Segment 1: HiddenMerit Morning Post · Issue 112

Focus on Database Frontiers, Practical Insights for DBAs September 24, 2026 ｜ 5 Selected Global Breaking News

01｜OceanBase Covers Nearly 4,000 Core Nodes Across Three Major Telecom Operators, Launches Telecom AI Integrated Data Solution

On September 22, the 2026 China Communications Expo was held at the China National Convention Center in Beijing. At the main forum, OceanBase disclosed that it now covers nearly 4,000 core nodes across the three major telecom operators — China Mobile, China Unicom, and China Telecom — stably serving over 1 billion mobile users annually.

Telecom AI Integrated Solution: OceanBase launched a telecom AI integrated data solution based on a lakehouse‑integrated engine that unifies the processing of structured and unstructured data, and embeds AI computation, data context, and application context into the data foundation. It supports production‑grade AI scenarios including real‑time inference, precise reach, intelligent operations, and business analytics.

Award‑Winning Projects: All five projects jointly submitted by OceanBase were selected for ICT China (2026) Case Awards — three first prizes and two second prizes — with partner customers covering Shandong Mobile, China Mobile Internet, Hebei Mobile, Beijing Mobile, and Fujian Mobile.

DBA Perspective: OceanBase’s deep coverage in the telecom industry (nearly 4,000 core nodes, 1 billion+ users) validates the maturity of domestic distributed databases in ultra‑large‑scale telecom scenarios. For DBAs, the “lakehouse‑integrated engine” architecture that unifies structured and unstructured data means telecom DBAs need to expand from traditional OLTP operations to multi‑modal data management and AI workload support. The five ICT award‑winning projects cover core upgrades, domestic‑tech transformation, and AI autonomous operations, providing a clear reference path for telecom DBA skill evolution.

📌 HiddenMerit In‑Depth Preview: Today’s in‑depth article – “Behind OceanBase Covering 4,000 Core Nodes Across Three Major Telecom Operators: Telecom DBAs’ New ‘AI Workload’ Exam Room” – will explore the technical logic of the telecom AI integrated solution and DBA capability migration.

02｜pg_partman Exposes Another High‑Risk SQL Injection Vulnerability (CVE-2026-61817): Low‑Privilege Users Can Plant Persistent Backdoors

The PostgreSQL partition management extension pg_partman has been found to have a serious SQL injection vulnerability (CVE-2026-61817), affecting versions before 5.5.0. This is the second high‑risk vulnerability disclosed in pg_partman recently.

Vulnerability Details: Functions including run_maintenance(), show_partitions(), show_partition_info(), undo_partition(), and partition_data_time() interpolate the writable part_config.time_dncoder text value directly into dynamic SQL without identifier quoting. A role with partman_user privileges can store malicious SQL instead of a legitimate decoder function name. When subsequent maintenance operations are triggered, the malicious SQL executes with the privileges of the default PostgreSQL superuser background worker role.

Attack Consequences: Successful exploitation can lead to full database compromise and potentially execute operating system commands as the PostgreSQL service account. The persisted malicious configuration row can continuously restore escalated access in subsequent maintenance cycles, forming a reliable backdoor. The vulnerability has been fixed in version 5.5.0.

DBA Perspective: This is the second high‑risk vulnerability disclosed in pg_partman within a week (the previous being CVE-2026-61821). Both vulnerabilities share the same pattern — the background worker executes operations with superuser privileges, bypassing the caller’s permission boundaries. DBAs are advised to upgrade to 5.5.0 immediately and audit the time_dncoder field in the part_config table for anomalous entries.

03｜Dameng DM9 Wins Gold Award at the 28th China International Software Expo: Five‑in‑One Architecture, 100% Original Independent R&D

From September 20‑22, the 28th China International Software Expo was held in Zhengzhou. Dameng Database Management System DM9 won the Gold Award at this year’s Software Expo.

DM9 Core Highlights:

100% independent R&D: DM9 uses a completely self‑developed database kernel, achieving 100% original independent R&D of core database code.
Five‑in‑One Architecture: Innovatively achieves a “centralised + distributed + TP + AP + AI” five‑in‑one architecture, deeply integrating shared clusters, data guard, storage‑compute separation, multi‑tenancy, and AI capabilities.
Security and Reliability Level II: In May this year, both Dameng V9 and V9 (Distributed) received Level II security and reliability certification, making it the first company in China to achieve Level II certification for both centralised and distributed databases.

DBA Perspective: DM9’s Gold Award at the Software Expo, combined with “100% original independent R&D” and the “five‑in‑one” architecture, validates the continuous breakthroughs of leading domestic database vendors in core technology self‑innovation. For DBAs, DM9’s “centralised + distributed + TP + AP + AI” five‑in‑one means a single database can cover the full spectrum from traditional OLTP to AI inference, reducing operational complexity from stacking multiple product lines.

