📊 HiddenMerit Daily · Issue 36

Focus on Database Frontiers, Practical Insights for DBAs June 4, 2026 ｜ 5 Selected Global Breaking News

01｜Microsoft Azure HorizonDB for PostgreSQL Launches Public Preview: Cloud Database Designed for AI Workloads

On June 2, Microsoft officially announced the public preview of Azure HorizonDB for PostgreSQL, a cloud‑native PostgreSQL database built specifically for AI applications, deeply integrating native AI capabilities such as vector search, large model inference, and intelligent index optimisation.

HorizonDB is built on the PostgreSQL kernel and is specially optimised for emerging workloads such as generative AI, retrieval‑augmented generation (RAG), and AI agents. Core capabilities include:

• Native Vector Search: Kernel‑level support for vector indexing, eliminating the need for additional vector database extensions, with significantly better vector query performance than the community pgvector extension.
• AI Inference Integration: Built‑in AI functions allow direct invocation of Azure OpenAI services within SQL for embedding generation and text inference.
• Intelligent Auto‑Tuning: Workload‑aware optimisation based on machine learning, automatically adjusting index strategies and query execution plans.

Microsoft stated that HorizonDB aims to solve the “data fragmentation” pain point in AI application development – developers no longer need to move data between multiple systems (relational database + vector database + cache); a single database can uniformly manage both business data and vector embeddings.

• DBA Perspective: Microsoft joining the “AI database” track marks that all three major cloud vendors (AWS, Google Cloud, Azure) have completed their strategic layouts for AI‑native databases. HorizonDB’s “kernel‑level vector search” directly competes with the AI‑In‑Database approaches of Alibaba Cloud PolarDB and Tencent Cloud TDSQL. When selecting cloud platforms, DBAs will increasingly need to consider AI‑native capabilities as a key decision factor. It is recommended to monitor HorizonDB’s actual performance under mixed workloads and its integration depth with the Azure AI service ecosystem.

02｜Oracle Shifts to Monthly Security Updates: First CSPU Fixes 35 Vulnerabilities, Including 11 Critical

On June 2, Oracle released its first Critical Security Patch Update (CSPU) , marking a shift from the traditional quarterly CPU model to a dual‑track mechanism of “quarterly CPU + monthly CSPU.” This CSPU fixes a total of 35 vulnerabilities, of which 11 are rated Critical, 18 High, and 6 Medium.

Critical Vulnerability Details:

It is worth noting that public PoC exploit code already exists for some vulnerabilities (e.g., CVE-2025-15467, CVE-2025-58050). CVE-2025-58050 was first公开 as early as August 2025, highlighting the time‑lag problem in fixing open‑source component supply chain vulnerabilities.

Oracle stated that the monthly CSPU aims to provide “targeted, high‑priority security fixes in a smaller, more focused format, enabling patch application with minimal disruption.” Future CSPUs will be released on the third Tuesday of each month, with initial planned dates of June 16, July 21, August 18, and September 15. Oracle Cloud customers will receive patches automatically.

• DBA Perspective: Oracle’s shift to monthly security updates is a response to the surge in vulnerability volume. For DBAs, this means a significant change in security operations cadence – adjusting from a quarterly patch window to a monthly “emergency patch” response. CVE-2026-46833 (CVSS 9.0) affects the Net Service component, the core entry point for database network communication. Users of versions 23.4.0 to 23.26.2 must prioritise patching. The concentrated爆发 of multiple critical vulnerabilities in the REST Data Services component means that if an enterprise exposes API interfaces through ORDS, the patch priority should be set to P0. Public PoC for older vulnerabilities such as CVE-2025-58050 is already available, and it is recommended to include them in this patch window as well.

• CTO Perspective: Oracle’s shift to monthly updates represents a significant upgrade in security threat response speed. Technology decision‑makers need to assess the impact of monthly CSPUs on internal change management processes. It is recommended to establish a “monthly security baseline” mechanism, incorporating Oracle patches into CI/CD gates. At the same time, vulnerabilities like CVE-2025-58050 – where a public PoC exists but remains unfixed for a long time – reflect the time‑window issue of supply chain security risks. When evaluating technology stacks, CTOs should include vendors’ security response speed as a long‑term consideration.

• Investor Perspective: Oracle’s shift to monthly updates is a passive adaptation to the surge in vulnerability volume and the accelerating speed of attacker response. For Oracle, this means higher security maintenance costs, but it may also drive enterprise customers to subscribe to its automated patching services. Investors should monitor the automated patch coverage of Oracle Cloud services, as well as customer feedback on “increased security operations complexity” – which could become another driver for cloud‑native databases to replace traditional commercial databases.

03｜CITIC Securities Procures Xinchuang Database for RMB 8.5 Million: Head Broker Core Trading System Xinchuang Accelerates

On June 2, the transaction candidate announcement for CITIC Securities’ “New Generation Core Trading System Database Procurement Project (Second Round)” was released. Beijing ZYXT Technology Co., Ltd. became the first transaction candidate with a bid of RMB 8,499,973.00 (approximately $1.18 million).

The procurement method was open competitive negotiation, with the content being “Xinchuang database procurement for the new generation core trading system.” The requirements specified that the vendor must provide domestic database products and services capable of meeting the high availability, high concurrency, and strong consistency demands of securities core trading scenarios.

This follows CITIC Securities’ CAP account platform procurement of TDSQL, marking another head broker advancing Xinchuang database replacement in its core trading system. Both CITIC Securities and CITIC Construction Investment Securities belong to the CITIC Group system. The consecutive Xinchuang procurements for core systems by two head brokers signal that securities industry Xinchuang replacement is moving from “peripheral pilot” to “core trading system” depth.

