overflow vulnerability (CVE-2026-32710) in MariaDB’s JSON_SCHEMA_VALID() function. The PostgreSQL vulnerabilities are tracked as CVE-2026-2005 (CVSS 8.8) and CVE-2026-2006 (CVSS near 9.0). CVE-2026-2005 is a heap buffer overflow issue. An attacker can craft specific input to trigger a size mismatch that leads to out‑of‑bounds writing on the heap. In environments where pgcrypto processes user‑controlled input, this can be exploited for remote code execution (RCE) on the database server. Researchers noted that the vulnerable code has existed since pgcrypto was first contributed in 2005 – over twenty years. The flaws have been fixed in versions v18.2, v17.8, v16.12, v15.16, and v14.21. However, Wiz analysis found that among cloud environments using PostgreSQL, 45% are still directly exposed to the internet. Users affected by CVE-2026-2005 must upgrade immediately to the patched versions.

· DBA Perspective: The twenty‑year‑old vulnerabilities loudly declare that the assumption “old code never rusts” is wishful thinking. pgcrypto, a standard dependency for almost all high‑security PostgreSQL deployments, has likely been a dark corner whose security implementation was never audited. Now AI‑powered vulnerability discovery tools are exposing such long‑dormant memory safety flaws. Three urgent actions must be taken: take inventory of production versions and extension loading with SHOW server_version; and SELECT * FROM pg_extension WHERE extname = ‘pgcrypto’;; audit which applications feed external input into pgcrypto; and patch internet‑facing instances first during a non‑critical window. · CTO Perspective: PostgreSQL has long been considered highly mature and well‑audited. These two‑decade‑old vulnerabilities show that even the most trusted open‑source components can harbor long‑cycle flaws. Technical leaders should add continuous AI code scanning or automated auditing mechanisms for critical open‑source modules to their security baselines, and should never assume that “long history automatically brings security.” · Investor Perspective: Following the XZ backdoor crisis and Log4j, the “supply chain soft spot of foundational open‑source modules” is again under the spotlight. Such events will accelerate the shift of enterprise security budgets toward SCA tools, AI‑powered vulnerability discovery, and automated patch management. Startups with these capabilities are likely to enjoy significant valuation premiums in enterprise security procurement.

02｜Oracle Pledges a “New Era” for MySQL: Vector Features to Community Edition, Independent Foundation in the Works

Facing strong criticism from the developer community over MySQL’s stagnant development and months‑long gaps with no new code commits, Oracle recently promised to take a “decisive and new approach,” including replacing MySQL engineering leadership. Its “three‑pronged” strategy includes: moving developer and AI‑critical features (such as vector capabilities) to the open source Community Edition; expanding the ecosystem by providing more tools and connectors; increasing roadmap transparency and encouraging community contributions (work logs and bug reports). Meanwhile, a proposal for an independent MySQL Foundation, initiated by influential members of the MySQL community, has gathered approximately 100 signatures. The goal is to establish a non‑profit organisation to support the MySQL community, and the initiators hope Oracle will participate in the actual preparatory work.

· DBA Perspective: Just after MySQL 8.0 reached EOL on April 30, Oracle offered the promise of “AI‑grade vector features to the Community Edition” to calm developers – timing is telling. If the foundation plan becomes reality, MySQL’s future roadmap will have a stronger community‑driven component. But DBAs are advised to maintain cautious optimism – actual code output matters more than verbal promises. Pay attention to the foundation’s actual timeline and governance details in upcoming webinars, and observe whether Oracle consistently delivers on its promises or stays at the PR level. · CTO Perspective: PostgreSQL’s growing community vitality and the leap in pgvector performance are eroding MySQL’s share of new projects. Oracle’s attempt to win back developers through openness also sends CTOs a signal: adopting MySQL still comes with both community and commercial support for the next 3‑5 years. CTOs need to closely watch the actual governance structure and funding of the independent foundation – this will directly determine the predictability of MySQL’s long‑term roadmap. · Investor Perspective: The openness of the MySQL ecosystem directly affects the enterprise value of MariaDB and other MySQL‑compatible products. Oracle’s move to give vector features to the Community Edition represents a competitive shock to vendors that rely on charging for MySQL enterprise proprietary features. Changes in governance will be continuously reflected in long‑term valuations. At the same time, the speed of the independent foundation’s formation and the level of industry support should become soft indicators for evaluating Oracle’s long‑term competitiveness in its database business.

