Segment 1: HiddenMerit Morning Post · Issue 97
Focus on Database Frontiers, Practical Insights for DBAs September 8, 2026 ｜ 5 Selected Global Breaking News
01｜RMB 18.84 Million Contract! Jiangsu Bank Procures Hygon/Kunpeng Servers, Financial Xinchuang Enters “Core Infrastructure” Phase
The results of Jiangsu Bank’s domestic database server procurement project have been announced, with Beijing Advanced Digital Technology winning the bid for RMB 18.84 million. The configuration requires Hygon or Kunpeng domestic CPUs, with large-capacity DDR memory and SSD storage, aiming to meet the high reliability and high performance requirements of the bank’s core business systems for database infrastructure.
Jiangsu Bank is the largest legal-person bank in Jiangsu Province and a listed city commercial bank on the A-share market. This nearly RMB 20 million domestic server procurement marks that financial Xinchuang is advancing from peripheral system pilots to core infrastructure upgrades. The tender notice explicitly requires “Hygon or Kunpeng” CPUs, not simply “domestically compatible.”
DBA Perspective: Kunpeng is based on the ARM architecture, while Hygon follows the x86-compatible path. The NUMA topology, cache coherency, and I/O paths of these two CPU types differ – the characteristics of domestic CPUs are becoming a key variable in database performance. DBAs need to prepare in advance by gaining hands-on database tuning experience on domestic CPU platforms.
📌 HiddenMerit In‑Depth Preview: Today’s in‑depth article – “Behind the RMB 18.84 Million Contract: Financial Xinchuang Moves from ‘Software Replacement’ to the ‘Hardware‑Software Integrated’ Deep Zone” – will explore the industry trends behind the Jiangsu Bank procurement and DBA response strategies.
02｜From China First to Asia‑Pacific First: OceanBase Tops Omdia Asia‑Pacific Distributed Database Ranking
Global technology research and advisory firm Omdia has released its “2026 Asia‑Pacific & Oceania Distributed Database Market Study,” showing that by 2025 revenue, OceanBase ranked first in the Asia‑Pacific and Oceania distributed database market, ahead of Tencent Cloud TDSQL, Google Cloud Spanner, Huawei Cloud GaussDB, and Alibaba Cloud PolarDB‑X.
This is the first time a domestic database has topped an Asia‑Pacific regional market ranking from a third‑party international research firm. Omdia data shows the Asia‑Pacific distributed database market reached $900 million in 2025 and is projected to grow to $1.8 billion by 2029, with a five‑year compound annual growth rate of 19.3%.
Key Data: OceanBase now serves over 4,000 customers globally. In the emerging fintech sector, it has served over 100 enterprises worldwide, covering more than 20 e‑wallets and over 50 payment platforms, cumulatively covering more than 1.3 billion end users. In traditional finance, it has served over 400 financial institutions, with more than 60% deploying OceanBase in core business systems.
Accelerating Overseas Expansion: In August 2026, Banque pour le Commerce Extérieur Lao Public (BCEL) signed a memorandum of understanding with OceanBase to introduce distributed database technology for core banking infrastructure upgrades. Overseas business revenue grew 200% in 2026, targeting an increase from 10% to 20% of total revenue.
DBA Perspective: OceanBase topping the Asia‑Pacific rankings means domestic distributed databases are moving from “domestic replacement” to “international competition.” When a domestic database can simultaneously meet the data compliance and business requirements of different countries – Philippines’ GCash, Malaysia’s TNG – its technology stack’s versatility and maturity have been validated multiple times. The scope of OceanBase skills is expanding from “domestic Xinchuang projects” to “overseas projects.”
03｜Metabase CVSS 10.0 Zero‑Day SQL Injection: Framework, Tally Confirm Data Breaches
The Metabase zero‑day SQL injection vulnerability (CVSS 10.0) is being actively exploited; no CVE has yet been assigned. Attackers can inject arbitrary SQL via the POST /api/session/reset_password endpoint without any credentials, gaining full administrator privileges and exfiltrating credentials and data from connected databases.
Confirmed Victims: Framework (modular laptop manufacturer) reported that attackers accessed its Metabase instance on August 3, exfiltrating customer names, email addresses, login IPs, addresses, and phone numbers. Tally also confirmed its Metabase analytics environment was breached on the same day, with attackers obtaining user emails and password hashes. Additionally, Kilo Code, n8n, and ChecklyHQ have publicly confirmed they were affected.
Attack Scale: Shodan data shows approximately 2,500 Metabase instances are discoverable. Wiz reported that approximately 13% of cloud environments have deployed self‑hosted Metabase, with approximately 25% fully exposed to the public internet.
Remediation: Affected versions cover 0.58.0+ through 0.63.x. Self‑hosted instances must be manually upgraded to 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5.
