📊 HiddenMerit Morning Post · Issue 65

Focus on Database Frontiers, Practical Insights for DBAs July 30, 2026 ｜ 5 Selected Global Breaking News

01｜OceanBase Launches Series A Funding Round: Target RMB 2-3 Billion, Annualized Revenue Exceeds RMB 1.4 Billion, Benchmarking Databricks

On July 29, Ant Group’s distributed database company OceanBase officially launched its Series A funding round, with a target of approximately RMB 2-3 billion. It has already engaged with multiple leading investment institutions. This marks the first time OceanBase has introduced external funding since its establishment. Sources indicate that this round will help OceanBase further enhance its independent operational capabilities and increase investment in AI data platform and overseas markets.

Key Data: In 2026, OceanBase’s annualized revenue has exceeded RMB 1.4 billion, representing approximately 70% year-on-year growth. The company currently has thousands of customers, primarily including Bank of Communications and China Mobile, and has begun expanding into Southeast Asia, Japan, India, and Latin America. According to IDC reports, OceanBase ranked first in market share for distributed database on-premises deployment in China in 2025.

Strategic Benchmarking: Bloomberg reports that OceanBase is benchmarking against US data and AI platform company Databricks. The two companies have different paths: Databricks extends from data analytics and AI into databases, while OceanBase starts from distributed databases and core transaction systems, expanding into enterprise-wide data management, agent data supply, and data services. In June this year, OceanBase launched its next-generation lakehouse-integrated AI database, which has been tested in dozens of customer scenarios. In 2024, OceanBase established an independent board of directors and an employee equity incentive mechanism, laying the foundation for independent operations and the introduction of external capital.

• DBA Perspective: OceanBase’s first external funding is a landmark event for domestic databases moving from “internal incubation” to “market-oriented independent operation.” The annualized revenue exceeding RMB 1.4 billion and 70% growth validate the commercial maturity of domestic distributed databases in core industries such as finance and telecommunications. Benchmarking against Databricks means OceanBase is evolving from a “database company” to an “AI data platform” – DBA skills need to expand from “distributed database operations” to “AI data platform architecture and agent data supply.” The lakehouse-integrated AI database has been tested in dozens of customer scenarios – DBAs should monitor its real-world performance in multi-modal data management.

02｜Weaver Ecology10 Critical SQL Injection Vulnerability (CVSS 9.8): Unauthenticated Attackers Can Steal Sensitive Data

On July 29, Chaitin Tech disclosed a critical SQL injection vulnerability in the getFieldValueFun interface of Weaver Ecology10, with a CVSS score of 9.8. The interface lacks effective filtering of user input parameters, allowing remote attackers without authentication to concatenate malicious SQL statements into database queries and steal sensitive data.

Vulnerability Impact:

• Data Leakage: Can obtain user accounts, passwords, personal information, etc. from the database.
• Data Tampering: Can modify database data, compromising integrity and reliability.
• Server Attack: May execute malicious code on the server through injected SQL, gaining server control.
• Denial of Service: May render the database service unavailable through specific SQL injection attacks.

Remediation: Immediately upgrade to the latest security patch version released by the vendor at: https://www.weaver.com.cn/cs/securityDownload.html . If immediate upgrade is not possible, restrict access to the /papi/ebuilder/form/freeform/getFieldValueFun path via access control policies, or deploy WAF to intercept requests containing SQL injection signatures.

• DBA Perspective: CVSS 9.8 means no authentication required, remotely exploitable, and wide impact. As a leading domestic OA system, Weaver Ecology10 is widely deployed in core industries such as government, state-owned enterprises, and finance. This interface’s SQL injection vulnerability could allow attackers to directly access sensitive data in the OA system’s underlying database, including organisational structures, approval processes, and personnel information. DBAs should immediately check if Weaver Ecology10 and the affected interface are in use, coordinate with application teams for emergency patch upgrades, or implement network access controls on the affected path before upgrading.

03｜IBM API Connect SQL Injection Vulnerability (CVE-2026-9074): Password Reset Function Becomes Attack Entry Point

On July 30, a security advisory disclosed an SQL injection vulnerability in IBM API Connect (CVE-2026-9074). The vulnerability stems from the password reset function lacking validation of external SQL statement input, allowing attackers to execute illegal SQL commands and steal sensitive database data.

Affected Versions:

• IBM API Connect >=12.1.0.0, <12.1.1.0
• IBM API Connect >=10.0.8.0, <10.0.8.10

Remediation: The vendor has released upgrade patches available at: https://www.ibm.com/support/pages/node/7278218.