• DBA Perspective: The RMB 8.5 million procurement amount represents a large order in the database procurement space, and the target is the “new generation core trading system” – indicating this is not a simple edge system replacement but a domestic transformation of the broker’s core business. Securities trading systems have extremely high demands on database latency, throughput, and high availability (millisecond‑level response, zero tolerance for interruptions). The DBA team involved in this project would necessarily need deep tuning experience with domestic databases in financial core scenarios. For DBAs focusing on the finance industry, the skill requirements for such projects can serve as a “reference standard” for professional capability building.

• CTO Perspective: Two head brokers – CITIC Securities and CITIC Construction Investment Securities – consecutively implementing Xinchuang procurements for core systems creates a “CITIC series” demonstration effect. This not only provides strong validation of domestic database capabilities in securities core scenarios but will also push other brokers to accelerate their follow‑up efforts. For CTOs in the securities industry who are still观望, the RMB 8.5 million procurement amount can serve as a budget reference, and the technology architecture selection can be used as a benchmarking reference.

• Investor Perspective: A RMB 8.5 million procurement order from a head broker’s core system is direct evidence of deepening domestic database replacement in the securities industry. Consecutive implementations at CITIC Securities and CITIC Construction Investment Securities indicate that the technical maturity of domestic databases in securities core scenarios has gained recognition from leading institutions. It is recommended to monitor the domestic database product line behind the winning vendor, Beijing ZYXT, and the subsequent cadence of order expansion in the securities industry.

04｜Kingware Releases Three Practical Paths for MySQL Migration: “Dual‑Track” Becomes Standard for Core System Migration

On June 3, CETC Kingware published a technical article titled “2026 Architecture Reshaping: Three Practical Evolution Paths for MySQL to Kingbase Migration,” systematically阐述 three reusable evolution paths for migrating from MySQL to KingbaseES V9.

Based on industry evolution logic, the article points out that database architecture in 2026 will no longer单纯 pursue stacking of performance metrics, but will shift toward deep integration of “full‑stack autonomy” and “intelligent endogenous.” The core driver of migration is shifting from “compliance” to “efficiency” – how to achieve smooth transition while ensuring security.

Three Practical Paths:

The article notes that “zero‑downtime” upgrades of core trading systems are a typical business scenario in 2026, requiring RPO=0 and RTO<30 seconds. Kingbase KES RAC technology provides stronger data consistency guarantees. In mixed workload scenarios, traditional MySQL often requires the introduction of additional analytical databases for decoupling, while Kingbase handles both OLTP and OLAP within the same cluster through technologies such as KES TDC.

• DBA Perspective: Kingbase’s three paths provide DBAs with a clear migration methodology framework. Path 1 is suitable for “quick win” scenarios, Path 2 addresses the high availability bottleneck of core systems (RPO=0/RTO<30s), and Path 3 directly addresses the multi‑modal integration needs of AI applications. Notably, the “dual‑track architecture” of “sharding + shared storage cluster” mentioned in Path 2 is becoming the “standard solution” for financial core system migration. When planning migrations, DBAs can classify and evaluate business systems according to these three paths and choose the most suitable evolution route.

• CTO Perspective: Kingware “productising” and “methodologising” the migration paths reduces the decision risk for MySQL users migrating to domestic databases. The three paths cover the full spectrum from lightweight small and medium systems to heavy‑duty core transactions to AI/big data scenarios, providing CTOs with a quantifiable selection and migration framework. Particularly worth attention are the technical maturity of “Kingbase KES RAC” in Path 2 and “multi‑modal convergence” in Path 3 – these directly determine the feasibility of core system migration and the support capability for AI scenarios.

05｜Changguang Group Completes Xinchuang Database Procurement: Energy Industry Xinchuang Replacement Continues to Deepen

On April 24, the Changguang Group Xinchuang Database and Xinchuang Server Operating System Procurement Project was completed, with Qingdao Guorui Information Technology Co., Ltd. as the winning supplier. The procurement includes 5 sets of domestic server operating systems and 1 set of domestic database, with the requirement explicitly stating “domestic database / Oracle compatible.”

Changguang Group is an important enterprise in Zhejiang Province’s energy sector. Its Xinchuang procurement indicates that the domestic replacement process in the energy industry is penetrating from “office systems” to “production support systems.” The “Oracle compatible” requirement reflects the large number of legacy Oracle applications in the energy industry, making database compatibility a core consideration in selection.

• DBA Perspective: Although the procurement quantity at Changguang Group is modest (1 database + 5 operating systems), the “Oracle compatible” technical requirement is highly representative. Traditional industries such as energy and manufacturing have大量 legacy Oracle stored procedures, triggers, and complex SQL, making migration costly and risky. Domestic databases with Oracle compatibility capabilities (such as KingbaseES with >95% PL/SQL compatibility) have a clear advantage in such scenarios. If DBAs want to remain competitive in Xinchuang projects in industries like energy and manufacturing, they should focus on building experience in Oracle syntax compatibility assessment and migration toolchain usage.

• CTO Perspective: Changguang Group’s Xinchuang procurement represents the typical rhythm of “catch‑up” Xinchuang replacement in the energy industry – modest procurement volume but明确 requirements. For CTOs, the most important thing in such projects is “smooth transition,” making “Oracle compatibility” a core metric. It is recommended that CTOs in the energy industry, when selecting, prioritise evaluating the automatic conversion rate of domestic databases for legacy PL/SQL objects and the operational stability after migration.

📅 Recent Database Hot Topics Recap

📌 Issue Summary

HiddenMerit Team Production Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.