Segment 1: HiddenMerit Morning Post · Issue 106

Focus on Database Frontiers, Practical Insights for DBAs September 17, 2026 ｜ 5 Selected Global Breaking News

01｜Oracle Releases September CSPU: Fixes 673 Vulnerabilities, 104 Rated 9.0 or Above, 247 Exploitable Without Authentication

On September 15, Oracle released its September 2026 Critical Security Patch Update (CSPU), fixing a total of 673 security patches covering 672 independent CVEs across Oracle Database Server, Fusion Middleware, E‑Business Suite, MySQL, Java SE, PeopleSoft, Siebel, Oracle VM VirtualBox, and other product families.

Severity Distribution:

607 patches with CVSS scores of 7.0 or above
104 patches with CVSS scores of 9.0 or above
Including 6 scored 10.0 (maximum), 15 scored 9.9, and 44 scored 9.8
247 vulnerabilities exploitable over the network without authentication

This is Oracle’s second consecutive month of large‑scale security updates, following August’s CSPU (943 vulnerabilities). Oracle strongly recommends customers deploy this CSPU patch immediately.

DBA Perspective: Oracle’s two consecutive months of 600+ scale CSPUs mean that a “monthly security baseline” has become the norm for Oracle DBAs. With 247 vulnerabilities exploitable without authentication, any Oracle instance exposed to the network faces direct risk. DBAs are advised to immediately assess affected versions and place the September CSPU at the highest priority in the Q3 patch window.

📌 HiddenMerit In‑Depth Preview: Today’s in‑depth article – “After OceanBase Tops Asia‑Pacific: The ‘AI Positioning Battle’ of Domestic Databases and New Coordinates for DBA Capabilities” – will explore the industry logic behind the Omdia report and DBA response strategies.

02｜OceanBase AI Data City Tour Held in Beijing Today: From Core Upgrade to AI Workloads

On September 17, the OceanBase AI Data City Tour was held at the Zhongguancun Exhibition Centre in Beijing, themed “From Core Upgrade to AI Workloads.” The event brought together 150 government and enterprise digitalisation leaders and AI pioneers, inviting leading companies in telecommunications, transportation, and manufacturing to share their digitalisation practices.

Core Agenda:

Practical paths and pitfalls to avoid in smooth core system upgrades
Landing paths and real results from AI application workload pilots to production
Enterprise practices for achieving core system upgrades and AI application workload hosting seamlessly without modification

The event aims to drive the data foundation’s leap from “cost centre” to “value engine.”

DBA Perspective: The theme of this OceanBase event precisely addresses the two core propositions facing DBAs today — core system Xinchuang upgrades and AI workload deployment. From “replacing Oracle” to “hosting AI workloads,” the role of databases is undergoing a fundamental transformation. For DBAs, this means skill development needs to expand from “distributed database operations” to “AI data platform architecture.”

03｜PostgreSQL 19 Confirmed Delayed: 53 Features Reverted, SQL/PGQ and REPACK Among Major Features Affected

On September 16, Snowflake’s engineering blog disclosed that PostgreSQL 19 is confirmed delayed. PostgreSQL has released major versions each autumn for the past few years, but this year the code is in a heavy review cycle, with multiple major features reverted during the beta phase, pushing the release back by weeks or even months. Beta 4 is scheduled for September 24.

Main Features Reverted (53 items reverted since beta started in June 2025):

SQL/PGQ property graph queries: Insufficient design readiness
ALTER TABLE MERGE/SPLIT PARTITION(S) : Long‑requested partition management feature, reverted due to design issues
UPDATE/DELETE FOR PORTION OF: Temporal range column feature
GROUP BY ALL: Caused incorrect results due to improper handling of ORDER BY non‑default equality semantics
Online data checksums: Unable to modify checksum settings during operation

Features Still at Risk: REPACK/CONCURRENTLY, foreign key fast‑path checks, postgres_fdw statistics import, and others may also be reverted.

DBA Perspective: The PostgreSQL 19 delay reflects the PG community’s “quality first” principle — preferring to revert features rather than release a flawed version. For DBAs, this means the PG 18 LTS support period becomes even more critical (until May 2031), and projects planning to upgrade to PG 19 need to adjust their timeline expectations. The SQL/PGQ reversion is particularly noteworthy — it means PostgreSQL’s property graph query landing timeline is pushed back further.

04｜Elastic Launches Serverless Vector Database: Minute‑Level Delivery, Scalable to Hundreds of Billions of Vectors

On September 11, Elastic (NYSE: ESTC) officially launched the Elasticsearch Vector Database, a serverless product designed for large‑scale vector search and AI applications.