• DBA Perspective: IBM API Connect is a core component of large enterprise API management platforms. The SQL injection vulnerability in its password reset function allows attackers to obtain sensitive database data. DBAs using IBM API Connect should immediately assess versions, schedule a patch window, and enforce the principle of least privilege for API management platform database accounts.

04｜SQLite Use-After-Free Vulnerability (CVE-2026-51303): May Lead to Code Execution

The ExprListDelete() routine in SQLite’s query expression parser has a Use-After-Free vulnerability (CVE-2026-51303). When parsing and rewriting crafted SQL statements containing nested expressions, window functions, or compound SELECT clauses, SQLite may prematurely free Expr nodes belonging to ExprList structures. Subsequent control flow paths retain dangling pointers to the freed Expr objects and continue to read and write heap memory.

Affected Versions: SQLite ≤ 3.51.2, fixed in 3.51.3.

Vulnerability Impact:

• Primary: Denial of service (application crash via SIGSEGV/heap corruption).
• Secondary: Information disclosure (out-of-bounds read from freed heap memory).
• Potential: If attackers can shape the heap layout, arbitrary code execution may be possible.

Prerequisites: Attackers must be able to execute controllable SQL statements against the SQLite database instance. Known PoC concepts have been released.

• DBA Perspective: SQLite is the world’s most widely deployed embedded database engine, present in billions of devices (including browsers, mobile applications, and embedded systems). This vulnerability allows authenticated SQL executors to trigger memory corruption, potentially leading to application crashes or even code execution. DBAs working with SQLite-based applications should work with development teams to check SQLite versions and upgrade to 3.51.3 or higher. SQLite’s widespread deployment means this vulnerability has an extremely broad potential impact.

05｜National Data Bureau: Over 120,000 High-Quality Datasets Built Nationwide, Encouraging “Token Economy” Innovation

On July 28, at the press conference for the 2026 China International Big Data Industry Expo, the National Data Bureau disclosed that as of June 2026, over 120,000 high-quality datasets had been built nationwide, with total data volume exceeding 1,565 petabytes.

Yu Ying, Deputy Director of the National Data Bureau, stated that high-quality datasets have become key “fuel” for the rapid development of artificial intelligence. The National Data Bureau encourages business model innovation based on token applications, exploring new transaction models such as token trading, and cultivating a market consensus of “paying for quality data.” Token applications will focus on deep integration with industries such as manufacturing, healthcare, and finance, driving the formation of a “data flywheel” effect – using model applications to drive data supply, and using data to empower model iteration.

2026 has been positioned as the “Year of Data Element Value Release.” The total national intelligent computing scale has reached 2.4 million PFLOPS, with intelligent computing accounting for over 80% of the eight national computing hubs.

• DBA Perspective: Policy support for the “token economy” means that business models on the AI data supply side are taking shape. The construction of 120,000 high-quality datasets and a data volume of 1,565 PB is macro-level positive news for database professionals – the larger and higher-quality the data, the stronger the demand for storage, retrieval, and governance. Encouraging a market consensus of “paying for quality data” will also drive a revaluation of data governance and database services.

📚 SQL Little Knowledge Point

This Issue’s Knowledge Point: What is a Use-After-Free (UAF) Vulnerability?

Use-After-Free (UAF) is a memory safety vulnerability that occurs when a program frees a block of memory but retains a pointer to that memory (dangling pointer) and subsequently continues to use that pointer to read or write memory.

Vulnerability Mechanism:

1. The program allocates a block of memory to store data.
2. The program frees the memory, marking it as reusable.
3. The program does not set the pointer to NULL.
4. The program later uses this dangling pointer to read/write memory – at which point the memory may have been overwritten with other data, leading to unpredictable behaviour.

CVE-2026-51303 Specifics: SQLite’s ExprListDelete() function, after freeing Expr nodes, does not clear the reverse references stored in parent expression structures, causing subsequent code paths to continue traversing the freed ExprList, resulting in UAF.

Potential Impact of UAF:

• Program crash (denial of service)
• Information disclosure (reading sensitive data from freed memory)
• Arbitrary code execution (if attackers can control the content of freed memory, they may hijack the program’s execution flow)

Implications for DBAs: UAF is one of the most dangerous types of memory safety vulnerabilities in C/C++ programs. As a widely deployed embedded database, SQLite’s UAF vulnerability could affect a vast number of applications. When evaluating database component security, memory safety should be an important consideration.

HiddenMerit Team Production Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.