Indicators of Compromise: An access pattern where POST /api/session/reset_password returns 400 followed immediately by GET /api/user/current returning 200 indicates the instance is highly likely compromised.
DBA Perspective: BI tools typically hold high‑privilege database connections – once compromised, it’s equivalent to handing over the keys to all downstream production databases. All DBAs using Metabase self‑hosted instances should immediately upgrade and rotate all credentials to connected databases. Checkly’s reflection is worth noting: “Rotating credentials solves the immediate problem, but doesn’t address the root cause – the analytics environment stored more sensitive data than actually needed.”
04｜SQL Chat Exposes Unauthenticated SQL Injection + SSRF Vulnerability (CVSS 8.7): Public Instances Face Internal Network Penetration Risk
SQL Chat (an open‑source natural language SQL query tool) has been found to have an unauthenticated SQL injection vulnerability, assigned CVE-2026-86123, with a CVSS v3.1 score of 8.7 (High) and a v4.0 score of 9.4 (Critical).
Vulnerability Details: Four unauthenticated API endpoints (/api/connection/execute, /api/connection/test, /api/connection/db_schema, /api/connection/db) accept client‑provided database connection parameters without any authentication, allowing attackers to force SQL Chat to connect to arbitrary database hosts specified by the attacker, execute arbitrary SQL queries, enumerate database schemas, and exfiltrate sensitive data. More dangerously, attackers can use the SQL Chat server as a springboard to access internal databases not directly exposed to the public internet (SSRF + database proxy combination).
Affected Versions: As of disclosure, SQL Chat’s official repository has not yet released a patched version. The developer has been notified but no fix commit has been confirmed.
Remediation: Immediately remove SQL Chat from public internet access and place it behind an authenticated reverse proxy; restrict its outbound network access to only authorised database hosts; monitor for anomalous connection behaviour.
DBA Perspective: The SQL Chat vulnerability reminds DBAs that “AI tools” themselves can become security blind spots. Natural language query tools introduced by development teams for efficiency gains may, without proper security auditing, open a “back door” to internal databases for attackers. DBAs are advised to include SQL Chat‑like “database‑connection‑privileged” AI tools in their security asset inventory and strictly limit their network egress.
05｜VLDB 2026 Concludes: Agentic Data Systems Gain Consensus, GPU‑Native Databases Spark Architectural Revolution
From August 31 to September 4, the 52nd VLDB conference was held in Boston. This year’s conference listed “Data Systems for the AI Agent Era” as a core theme, with dedicated forums and workshops on Agentic Data Systems and database‑large model collaboration.
Transwarp’s GPU‑Native Cognitive Database was one of the conference’s notable highlights. The system fully migrates the complete database pipeline – from storage I/O and query execution to result materialization – to native GPU execution, delivering tens to thousands of times acceleration in financial risk control, quantitative research, and other scenarios. Unlike the common “GPU as coprocessor” approach, the Cognitive Database starts from first principles, having data complete the entire processing flow directly in GPU video memory, completely eliminating CPU‑GPU data movement overhead. As AI agents increasingly become the primary consumers of data, the underlying data infrastructure is undergoing a structural redesign.
DBA Perspective: VLDB 2026 sends a clear signal – GPUs are evolving from “AI accelerators” to “core variables in database architecture.” For DBAs, the boundaries of tuning will expand from “CPU core count, memory allocation, disk I/O” to “GPU video memory management, parallel stream scheduling, and data residency strategies.”
💡 SQL Little Knowledge Point
This Issue’s Knowledge Point: What is Storage‑Compute Separation vs. Storage‑Compute Integration?
The Jiangsu Bank procurement of domestic servers + domestic databases essentially represents an exploration of the “storage‑compute integration” performance path. Understanding these two concepts helps grasp the evolution direction of database architecture.
| Dimension | Storage‑Compute Separation | Storage‑Compute Integration |
|---|---|---|
| Architecture | Compute nodes separated from storage nodes | Storage nodes built with compute capability |
| Data Path | Compute nodes read storage data over network | Compute is completed locally in storage |
| Typical Scenarios | Cloud‑native databases, data lakes | All‑in‑one machines, GPU‑native databases |
| Advantages | Independent scaling, resource sharing | Extremely low latency, high throughput |
Dameng PAI all‑in‑one and Transwarp’s GPU‑native database both follow the “storage‑compute integration” path. For DBAs, the boundaries of tuning are expanding from “parameter configuration” to full‑stack coordination of “storage + network + compute.”
HiddenMerit Team Production Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.
Segment 2: HiddenMerit In‑Depth · Issue 10
Focus on Database Frontiers, In‑Depth Analysis September 8, 2026 ｜ 1 In‑Depth Feature Article
Behind the RMB 18.84 Million Contract: Financial Xinchuang Moves from “Software Replacement” to the “Hardware‑Software Integrated” Deep Zone
1. RMB 18.84 Million – Not Just Servers, But a Signal
Jiangsu Bank’s domestic database server procurement project was won by Beijing Advanced Digital Technology for RMB 18.84 million. The configuration requires Hygon or Kunpeng domestic CPUs, with large‑capacity DDR memory and SSD storage.