Core Capabilities:

Minute‑level delivery: Developers only need to provide documents and queries; Elastic automatically handles embedding, tuning, and underlying infrastructure
Built‑in hybrid search: Full‑text and vector search can be completed in a single query
Single field type: Handles indexing, embedding, and chunking simultaneously, eliminating the need to build embedding pipelines
Automatic quantisation: Better Binary Quantisation reduces vector memory by up to 32x while maintaining high recall
Scalable to hundreds of billions of vectors: Priced based on data and search capacity, with no hidden compute unit fees

Elastic stated that Elasticsearch is already one of the world’s most widely used vector workload platforms, and this launch packages years of large‑scale deployment experience into “expert‑tuned default configurations.”

DBA Perspective: The “minute‑level delivery” positioning of the Elasticsearch Vector Database directly addresses the pain point of AI application developers who “don’t want to become infrastructure engineers.” For DBAs, this means competition in the vector database space is shifting from “features” to “delivery experience” — whoever can get developers’ AI applications live faster wins the market.

05｜Dameng Responds on AI Security: 100% Code Autonomy, Behaviour Auditing + Full‑Encryption Protection Supporting Intelligent Applications

On September 16, Dameng responded to AI security topics on its investor interaction platform. The company stated that its database products have mastered a series of data protection security technologies including full‑encryption data protection, trusted encryption protection, dynamic data masking, data tamper‑proofing, and row‑level access control, with overall security protection reaching Cybersecurity Classified Protection Level 4 and EAL4+ level.

Key Responses:

100% code autonomy: Not dependent on open‑source communities or external platforms, effectively avoiding supply chain risks such as open‑source licence changes and community blockades
Behaviour auditing function: Can record and trace database operation behaviour, providing effective support for security management in intelligent application scenarios

DBA Perspective: Dameng’s response on AI security precisely targets the two issues DBAs care about most today — supply chain security and AI behaviour auditability. When AI agents become new database users, “behaviour auditing” upgrades from a “compliance requirement” to a “security necessity.” The 100% code autonomy positioning also provides DBAs with a quantitative reference for evaluating “autonomous control” levels in Xinchuang selection.

💡 SQL Little Knowledge Point

This Issue’s Knowledge Point: What is CSPU?

CSPU (Critical Security Patch Update) is a monthly security patch update mechanism Oracle introduced starting in 2026, supplementing the traditional quarterly CPU (Critical Patch Update).

Dimension	Quarterly CPU	Monthly CSPU
Frequency	Once per quarter	Once per month
Scale	Larger	Smaller, more focused
Target	Comprehensive coverage	High‑priority fixes
September 2026 Scale	—	673 patches / 672 CVEs

Why Oracle Shifted to Monthly CSPU: AI‑driven vulnerability discovery is accelerating the pace of vulnerability identification, and quarterly updates can no longer meet the security response cadence. After launching the monthly CSPU mechanism in May 2026, Oracle released large‑scale updates in July, August, and September consecutively (481 → 943 → 673 patches).

Significance for DBAs: Monthly CSPUs mean the “quarterly patch window” is being replaced by a “monthly security baseline.” DBAs need to establish a routine monthly patch assessment process, rather than waiting for quarterly CPUs to handle everything at once.

HiddenMerit Team Production Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.

Segment 2: HiddenMerit In‑Depth · Issue 19

Focus on Database Frontiers, In‑Depth Analysis September 17, 2026 ｜ 1 In‑Depth Feature Article

After OceanBase Tops Asia‑Pacific: The “AI Positioning Battle” of Domestic Databases and New Coordinates for DBA Capabilities

1. A Market Coordinate Shift from “China” to “Asia‑Pacific”

Recently, global technology research and advisory firm Omdia released its “2026 Asia‑Pacific & Oceania Distributed Database Market Study.” By 2025 revenue, OceanBase ranked first in the Asia‑Pacific distributed database market with a 15.5% market share, ahead of Google Cloud Spanner, Tencent Cloud TDSQL, Huawei Cloud GaussDB, and Alibaba Cloud PolarDB‑X.

Omdia data shows the Asia‑Pacific distributed database market reached $900 million in 2025 and is projected to grow to $1.8 billion by 2029, with a five‑year CAGR of 19.3%. This is the first time a domestic database has topped a regional ranking from a third‑party international research firm.

OceanBase’s top ranking is no accident. Its technology system has been repeatedly honed in extreme scenarios in the Chinese market: originally born to solve the “Double 11” payment surge, it has deeply rooted itself in financial core businesses over the past decade, serving over 400 financial institutions, with nearly 70% of trillion‑yuan‑asset banks deploying their core systems on it.

When “replacing Oracle” is no longer the main competitive narrative in China’s distributed database market, the path for domestic database vendors to “expand territory” overseas is being redefined.

2. Why OceanBase? – From “Domestic Honing” to “Regional Validation”

Driver 1: China Market’s “Extreme Stress Test”

“Double 11″‑level concurrency pressure, financial core system strong transaction consistency requirements, 7×24 uninterrupted operation – these extreme demands from the Chinese market became the “proving ground” for OceanBase’s technical maturity. And Asia‑Pacific customer requirements still focus on high concurrency, strong consistency, zero downtime, and elastic scaling – essentially the same type of problem as China’s “Double 11” scenario.