03｜Three Major Cloud Giants Simultaneously Bet on Apache Iceberg: The Cross‑Cloud Lakehouse Battle Begins

At the Google Cloud Next’26 conference, Google officially launched its Cross‑Cloud Lakehouse, built entirely on the standardised open table format Apache Iceberg. This is not BigQuery‑proprietary tables nor Google’s own format – data resides directly in the user’s own object storage, and any engine (BigQuery, Dataproc, Spark, etc.) can read it. This announcement marks the end of the compute‑format war: AWS has already launched S3 Tables with built‑in Iceberg; Microsoft has embedded Iceberg into OneLake and Fabric; Snowflake has open‑sourced Polaris as an Iceberg catalog (with AWS, Google, Microsoft, and Salesforce already signed on); and Databricks acquired Tabular, the company founded by the Iceberg creators, for over $1 billion and is advancing unification between Delta and Iceberg.

· DBA Perspective: The melting of Iceberg completely liberates data from vendor lock‑in: regardless of which cloud vendor you choose, as long as the format is Iceberg, your data foundation can freely move. The DBA’s role will expand from “maintaining a single engine” to “managing a federated view of a shared data layer” – data resides in your own account and your own storage bucket, readable by any engine, an architecture previously available only to the largest enterprises. DBAs need to start learning Iceberg’s table format design, snapshot isolation, time travel, and partition evolution principles, preparing early for the next‑generation lakehouse architecture. · CTO Perspective: Four hyperscale cloud vendors have reached a rare consensus on a single open table format – this is a generational shift in data architecture. For technology decision‑makers, the direct benefits of Iceberg are eliminating vendor lock‑in, unified cross‑cloud governance, and avoiding duplicate data storage. From a CTO perspective, “Iceberg support” should become a baseline requirement for data platforms, not just a nice‑to‑have. · Investor Perspective: The emergence of an open data format as a de facto standard will reduce cross‑cloud switching costs for users and compress the lock‑in premium of individual cloud vendors. But Iceberg itself does not directly generate commercial revenue; its technology value must be indirectly monetised through upper‑layer commercial services. Companies like Snowflake, Databricks, and Salesforce are actively advancing the Iceberg ecosystem, and startups in metadata management, data quality governance, and unified analytics may see a new valuation window.

04｜Snowflake Stock Down 35% in 2026: High‑Growth Narrative Under Scrutiny, May 20 Earnings as Key Test

Snowflake has fallen approximately 35.7% year‑to‑date in 2026. The continuous downward pressure comes from multiple factors. First, the Q4 FY2026 earnings report (released in late February) showed full‑year revenue of $4.68 billion, up 29%, but a full‑year net loss of $1.33 billion. Investors began questioning whether high growth can support its historically high valuation. Second, a shareholder class action lawsuit filed in late April accuses the company of misrepresenting consumption revenue growth, raising deep concerns about growth sustainability. At the same time, the AI software sector as a whole pulled back in April due to investor concerns about AI cost efficiency, further depressing high‑valuation software stocks. The company appointed a new Chief Revenue Officer in April, adding leadership transition uncertainty. Although Snowflake has launched Snowflake Intelligence and Cortex Code to support its “Agentic Enterprise” strategy, these products have not yet driven a stock price recovery. The Q1 FY2027 earnings call on May 20 will be the most important validation point for the market.

· DBA Perspective: Snowflake’s stock volatility reminds DBAs that high‑valuation growth stocks are highly sensitive to earnings expectations. But it is also worth noting that Snowflake still maintains a net revenue retention rate of approximately 125%, proving that its wallet share from existing customers continues to expand – incremental growth is healthy. Keeping Snowflake’s architecture on your radar and learning its storage‑compute separation, elastic pricing, and instant scaling concepts will directly help build AI data infrastructure capabilities – regardless of the stock price. · CTO Perspective: Snowflake is evolving from a “pure data warehouse” to an “AI agent data platform,” introducing an Agentic Enterprise architecture to serve decision‑making patterns in the AI era. For technology decision‑makers, this is not just about financial metrics – it is an industry bellwether. Whether a data platform can support AI agent workloads will be a common test for all cloud data vendors over the next 12‑18 months. CTOs should proactively track Snowflake’s product evolution and pricing flexibility for AI scenarios – these factors are gaining weight in technology selection. · Investor Perspective: The triple pressure of a $1.33 billion net loss, a shareholder class action lawsuit, and a broad AI sector pullback have caused a significant stock price retreat for Snowflake – but may also bring its valuation into a more reasonable range. Its product innovation direction aligns with long‑term trends for AI agents, but investors need to closely monitor the actual consumption revenue growth data in the May 20 earnings report. This will determine whether the “high‑growth story” can continue to support market expectations.

