📊 HiddenMerit Morning Post · Issue 64
Focus on Database Frontiers, Practical Insights for DBAs July 29, 2026 ｜ 5 Selected Global Breaking News
01｜Oracle’s Largest Ever CPU: 1,449 Patches Fix 1,235 CVEs, AI Assists Mass Vulnerability Discovery
On July 21, Oracle released its July 2026 Critical Patch Update (CPU), setting a record for the largest single patch release in the company’s history. This CPU contains 1,449 security patches fixing 1,235 independent CVEs across 32 Oracle product families, with 261 patches rated Critical and high‑severity patches accounting for 52.7%.
Patch Distribution by Product Family:
| Product Family | Patches | Remotely Exploitable Without Authentication |
|---|---|---|
| Oracle E‑Business Suite | 410 | 45 |
| Oracle Fusion Middleware | 355 | 219 |
| Oracle Communications | 168 | 122 |
| Oracle MySQL | 54 | 9 |
| Oracle Database Server | 15 | 6 |
Context: Oracle Security Engineering has fully integrated AI assistance – Oracle has access to Anthropic Claude Mythos and OpenAI’s most advanced models to accelerate and enhance vulnerability discovery and patching. The vast majority of vulnerabilities in this CPU were discovered internally, likely with AI assistance. Oracle issued a warning a month in advance, emphasising that AI is fundamentally lowering the barrier to discovering and exploiting vulnerabilities.
- DBA Perspective: The Oracle CPU size has surged nearly threefold (481 patches in the April CPU), sending two clear signals: first, AI‑driven vulnerability discovery is accelerating the pace of vulnerability identification, and DBAs must shift from a “quarterly patch” cadence to a “monthly security baseline” response mode; second, AI is both a defensive tool and an attack accelerator – DBAs need to monitor AI‑driven threat intelligence changes.
02｜Dameng Receives Major Shareholder Increase to 25%, China Electronics Group Puts “Real Money” Behind Xinchuang Leader
On July 28, Dameng (688692) announced that its controlling shareholder, China Electronics Corporation Group, through its wholly‑owned subsidiary CEC Investment, increased its shareholding by 11,758 shares via secondary market block trading on July 28. After this increase, the combined shareholding of CEC Investment and its concert party China Software rose from 24.99% to 25.00%.
The entire increase was funded by CEC Investment’s own capital. The announcement clearly stated that the increase was driven by China Electronics Group’s “strong confidence in the company’s future sustainable and stable development, and to enhance the value of the listed company and returns to public shareholders.”
Dameng is a leading domestic database product development service provider, with 2025 revenue of RMB 1.306 billion and net profit of RMB 515 million. Dameng’s stock price currently stands at RMB 215.99, up 3.69% on the day.
- DBA Perspective: A Xinchuang leader receiving a major shareholder’s “real money” increase to the 25% threshold is a positive signal of industrial capital’s confidence in the long‑term value of domestic databases. Dameng’s product line (DM9, graph database, Qiyun Database) already covers core scenarios such as finance, telecommunications, and government. For DBAs engaged in domestic database operations, major shareholder capital movements are often leading indicators of industry sentiment.
03｜IBM Sterling B2B Integrator SQL Injection Vulnerability (CVE-2026-7769, CVSS 8.1)
On July 29, IBM Sterling B2B Integrator and IBM Sterling File Gateway were found to have an SQL injection vulnerability (CVE-2026-7769, CVSS 8.1). Affected versions cover 6.2.0.0 through 6.2.2.0_1 and others. A remote attacker could use crafted SQL statements to view, add, modify, or delete information in the backend database.
The CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N – low attack complexity, low privileges required, no user interaction, with high impact on confidentiality and integrity.
- DBA Perspective: IBM Sterling B2B Integrator is a core middleware for B2B data exchange in large enterprises, typically holding high‑privilege access to enterprise databases. This vulnerability allows low‑privilege attackers to read and write to the backend database, posing a direct threat to supply chain data security. DBAs using IBM Sterling should immediately assess versions, schedule a patch window, and enforce the principle of least privilege for related database accounts.
04｜rtMedia WordPress Plugin Unauthenticated SQL Injection (CVE-2026-59549, CVSS 9.3)
IONIX disclosed that the rtMedia for WordPress plugin (versions ≤ 4.7.10) has a critical unauthenticated SQL injection vulnerability (CVE-2026-59549, CVSS 9.3). The vulnerability stems from insufficient user input sanitisation, allowing unauthenticated attackers to extract sensitive data from the underlying WordPress database via remote HTTP requests, including hashed passwords, user emails, session tokens, and stored API keys. Fixed in version 4.7.11. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L.
- DBA Perspective: WordPress plugin SQL injection is a familiar database security concern – but the CVSS 9.3 rating means this vulnerability has an extremely low exploitation barrier and a wide damage radius. DBAs using WordPress and the rtMedia plugin should advise application teams to upgrade to 4.7.11 immediately or temporarily disable the plugin.
05｜National Data Bureau: Over 120,000 High‑Quality Datasets Built Nationwide, Encouraging “Token Economy” Innovation
On July 28, at the press conference for the 2026 China International Big Data Industry Expo, the National Data Bureau disclosed that as of June 2026, over 120,000 high‑quality datasets had been built nationwide, with total data volume exceeding 1,565 petabytes.
Yu Ying, Deputy Director of the National Data Bureau, stated that high‑quality datasets have become key “fuel” for the rapid development of artificial intelligence. The National Data Bureau encourages business model innovation based on token applications, exploring new transaction models such as token trading, and cultivating a market consensus of “paying for quality data.” Token applications will focus on deep integration with industries such as manufacturing, healthcare, and finance, driving the formation of a “data flywheel” effect – using model applications to drive data supply, and using data to empower model iteration.
2026 has been positioned as the “Year of Data Element Value Release.” The total national intelligent computing scale has reached 2.4 million PFLOPS, with intelligent computing accounting for over 80% of the eight national computing hubs.
- DBA Perspective: Policy support for the “token economy” means that business models on the AI data supply side are taking shape. The construction of 120,000 high‑quality datasets and a data volume of 1,565 PB is macro‑level positive news for database professionals – the larger and higher‑quality the data, the stronger the demand for storage, retrieval, and governance. Encouraging a market consensus of “paying for quality data” will also drive a revaluation of data governance and database services.
📚 SQL Little Knowledge Point
This Issue’s Knowledge Point: What is the “Token” Economy?
In the AI context, a “token” is the smallest semantic unit when large models process text. The “token economy” is a new concept proposed by the National Data Bureau – transforming data resources into a “token” form that models can directly consume, activating the data element market through new models such as token trading.
The Three‑Layer Logic of the Token Economy:
- Data → Tokens: High‑quality datasets are processed into standardised tokens that models can consume.
- Tokens → Models: Tokens serve as “fuel” to drive AI model training and inference.
- Models → Data: AI applications generate new demand, pulling more data into tokenisation, creating a data flywheel.
The National Data Bureau’s proposal of “using model applications to drive data supply, and using data to empower model iteration” is a policy articulation of the data flywheel effect. For the database industry, the large‑scale implementation of the token economy means sustained growth in demand for multi‑modal data storage, vector retrieval, and real‑time data processing.
HiddenMerit Team Production Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.