📊 HiddenMerit Daily · Issue 40

Focus on Database Frontiers, Practical Insights for DBAs June 10, 2026 ｜ 5 Selected Global Breaking News

01｜Alibaba Cloud Launches MongoDB 8.3 Domestically: Three AI‑Native Capabilities, Saying Goodbye to “Add‑On” AI

In early June, Alibaba Cloud became the first in China to launch MongoDB 8.3. This version deeply integrates three major AI capabilities – vector search, auto‑embedding, and intelligent O&M – into the database engine, introducing an “AI‑Native” design philosophy – not “add‑on” AI support, but letting AI capabilities natively “grow” inside the database engine, achieving native search, native vectorisation, and native O&M.

The Three AI‑Native Capabilities:

• Native Search: Vector and full‑text search are built into the engine layer; a single pipeline completes hybrid search combining “vector + full‑text + scalar,” with $rankFusion stage using the RRF algorithm for score fusion, eliminating the need for applications to switch between multiple systems.
• Native Vectorisation: Write‑time auto‑embedding, transparent to applications, zero sync overhead; the engine layer automatically listens for data changes via Change Stream, calls models to generate vectors, writes back to documents, and triggers index updates.
• Native O&M: Natural language management, AI‑assisted slow query analysis, index recommendations, and parameter tuning, covering all versions; this capability is not limited to 8.3 but covers all versions of Alibaba Cloud MongoDB.

MongoDB 8.3 also delivers impressive OLTP performance: compared to version 8.0, write throughput increases by 35% , read throughput by 45% , and ACID transaction throughput by 15% , all without any application code changes.

Alibaba Cloud is the only cloud vendor in China that can provide the latest version of MongoDB, consistently maintaining a release cadence in sync with the open‑source version. Currently, MongoDB 8.3’s hybrid search capability is still in invite‑only testing, while auto‑embedding and console natural language O&M capabilities are available.

• DBA Perspective: MongoDB 8.3’s “AI‑Native” design philosophy represents a high‑order form of database AI‑ification. In the past, building a RAG application required DBAs to set up complex ETL pipelines across MongoDB (business data), a vector database (embeddings), and a message queue (sync链路). Now 8.3 completes the entire chain within a single database. The “write‑time vectorisation” capability of auto‑embedding fundamentally eliminates data consistency problems, but also means DBAs must redesign the performance baseline and monitoring strategy for the write path. Moving from “add‑on AI” to “native AI” is a generational shift in database architecture.

• CTO Perspective: Alibaba Cloud’s domestic launch of MongoDB 8.3 is another major milestone in the “AI‑Native” direction for domestic cloud databases, following Tencent Cloud’s AI‑Native 3.0 upgrade. For CTOs planning data architectures for AI applications, MongoDB 8.3’s design of “a single pipeline for hybrid search” and “zero sync overhead” can significantly reduce the data integration complexity and O&M costs of AI applications.

• Investor Perspective: The deep cooperation between Alibaba Cloud and MongoDB shows that domestic cloud vendors are seizing market opportunities by introducing world‑leading AI database capabilities. MongoDB’s AI‑Native approach and domestic databases’ AI‑In‑Database approach form a competitive yet cooperative relationship. Investors should pay attention to differences in customer acceptance between these two technology paths in commercial implementation.

02｜Tencent Cloud Upgrades Full‑Stack Data Platform for Agents: DataBuddy, WeData, and AI‑Native Data Foundation Debut

On June 5, Tencent Cloud announced a full‑stack upgrade of its data platform capabilities for agents, building an intelligent entry point, unified control plane, and data foundation for human‑agent collaboration through a three‑layer architecture: production‑grade data agent DataBuddy, data intelligence platform WeData, and AI‑native big data foundation, helping enterprises build data infrastructure for the agent era.

Intelligent Entry Point DataBuddy: Users can automatically complete complex tasks such as data modelling, ETL development, task orchestration, attribution analysis, and report generation by stating requirements in natural language. Since opening internal testing in May, it has attracted over 3,000 enterprises to apply for trials. In data engineering scenarios, DataBuddy can reduce repetitive development workloads by 80% and improve overall R&D efficiency by 5 to 10 times. Over 90% of common faults can be automatically diagnosed and repaired.