05｜Google Cloud Next’26 Kicks Off: Cross‑Cloud Lakehouse, Vertically Integrated AI Stack

Google Cloud Next’26 opened recently, with core themes around AI vertical integration and cross‑cloud interoperability. Google announced its Cross‑Cloud Lakehouse, allowing users to directly query data stored in AWS S3 without data migration or building complex ETL pipelines, with expansion to Azure later this year. The architecture is built on the open table format Apache Iceberg. BigQuery, Dataproc, and Spark read Iceberg data directly, and compute engines are fully decoupled from storage – marking the extension of trusted data‑integrated architecture from the public cloud to a multi‑cloud ecosystem. Google Cloud also systematically demonstrated its vertically integrated AI full stack capabilities – from TPU custom silicon, AI large models (Gemini family), platform, to applications. Google Cloud CEO Thomas Kurian emphasised that Google Cloud is the only cloud vendor offering first‑party solutions at all layers while maintaining open connectivity to other infrastructure and data. Alphabet CEO Sundar Pichai noted that Gemini Enterprise paid monthly active users grew 40% quarter‑over‑quarter.

· DBA Perspective: Before this announcement, a cross‑cloud query architecture was essentially a hypothetical scenario that could only be approximated with a hybrid cloud platform. Now DBAs can directly use BigQuery to query data stored on AWS S3 – zero copy, zero ETL. No matter which cloud the original data resides in, the same SQL can be used directly for modelling. The DBA’s management radius will expand from a single public cloud to planning and tuning of a multi‑cloud federated environment. In addition, the Model Context Protocol (MCP) toolbox, which embeds AlloyDB and BigQuery into agent workflows, is also worth tracking. · CTO Perspective: Google Cloud Next’26 announcements mark the transition of multi‑cloud data strategy from a market story to an engineering reality. For CTOs, previously being locked into a single cloud vendor meant that the cost of moving existing data was prohibitively high. Now, with the same Iceberg standard, you can use the same engine to run federated queries – dramatically lowering cloud migration costs. Combined with Google’s differentiation via TPU silicon, offering a full‑stack solution from chip to AI applications, CTOs now have a more complete blueprint for a multi‑cloud AI technology stack. · Investor Perspective: Gemini Enterprise’s 40% sequential growth shows that Google is converting its differentiated AI capabilities into paid cloud revenue. Cross‑cloud querying continues to alleviate customers’ lock‑in concerns, freeing up more share for third‑party cross‑cloud deployments. Pay attention to whether subsequent Google Cloud earnings reports can translate AI traffic into sustained IaaS/PaaS revenue growth – this will directly affect the market’s judgment of Google Cloud’s valuation centre.

📅 Recent Database Hot Topics Recap

Date Event Core Highlights May 4 Wiz ZeroDay.Cloud: AI tool finds 20‑year PG/MariaDB flaws Two‑decade‑old memory vulnerabilities, 45% cloud PG environments exposed May 4 Google announces cross‑cloud Iceberg lakehouse All three major cloud giants bet on open table format May 5 Independent MySQL Foundation proposal gathers ~100 signatures Oracle pledges new strategy, vector features to Community Edition May 5 LakeFusion raises $7.5M seed round Databricks‑native data management platform attracts capital May 5 Kingbase discloses full medical Xinchuang replacement case Healthcare industry moves beyond “real use” deep zone May 20 Snowflake Q1 FY2027 earnings call Key validation point for high‑growth narrative May 29 Tencent Cloud “Database + AI” product launch Domestic AI‑In‑Database route realises

📌 Issue Summary

News Core Keywords DBA Actions CTO/Decision‑Maker Focus Investor Signals AI finds 20‑year PG/MariaDB flaws 20‑year vulnerability, pgcrypto RCE, AI security tool Immediately inventory pgcrypto in production, upgrade to patched versions Add continuous AI code scanning for critical open‑source modules in security baseline Enterprise security budgets accelerate shift toward SCA and AI‑driven vulnerability management Oracle pledges new MySQL era Vector features to Community Edition, independent foundation proposal Maintain cautious watch, focus on foundation governance details Closely track foundation governance structure and funding progress MySQL ecosystem openness affects long‑term valuation of MariaDB and others Three cloud giants bet on Iceberg Cross‑cloud open lakehouse, open table format Learn Iceberg table format principles, prepare for lakehouse architecture Make “Iceberg support” a baseline requirement for data platform selection Iceberg ecosystem opens startup windows in metadata and data governance Snowflake stock down 35% Growth doubts, net loss, AI cost efficiency concerns Learn Snowflake’s storage‑compute separation, track AI data platform evolution Whether data platforms can support AI agent workloads is the next‑12‑months test for all cloud vendors May 20 earnings call is key to validating whether growth narrative can continue Google Cloud Next’26 Cross‑cloud lakehouse, vertical AI stack Learn cross‑cloud federated queries, expand multi‑cloud management radius Cross‑cloud query reduces migration costs; TPU silicon creates full‑stack differentiation Gemini Enterprise 40% QoQ growth – watch if AI traffic translates into sustained cloud revenue

HiddenMerit Team Production Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.