The figure itself isn’t particularly large – billion‑yuan domestic server procurement deals are not uncommon. But the signal it sends is more significant than the amount.
Jiangsu Bank is the largest legal‑person bank in Jiangsu Province and a listed city commercial bank on the A‑share market. The key point of this nearly RMB 20 million domestic server procurement is: it’s not a generic “domestic replacement,” but precisely targeted at “database servers.” The tender notice explicitly requires CPUs to be “Hygon or Kunpeng” – not “domestically compatible,” not “domestic optional,” but a hard requirement. And the procurement model is separate tendering for database servers, not bundled with x86 servers.
This means financial Xinchuang is moving from the early stage of “just being able to run domestic databases” into the deep zone of “re‑evaluating server selection for optimal domestic database performance.”
2. Kunpeng vs. Hygon: DBAs Can’t Just Focus on Databases Anymore
The tender notice listed both Hygon and Kunpeng as options, raising a new question for DBAs: The same database software, running on Kunpeng vs. Hygon, may deliver completely different performance.
Kunpeng is based on the ARM architecture, while Hygon follows the x86‑compatible path. Their NUMA topology, cache coherency, and I/O paths differ, and these differences directly affect database lock management, memory allocation, and parallel execution plans.
Key differences:
| Dimension | Kunpeng (ARM) | Hygon (x86‑compatible) |
|---|---|---|
| Instruction Set | ARM | x86‑compatible |
| NUMA Topology | Multi‑die architecture, sensitive to cross‑die access latency | Traditional x86 NUMA |
| Cache Coherency | Cross‑die cache synchronisation requires attention | Relatively mature |
| I/O Path | Ecosystem still evolving | Mature ecosystem |
For DBAs, this means that in Xinchuang projects, hardware selection is no longer about “whether it’s compatible,” but a mandatory choice between “Hygon or Kunpeng.” Database tuning directions under the two platforms may be completely different.
3. The “Three‑Leap” Evolution of Financial Xinchuang
The evolution path of financial Xinchuang can be summarised as three leaps:
Leap 1: Peripheral System Replacement (2022‑2024) . OA, email, portals, and other non‑core systems were piloted first, with the requirement being “just needs to run.”
Leap 2: Core System Software Replacement (2024‑2026) . Bank core transaction systems began migrating to domestic databases, focusing on “feature parity.”
Leap 3: Hardware‑Software Integrated Deep Optimisation (2026‑ ) . Not just database software replacement, but servers, storage, and networking all redesigned for domestic databases. Behind the RMB 18.84 million procurement is Jiangsu Bank’s performance demand for the “domestic database + domestic CPU” combination – no longer about “whether it can replace,” but “whether it can run faster and more stable than the original solution.”
4. Practical Implications for DBAs
Implication 1: Add domestic CPU platforms to test environments
If you’ve only tested on x86 platforms in Xinchuang projects without stress‑testing on Kunpeng or Hygon, the first day of production go‑live could be the first day of “performance pitfalls.” It is recommended to deploy a Kunpeng or Hygon platform in the test environment to gain hands‑on cross‑platform migration and tuning experience.
Implication 2: Pay attention to hardware‑software collaborative tuning logic
A Kunpeng server with Dameng database versus a Hygon server with Dameng database may require completely different tuning parameters. DBAs can no longer focus only on shared_buffers and work_mem – they also need to consider NUMA binding policies, interrupt affinity, I/O scheduler algorithms, and their interaction with domestic CPU characteristics.
Implication 3: Storage selection is also changing
The tender notice explicitly mentions “large‑capacity DDR memory and SSD storage,” rather than traditional SAS drives. Performance bottlenecks for domestic databases on domestic CPUs may not be in the database itself, but in the storage subsystem. DBAs need to pay attention to storage media selection and configuration, incorporating them into the overall tuning consideration.
5. The Bigger Trend: Domestic Databases Are Defining Hardware Standards
Behind the RMB 18.84 million procurement is a larger trend: domestic databases are moving from “adapting to domestic hardware” to “defining requirements for domestic hardware.”
In the past, it was “databases adapting to Kunpeng” – whatever compute power Kunpeng could provide, databases would optimise within that range.
Now, it’s “Kunpeng adapting to databases” – the high requirements of databases for memory bandwidth, I/O throughput, and cache coherency are pushing the next‑generation chip designs of Kunpeng and Hygon.
If this trend continues, DBA tuning work will no longer be limited to “parameter settings” but will extend to “hardware‑software collaborative architecture design.” The DBA role will also evolve from “database administrator” to “data infrastructure architect.”
HiddenMerit Team Production Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.