Unified Control Plane WeData: Through unified metadata, data semantics, orchestration, and permission systems, it connects the entire process of data development, machine learning, and AI applications, improving overall R&D efficiency by over 50% . The unified semantic layer沉淀 metric definitions, business terms, and business rules into assets that agents can understand and invoke, increasing natural language to SQL accuracy to over 90% .

AI‑Native Data Foundation: Intelligent upgrades at four levels – storage system, compute engine, system, and data analysis. The new storage architecture reduces storage costs to one‑tenth of traditional solutions and improves retrieval performance by 4.5 times. The self‑developed Meson compute engine improves overall performance in TPC‑DS tests by 3.6 times and reduces CPU resource consumption by 50% . The multi‑agent collaboration system completes complex tasks through SQL Agent, Code Agent, RAG Agent, and Report Agent working together, reducing fault root cause localisation time from 4.5 hours to 30 minutes.

• DBA Perspective: Tencent Cloud DataBuddy’s “natural language → automated O&M” capability means that over 90% of common faults in DBAs’ daily work can be automatically diagnosed and repaired by AI. The DBA role is evolving from “manual troubleshooting” to “agent policy manager” – defining agent operation boundaries, auditing their execution traces, and triggering circuit breakers during anomalies. The unified semantic layer improving natural language to SQL accuracy to over 90% also significantly lowers the barrier to self‑service data access, requiring DBAs to establish quality review mechanisms for AI‑generated SQL.

• CTO Perspective: Tencent Cloud’s full‑stack upgrade for agents covers the complete chain from data foundation to intelligent entry point to unified control plane. For CTOs planning data intelligence platform construction, DataBuddy’s 5‑10x R&D efficiency improvement data is highly compelling, and WeData’s unified semantic layer is an effective solution to the long‑standing pain point of “inconsistent business metrics.”

• Investor Perspective: Tencent Cloud’s layout in agent data infrastructure is synergistic with the AI‑Native 3.0 upgrade we reported in previous issues. DataBuddy attracting 3,000 enterprises to apply for trials within one month of launch indicates strong market demand for “AI‑driven data development.” It is recommended to follow Tencent Cloud’s subsequent commercialisation progress in the AI data platform direction.

03｜OceanBase CEO Yang Bing: The Next Battleground for Databases is Agent‑Friendly and AI‑Native

Xinhua Finance reported that Yang Bing, Vice President of Ant Group and CEO of OceanBase, stated in an exclusive interview that in the future, the direct users of much software and infrastructure will no longer be humans, but various agents. The next battleground for databases is Agent‑Friendly and AI‑Native.

Core Views:

• Agent‑Friendly: The interaction mode of databases must be more friendly to agents, supporting natural language manipulation. In the future, the primary access subjects of databases will shift from human developers to AI agents, requiring databases to redesign access patterns and permission governance systems.
• AI‑Native: Databases must natively support unified storage of multi‑modal data, real‑time fusion of unstructured data (audio, video, etc.) with structured data (orders, products, etc.), avoiding token consumption, inconsistency, and even hallucinations caused by data fragmentation. A real‑time, integrated multi‑modal foundation will become a key feature of next‑generation data infrastructure.

Four Explosion Points in the Next Three to Five Years:

1. Distribution will become the default mainstream, covering at least 50% of scenarios;
2. Multi‑modal and structured data fusion storage will become mainstream;
3. Supporting massive agent applications with极致 elasticity and fine‑grained resource virtualisation;
4. Database O&M becomes fully intelligent, ultimately enabling natural language manipulation of the entire system.

Commercialisation Progress: OceanBase serves over 4,000 customers, with public cloud revenue growing 50% year‑on‑year. In the financial sector, nearly 200 core systems of over 100 banks with assets exceeding RMB 100 billion are running on it.