04｜OceanBase Selected for Five ICT China Award‑Winning Projects: Telecom Core System Upgrades and AI Autonomous Operations Become Benchmarks

At the 2026 China Communications Expo ICT Case Release Ceremony, all five projects jointly submitted by OceanBase were selected for ICT China (2026) Case Awards — three first prizes and two second prizes.

Award‑Winning Project Scenarios:

Shandong Mobile: Building an intelligent operations system based on OceanBase AI autonomous services (First Prize)
China Mobile Internet: Rebuilding core business systems based on OceanBase HTAP (First Prize)
Hebei Mobile: Achieving provincial core business system domestic upgrade based on OceanBase TP/AP/HTAP (First Prize)
Beijing Mobile: Completing core upgrades and building a RAGflow architecture for intelligent operations (Second Prize)
Fujian Mobile: Advancing B‑domain core system construction, achieving high availability and independent innovation (Second Prize)

DBA Perspective: The five award‑winning projects showcase three evolution directions for domestic databases in the telecom industry — core system domestic upgrade, HTAP restructuring, and AI autonomous operations. For DBAs, these benchmark cases provide reference implementation paths: from “replacing Oracle” to “restructuring core systems with HTAP,” and further to “building AI autonomous operations systems.” Telecom DBA skill evolution now has clear reference coordinates.

05｜Dameng: Domestic Database Market Enters “Shakeout and Elimination” Phase, Resources Concentrating Towards the Head

Dameng recently gave a clear judgement during investor exchanges: the domestic database market is moving from “multiple strong players coexisting” into a “shakeout and elimination” phase, with market resources concentrating towards leading enterprises.

Industry Judgement: Dameng’s management noted that database core technology requires long‑term technical accumulation, as well as repeated validation through massive real business scenarios. A complete ecosystem also requires multi‑party collaborative adaptation across the industry chain. Market resources are continuously concentrating towards leading enterprises with hardcore technology and full‑stack service capabilities.

Strategic Direction: Dameng is explicitly advancing two technology tracks — “AI for DB” (intelligent operations, SQL optimisation, fault self‑healing) and “DB for AI” (native vector retrieval, multi‑modal data processing) — and has incorporated its database all‑in‑one business into its core strategy, positioning it as a “second growth curve.”

DBA Perspective: Dameng’s “shakeout and elimination” judgement is highly consistent with the real feelings of DBAs in IT168’s survey — domestic database replacement has entered the “deep water zone.” The shallow water zone solved “whether to replace” and “who to choose”; the deep water zone solves “whether it can run stably long‑term after replacement.” For DBAs, this means the focus of skill development is shifting from “migration capability” to “capability to rebuild operational systems on domestic databases.”

💡 SQL Little Knowledge Point

This Issue’s Knowledge Point: What is the “Background Worker” Risk in PostgreSQL Extensions?

Both pg_partman vulnerabilities (CVE-2026-61821 and CVE-2026-61817) point to the same architectural risk: background workers execute operations with superuser privileges.

Component	Role	Default Privileges
Caller	`partman_user`	Low privileges
Background Process	`pg_partman_bgw.role`	PostgreSQL Superuser

What Makes CVE-2026-61817 Unique: The malicious SQL is persistently stored in part_config.time_dncoder rather than executed immediately. When subsequent maintenance operations are triggered, the malicious SQL executes with superuser privileges and can continuously restore escalated access in subsequent cycles, forming a reliable backdoor.

Implications for DBAs: Any component that executes operations with “higher privileges” (background processes, schedulers, agents, MCP Servers) requires independent privilege auditing. You cannot assume “the operation is safe” simply because “the caller has low privileges.”

HiddenMerit Team Production Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.

Segment 2: HiddenMerit In‑Depth · Issue 25

Focus on Database Frontiers, In‑Depth Analysis September 24, 2026 ｜ 1 In‑Depth Feature Article

Behind OceanBase Covering 4,000 Core Nodes Across Three Major Telecom Operators: Telecom DBAs’ New “AI Workload” Exam Room

1. An Overlooked “Scale Signal”

On September 22, at the 2026 China Communications Expo, OceanBase disclosed an easily overlooked figure: it now covers nearly 4,000 core nodes across the three major telecom operators, stably serving over 1 billion mobile users annually.

[quads id="805"]

What does 4,000 core nodes mean? A significant portion of the billing, CRM, signalling collection, and network management systems of China Mobile, China Unicom, and China Telecom now run on OceanBase. This is not a “pilot” — large‑scale replacement of telecom core systems has already been completed.

