📊 HiddenMerit Morning Post · Issue 77

Focus on Database Frontiers, Practical Insights for DBAs August 17, 2026 ｜ 5 Selected Global Breaking News

01｜Metabase Zero‑Day CVE-2026-72898 (CVSS 10.0): CISA Mandates Fix by August 14, JPCERT Issues Urgent Alert

On August 11, CISA added the critical Metabase SQL injection vulnerability (CVE-2026-72898) to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to remediate by August 14. CVSS score 10.0 (highest risk), with confirmed active exploitation in the wild. Attackers can inject arbitrary SQL via the /reset_password endpoint without authentication, gaining administrator privileges and accessing all connected data sources.

Japan’s JPCERT simultaneously issued an urgent alert, confirming that PoC has been publicly released and attacks may expand further. Third‑party organisations including Framework, Tally, and LexisNexis have already been compromised through this vulnerability.

Remediation: Self‑hosted instances must be manually upgraded to 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, or 1.63.5. Temporary mitigation: block the /api/session/reset_password endpoint. Indicators of Compromise: POST /api/session/reset_password returning 400 followed immediately by GET /api/user/current returning 200. After patching, immediately revoke active sessions, review administrator accounts, and rotate all credentials to connected databases.

DBA Perspective: CISA’s two‑day remediation deadline indicates this vulnerability has been weaponised. Metabase typically holds high‑privilege database connections – once compromised, it can directly access downstream production databases. All DBAs using Metabase self‑hosted instances should immediately upgrade and rotate credentials. JPCERT’s concurrent warning that PoC is public means the attack window is rapidly closing.

02｜OceanBase Launches Series A Funding Round: Targeting RMB 2‑3 Billion, Annualized Revenue Exceeds RMB 1.4 Billion, Benchmarking “China’s Databricks”

According to Bloomberg, Ant Group’s independent database company OceanBase launched its Series A funding round in late July, targeting approximately RMB 2‑3 billion, and has already engaged with multiple leading investment institutions. This marks OceanBase’s first external funding since its establishment. In March 2024, OceanBase established an independent board of directors with a CEO‑accountable governance structure.

Key Data: In 2026, OceanBase’s annualized revenue has exceeded RMB 1.4 billion (approximately $200 million), representing approximately 70% year‑on‑year growth. According to IDC, OceanBase ranked first in China’s distributed database on‑premises deployment market share in 2025, competing with Huawei and Tencent. One‑third of central SOEs have deployed core systems on OceanBase, covering critical industries including transportation, energy, and telecommunications.

Strategic Benchmarking: Bloomberg reports that OceanBase is targeting Databricks as a competitive benchmark – Databricks’ annualized revenue has reached $5.4 billion, with AI products contributing $1.4 billion. Three Ant Group subsidiaries are simultaneously pursuing independent financing: Ant International completed a Series A round of approximately $1.2 billion in July, and Ant Digital is preparing for a Pre‑IPO round.

DBA Perspective: OceanBase’s first external funding is a landmark event for domestic databases moving toward “market‑oriented independent operations.” Benchmarking against Databricks means its strategic direction is extending from a “database company” to an “AI data platform” – DBA skills need to expand from “distributed database operations” to “AI data platform architecture and multi‑modal data management.”

03｜Dameng Wins CNOOC Data Center Upgrade Project: Energy Sector Xinchuang Expands

Recently, Dameng won the bid for the CNOOC data centre infrastructure upgrade project. This represents another key breakthrough in the energy sector for Dameng, following its successes in finance and government, indicating continued deepening of domestic database penetration in central SOE energy core systems.

Dameng’s 2025 revenue was RMB 1.306 billion, with net profit of RMB 515 million. The company’s strategic focus is gradually shifting toward the next‑generation database all‑in‑one business, matching the dual demands of autonomous control and extreme performance in finance, energy, and telecommunications through deep hardware‑software integration.