• DBA Perspective: Yang Bing’s judgment that “the next battleground for databases is Agent‑Friendly” is highly consistent with Tencent Cloud’s concept of “taking agents as new users” reported in previous issues. For DBAs, this means that designing database access patterns for agents will become a new core skill – multi‑tenant isolation, long‑term memory storage, cross‑session context management, and agent audit trails. DBAs are advised to study the access pattern characteristics and resource isolation strategies of agent workloads in advance.

• CTO Perspective: OceanBase serving over 4,000 customers and achieving 50% annual public cloud revenue growth validates the commercial maturity of domestic distributed databases. The four explosion points proposed by Yang Bing provide CTOs with a clear quantitative framework for formulating medium‑ and long‑term data architecture plans. CTOs should focus particularly on the direction of “极致 elasticity and fine‑grained resource virtualisation” – this will directly determine whether a database can handle the concurrency冲击 of massive agent applications.

• Investor Perspective: OceanBase’s evolution from “financial core system replacement” to “multi‑modal AI data foundation” is a key signal that its valuation logic is being upgraded from “Xinchuang” to “AI infrastructure.” The 50% annual growth in public cloud revenue indicates that its cloud service commercialisation has entered the fast lane. Yang Bing’s “four explosion points” provide the market with a macro framework for assessing the growth space of domestic databases in the AI era.

04｜Xinchuang Migration “Deep Water”: Kingware Issues New Standard for Domestic Database Implementation, Moving from “Physical Migration” to “Logical Restructuring”

Recently, CETC Kingware (formerly Renda Kingware) published technical articles titled “Xinchuang Deep Water: A Three‑Year Evolution Roadmap for Databases from ‘Usable’ to ‘Intelligent Use’” and “Enterprise Database Migration: Kingware Defines a New Standard for Xinchuang Implementation.” The articles judge that Xinchuang construction is moving from the “quantity‑meeting” shallows into the “autonomous‑control” deep water, and the industry is no longer satisfied with “seamless replacement,” but requires databases to possess native intelligence, cloud‑native elasticity, and cross‑scenario data convergence capabilities.

The “Full‑Chain Trustworthiness” New Standard: Kingware proposes that the new standard for Xinchuang implementation is “full‑chain trustworthiness” – from the integrity of data migration (RPO=0) and compatibility of application operation, to fault recovery capability under extreme scenarios (RTO<30s), all must be validated in a closed loop. In real‑world tests, KingbaseES V9 supports second‑level fault switching, with RTO指标 stably controlled within 30 seconds.

Three‑Year “Three‑Step” Evolution Strategy:

1. Legacy migration and architecture decoupling (Year 1): Smooth migration of core systems, decoupling applications from databases;
2. Capability enhancement and performance tuning (Year 2): Introduce vector retrieval to prepare the data foundation for AI business;
3. Intelligent convergence and ecosystem restructuring (Year 3): Fully promote cloud‑native deployment, deeply integrate database AI capabilities with upper‑layer business.

Real‑World Validation Data: In a migration case at a large financial institution, after deep tuning of execution plans, the TPS of the core trading system caught up with the original system, and performance in complex report query scenarios improved by over 40% .

• DBA Perspective: Kingware’s proposed “full‑chain trustworthiness” standard provides DBAs with a quantitative evaluation framework for participating in Xinchuang migration projects. The pain point scenario described in the article – “an SQL statement that originally executed in milliseconds became stuck for five minutes after migrating to a domestic database” – is a nightmare many DBAs have truly experienced in domestic replacement. Kingware’s three‑year “three‑step” strategy can serve as a standard methodology for DBAs leading Xinchuang migration projects.

• CTO Perspective: Kingware’s judgment of moving “from physical migration to logical restructuring” is highly consistent with the government cloud selection trends we reported in previous issues. The “full‑chain trustworthiness” standards emphasised in the article – RPO=0, RTO<30s, performance recovery over 95% – provide CTOs with a quantitative indicator system for evaluating domestic database suppliers.