Driver 2: Real Business Validation in Asia‑Pacific Markets

The Philippines’ GCash faces “8 out of 10 Filipinos use it” high‑concurrency pressure, supporting millions of transactions per second after migration with resource costs reduced by 40%; Malaysia’s TNG Digital achieved zero downtime under extreme scenarios of 40,000 transactions per second; Indonesia’s DANA has over 200 million account management requirements, achieving 7×24 zero‑interruption operation after migration.

A technology system honed in China’s complex scenarios can be seamlessly transferred to similar demands in Asia‑Pacific markets.

Driver 3: AI Agents Are Becoming the “New Users” of Databases

Omdia specifically notes in its report that database vendors are increasingly integrating AI capabilities into distributed databases, evolving them from “systems of record” to “intelligent engines.” The highly distributed nature and strong consistency of distributed databases make them particularly well‑suited for AI agent workloads, providing low‑latency access to operational data for real‑time AI inference.

3. The “AI Positioning Battle” of Domestic Databases

OceanBase’s top ranking in Asia‑Pacific coincides with the domestic database industry entering the “AI positioning battle” phase.

Positioning 1: AI Workload Hosting Capability

On September 17, OceanBase held its “AI Data City Tour” event in Beijing, themed “From Core Upgrade to AI Workloads,” bringing together leading companies in telecommunications, transportation, and manufacturing to share landing paths from AI application workload pilots to production. This shows OceanBase is making “AI workload hosting” a core strategic direction.

[quads id="805"]

Positioning 2: AI Security and Auditing

Dameng recently emphasised in its response on AI security that its products have built‑in behaviour auditing functions that can record and trace database operation behaviour, “providing effective support for security management in intelligent application scenarios.” When AI agents become new database users, “behaviour auditing” upgrades from a “compliance requirement” to a “security necessity.”

Positioning 3: Knowledge Modelling and Semantic Reasoning

Yashan Technology proposed at DTCC 2026 that the software operation paradigm in the AI era is shifting from the traditional “program + data” process‑driven model to a “model + knowledge” goal‑driven model. Databases need to move from “storing data” to “organising knowledge,” becoming the knowledge foundation for AI applications.

Positioning 4: Overseas Market Expansion

OceanBase’s globalisation is moving from point‑market entry to large‑scale development. Since commercialisation began in 2020, its global customer count has exceeded 4,000, with services covering 16 countries and regions, 60+ regions, and 240+ availability zones.

4. New Coordinates for DBA Capabilities

As domestic databases move from “domestic replacement” to “Asia‑Pacific competition,” and from “supporting business” to “hosting AI workloads,” the DBA’s capability coordinates need to migrate accordingly.

Coordinate 1: From “Single‑Database Operations” to “Clustered High‑Availability Management”

OceanBase’s customer scenarios in Asia‑Pacific markets involve high‑concurrency pressure of millions of transactions per second, requiring DBAs to have deep capabilities in clustered deployment, high‑availability solution design, and failover management.

Coordinate 2: From “SQL Tuning” to “AI Workload Tuning”

When AI agents become new database users, agent data access patterns are completely different from human ones – high‑frequency small batches, cross‑session persistence, multi‑tenant logical isolation. DBAs need to understand these patterns and master the skills for optimising AI workloads.

Coordinate 3: From “Data Management” to “Knowledge Organisation”

The “model + knowledge” paradigm shift proposed by Yashan Technology means databases are moving from “storing data” to “organising knowledge.” DBAs need to start understanding new data modelling approaches such as knowledge graphs, ontologies, and semantic retrieval.

Coordinate 4: From “Domestic Xinchuang” to “Overseas Projects”

As domestic databases establish a foothold in Asia‑Pacific markets, DBAs with domestic database skills are no longer limited to the domestic Xinchuang market. OceanBase’s service network covering 16 countries and regions offers DBAs the possibility of participating in overseas projects.

5. The Bigger Picture

OceanBase’s top ranking in Asia‑Pacific validates a trend: domestic databases are moving from “Oracle replacers” to “definers of Asia‑Pacific data infrastructure.”

For DBAs, this means establishing a new coordinate system – no longer using “compatibility with Oracle/MySQL” as the sole evaluation standard, but starting to understand new dimensions such as “distributed architecture scalability boundaries,” “AI agent workload adaptability,” and “knowledge modelling and semantic reasoning capability.”

When OceanBase held its “From Core Upgrade to AI Workloads” event in Beijing, the signal it sent was clear: the role of databases is leaping from “cost centre” to “value engine.” And DBAs need to complete the corresponding role transition from “cost centre manager” to “value engine architect.”