DBA Perspective: Dameng’s CNOOC win is further evidence of deepening energy sector Xinchuang. Energy core systems demand extremely high real‑time performance, high availability, and disaster recovery capability from databases. Dameng’s continued breakthroughs in energy central SOEs provide DBAs with a quantifiable reference benchmark for energy industry Xinchuang selection.

04｜DTCC 2026 China Database Technology Conference This Week: Five Core Themes Cover Kernel Self‑Development, Data+AI Integration, and Xinchuang Implementation

From August 20‑22, the 17th China Database Technology Conference (DTCC 2026) will be held in Beijing. The conference focuses on five core themes: database kernel self‑development, Data+AI integration, Xinchuang domestic implementation, vector database ecosystem, and intelligent autonomous database operations, with 15+ specialised technical tracks.

Key Highlights:

Kernel Frontiers: JD.com’s self‑developed distributed database DongSQL architecture, database and AI underlying compute integration, database as an application execution platform.
Data+AI Integration: Low‑cost large model implementation for SMEs, AI‑native databases, agent data engineering.

[quads id="805"]
Financial Xinchuang: Real‑world domestic replacement practices in core systems of major banks, insurance, and payment institutions.
Intelligent Operations: Operations agents, multi‑agent collaboration, AIOps implementation practices.
DBA Perspective: DTCC is the largest technical conference in China’s database field. The five core themes cover the technology directions DBAs are most concerned about in 2026 – kernel self‑development determines technical depth, Data+AI determines application breadth, and Xinchuang implementation determines market space. DBAs are advised to focus on the Data+AI Integration and Intelligent Operations tracks – these two directions will directly impact the skill evolution path for DBAs over the next 3‑5 years.

05｜Beacon CRM Cloud Backup Files Become Attack Entry Point: DBAs Need to Focus on Backup Chain Security

Recently, Beacon CRM, a UK‑based charity and voluntary organisation CRM platform, disclosed that attackers used AWS access keys leaked in the JavaScript build artifacts on its website to steal and export the complete customer database. The attack began on July 27 and lasted approximately 1 hour and 27 minutes, during which a large data transfer surge occurred. Although AWS had static data encryption enabled, the attackers were able to access decrypted data using the stolen legitimate access keys.

This incident reveals a new risk dimension in cloud backup file security – backup files themselves, if lacking cleanliness validation, can become a persistence channel for attackers. The XSS2Shell attack chain shows that after gaining database access, attackers can modify automated backup tasks so that the next backup includes a web shell and backdoor accounts. When administrators restore the backup, they are effectively reinstalling the attacker’s backdoor into the production environment.

DBA Perspective: The Beacon CRM incident reveals the “backup file” attack surface that DBAs have long overlooked – attackers don’t need to breach the database itself; they only need to steal access keys to the cloud backup environment to obtain complete data. For DBAs, backup chain security should include: access controls for backup environments independent of production environments, backup file integrity validation (hash comparison, timestamp checks), and cleanliness validation after backup restoration. Backup files are not a “safe haven” – they are a high‑value target for attackers.

📚 SQL Little Knowledge Point

This Issue’s Knowledge Point: What is “Backup Cleanliness Validation”?

“Backup cleanliness validation” is the process of confirming that backup files have not been written to or tampered with by third parties between creation and restoration.

Three Practical Indicators:

File Hash Changes: Compare the backup file’s SHA‑256 hash against the hash recorded during the last full backup. If the hash doesn’t match, treat as contaminated (attackers may add a few lines of code to functions.php – file size may remain nearly identical but the hash will be completely different).
Backup Timestamp Anomalies: Check creation and modification times. If the modification time is more than 5 minutes later than the creation time, it indicates the backup file was touched after generation.
Abnormal Writes in Restoration Logs: Check restoration logs for file paths that don’t belong to the original site (e.g., /tmp/xxx.php or /wp-content/uploads/2026/08/shell.php) – any such entries indicate the backup has been contaminated.

Beacon CRM Lessons: Backup chain security involves not only file integrity, but also protection of cloud backup environment access keys – attackers don’t need to breach the database itself; they only need to steal backup environment credentials to obtain complete data.

HiddenMerit Team Production Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.