• Investor Perspective: Kingware’s transformation from a “product supplier” to a “methodology exporter” is a sign of the maturity of the domestic database industry. The “Xinchuang deep water” judgment and “three‑year evolution” framework proposed in the article are essentially Kingware defining industry standards and evolution cadence. Vendors with the ability to “define industry standards” will occupy stronger pricing power in the deep‑water Xinchuang replacement.

05｜Weekly Security Vulnerabilities Focus: Chanjet CRM SQL Injection, Appsmith XSS, and Others Disclosed

Multiple database‑related security vulnerabilities were intensively disclosed this week:

CVE-2026-11456 (Chanjet CRM SQL Injection) : Affects Chanjet CRM 1.0. The vulnerability is located in the /tools/jxf_dump_systable.php file, with the gblOrgID parameter having an SQL injection vulnerability. Remotely exploitable, public PoC exists, rated as “Critical” by VulDB.

CVE-2026-7299 (Appsmith XSS) : Affects the Appsmith open‑source low‑code platform (versions before 2.1). The vulnerability is located in the autocomplete renderer of the CodeMirror SQL query editor. An attacker with developer privileges can inject arbitrary JavaScript by creating a malicious database object name containing an XSS payload, which will execute when SQL autocomplete is triggered. Successful exploitation could lead to session hijacking, privilege escalation, or credential theft. Fixed in version 2.1.

CVE-2026-11456 PoC Publicly Available: Exploit code for this vulnerability has been公开 on GitHub. Affected users should upgrade immediately.

• DBA Perspective: The Chanjet CRM SQL injection vulnerability once again warns that enterprise applications such as CRM and ERP are often the “front door” to database security – after attackers breach through application‑layer SQL injection, they can directly reach the database core. The Appsmith XSS vulnerability reminds DBAs that low‑code platform database connectors and query editors can also become attack entry points. DBAs should work with security teams to conduct specialised security audits of application‑layer components with “database read/write privileges” such as CRMs and low‑code platforms, and enforce strict access controls and mandatory parameterised query constraints on publicly exposed management interfaces.

• CTO Perspective: The frequent emergence of SQL injection vulnerabilities at the enterprise application layer indicates that “shift‑left security” has not yet taken root. It is recommended to establish a full‑chain “application layer → database layer” security audit mechanism, and include “high‑privilege applications” such as CRMs and low‑code platforms as regular模拟 attack targets in red‑team exercises.

• Investor Perspective: The continued exposure of enterprise application‑layer SQL injection vulnerabilities will drive enterprise customers to increase procurement of API security scanning and Web application firewalls. Service providers offering DAST, SAST, and interactive application security testing, as well as low‑code platform security audit tools, will see sustained demand growth in enterprise security budgets.

📚 SQL Little Knowledge Point

This Issue’s Knowledge Point: What is Execution Plan “Acclimatisation”?

In database migration scenarios, “acclimatisation” refers to the phenomenon where an SQL statement that executed efficiently on the source database experiences a fundamental shift in its execution plan after migration to a domestic database, leading to a sharp decline in performance.

Typical Symptoms:

• An index scan query becomes a full table scan;
• A millisecond‑response SQL becomes second‑ or minute‑level;
• An efficient table join order is incorrectly chosen by the optimiser.

Common Causes:

1. Statistics Differences: Different statistics collection strategies between source and target databases cause the optimiser to misjudge data distribution;
2. Optimiser Algorithm Differences: Different databases have different algorithms for choosing join order and access paths;
3. Lock Mechanism Differences: Different underlying lock implementations may change lock contention behaviour under high concurrency;
4. Function Implementation Differences: Subtle differences in the underlying execution logic of certain built‑in functions may affect index usage.

Coping Strategies:

• Perform full SQL analysis and execution plan comparison before migration;
• Use production‑scale data volumes for stress testing in the target environment;
• Establish execution plan baselines and validate after migration;
• Use hints or SQL rewriting to intervene on abnormal execution plans.

In a migration case at a large financial institution, after deep tuning of execution plans, Kingbase achieved TPS matching the original system in core transaction scenarios and over 40% performance improvement in complex report query scenarios.

HiddenMerit Team Production Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.