More noteworthy is the telecom AI integrated data solution OceanBase launched at the same time — it points to a deeper proposition: when AI enters telecom production systems, how do DBAs’ skill coordinates need to migrate?

2. The Unique Nature of “AI Workloads” in the Telecom Industry

The telecom industry has a key difference from the “main battlefields” of Xinchuang such as finance and government: telecom production systems demand millisecond‑level real‑time performance, while AI workloads have completely different requirements for the data foundation.

Li Nan, General Manager of OceanBase Government and Enterprise FDE, noted in his speech that as AI enters telecom production scenarios such as customer service, operations, marketing, and network management, the problems the data foundation needs to solve are changing: it must not only support stable operation of core business, but also enable massive data to be quickly acquired, understood, and computed by AI.

Telecom data has two unique characteristics:

Extremely large data volume: Structured data such as user bills, network metrics, and location signalling grows by terabytes daily.
High proportion of unstructured data: Unstructured data such as customer service recordings, fault images, network optimisation videos, and inspection logs is becoming core material for AI applications.

Traditional data architectures place structured data in databases and unstructured data in object storage or data lakes, with AI applications pulling data across systems — data movement becomes the biggest bottleneck for AI implementation.

3. OceanBase’s Solution: Lakehouse Integration + AI Pushdown

OceanBase’s telecom AI integrated solution revolves around the core principle of “data stays put, compute moves. “

Layer 1: Lakehouse‑Integrated Engine. Structured data (user bills, network metrics, location signalling) and unstructured data (customer service recordings, fault images, network optimisation videos, inspection logs) are unified into the data foundation, with storage, retrieval, computation, and governance performed in a unified engine, reducing data movement between different systems.

Layer 2: AI Compute Pushdown. Capabilities such as AI hybrid search and AI operators are pushed down to the database layer, enabling OLTP, OLAP, and AI computation to be processed collaboratively in the same engine. This means AI inference no longer needs to pull data from the database to external AI services — feature computation and real‑time inference are completed inside the database.

Layer 3: Dual Context Injection. “Data context” (data semantics, data governance) and “application context” (RAG, Memory mechanisms) are introduced into telecom AI scenarios, enabling AI to leap from “seeing data” to “understanding business.”

The three‑layer architecture ultimately supports six production‑grade telecom AI scenarios across three major directions — “integrated intelligent computing, unified intelligent operations, unified intelligent decision‑making” — forming a complete chain of “AI‑driven — agent execution — data closed‑loop feedback.”

4. Practical Implications for Telecom DBAs

Implication 1: From “Managing OLTP” to “Managing AI Workloads”

The traditional work of telecom DBAs is managing connection pools, slow SQL, and primary‑standby failover for OLTP systems. When AI workloads enter production systems, DBAs need to start understanding: AI hybrid search index maintenance, AI operator resource isolation, and mixed execution plans for vector retrieval and scalar queries.

Implication 2: From “Data Movement Manager” to “Data Context Designer”

The core of the telecom AI solution is “data stays put, compute moves” — this reduces the DBA’s burden of maintaining ETL pipelines, but adds new responsibilities: designing data context. How are data semantics defined? How are data governance rules configured? How are RAG retrieval strategies tuned? These are becoming new work content for telecom DBAs.

Implication 3: Pay Attention to “AI Autonomous Operations” Implementation Cases

Shandong Mobile built an intelligent operations system based on OceanBase AI autonomous services, winning an ICT China First Prize. This means: AI autonomous operations in the telecom industry has moved from “concept” to “production‑grade implementation.” Telecom DBAs need to start learning AI autonomous operations toolchains and understanding their decision logic and boundaries.

Implication 4: The Telecom Industry is the “Training Ground” for Domestic Database DBAs

A scale of 4,000 core nodes means: the telecom industry is the largest‑scale “training ground” for domestic distributed databases. The operational experience accumulated here (large‑scale cluster management, cross‑region multi‑active, AI workload support) has extremely high transferability — whether moving to finance, government, or overseas projects, telecom industry domestic database operations experience is hard currency.

5. The Bigger Picture

OceanBase covering 4,000 core nodes across the three major telecom operators validates a trend: domestic database replacement in the telecom industry has completed “large‑scale” and is entering a new “AI‑ification” phase.

For DBAs, this means the “coordinate system” for career development needs recalibration:

Stop asking “can domestic databases replace” — the answer is clear.
Start asking “how do we manage it well after replacement” — this is the core proposition of the deep water zone.
Further ask “how do we support AI workloads” — this is the telecom DBA’s new exam room.

IT168’s survey notes that domestic database replacement has entered the deep water zone, which addresses the question of “whether it can run stably long‑term after replacement.” The telecom industry’s 4,000 core nodes are precisely the largest‑scale practice ground for this “deep water zone.”