📊 HiddenMerit Morning Post · Issue 78

Focus on Database Frontiers, Practical Insights for DBAs August 18, 2026 ｜ 5 Selected Global Breaking News

01｜Metabase Zero‑Day CVE-2026-72898 (CVSS 10.0) In‑Wild Exploitation Expands, 2,500 Instances at Risk

The Metabase zero‑day SQL injection vulnerability (CVE-2026-72898, CVSS 10.0) disclosed on August 6 is continuing to escalate. According to Shodan data, approximately 2,500 Metabase instances are currently discoverable. Security firm Wiz reported that approximately 13% of cloud environments have deployed self‑hosted Metabase instances, with approximately 25% fully exposed to the public internet.

Vulnerability Details: Attackers can inject arbitrary SQL via the /api/session/reset_password interface without authentication, gaining instance administrator privileges, enabling raw SQL access, and exfiltrating or tampering with credentials, API keys, Slack tokens, and other sensitive data. Multiple companies have confirmed impacts, including Framework, Tally, LexisNexis, Kilo Code, n8n, and ChecklyHQ. CISA has added the vulnerability to its KEV catalog, requiring federal agencies to remediate by August 14. Japan’s JPCERT has also issued an urgent alert.

Remediation: Self‑hosted instances must be manually upgraded to 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, or 1.63.5. After patching, immediately revoke active sessions, review administrator accounts, and rotate all credentials to connected databases.

• DBA Perspective: A CVSS 10.0 vulnerability is rare in 2026, and the CISA mandatory remediation deadline indicates it has been weaponised. Metabase typically holds high‑privilege database connections – once compromised, it can directly access downstream production databases. All DBAs using Metabase self‑hosted instances should immediately upgrade and rotate credentials. Checkly’s reflection is worth noting: “Rotating credentials solves the immediate problem, but doesn’t address the root cause – analytics environments store more sensitive data than actually needed, with overly broad access permissions.”

02｜OceanBase Launches Series A Funding Round: Targeting RMB 2‑3 Billion, Annualized Revenue Exceeds RMB 1.4 Billion, Benchmarking “China’s Databricks”

According to Caijing, Ant Group’s independent database company OceanBase launched its Series A funding round in late July, targeting approximately RMB 2‑3 billion, and has already engaged with multiple leading investment institutions. This marks OceanBase’s first external funding since its establishment. In March 2024, OceanBase established an independent board of directors with a CEO‑accountable governance structure.

Key Data: In 2026, OceanBase’s annualized revenue has exceeded RMB 1.4 billion (approximately $200 million), representing approximately 70% year‑on‑year growth. According to CCID Consulting, OceanBase ranked first in China’s distributed database market. As of June 2026, OceanBase has served over 400 financial institutions, with nearly 70% of trillion‑yuan banks deploying its systems. Global customers have exceeded 4,000, with CEO Yang Bing projecting that the non‑financial customer ratio will increase to approximately 50% in 2026.

Strategic Benchmarking: Media have referred to OceanBase as “China’s Databricks.” Databricks extends from data analytics and AI into databases, while OceanBase starts from distributed databases and financial core systems, expanding into enterprise‑wide data management, agent data foundation, and data services. Three Ant Group subsidiaries are simultaneously pursuing independent financing: Ant International completed a Series A round of approximately $1.2 billion in July, and Ant Digital is preparing for a Pre‑IPO round.

• DBA Perspective: OceanBase’s first external funding is a landmark event for domestic databases moving toward “market‑oriented independent operations.” Benchmarking against Databricks means its strategic direction is extending from a “database company” to an “AI data platform” – DBA skills need to expand from “distributed database operations” to “AI data platform architecture and multi‑modal data management.” CAICT reports note that AI capabilities are evolving from optional to architectural essentials, and capital market valuation logic is shifting from “cloud‑native” to “AI data platform.”

03｜Dameng Surpasses Foreign Vendors for the First Time to Rank First in China Database Market

According to the recently released “2025‑2026 China Platform Software Market Research Annual Report” by CCID Consulting, Dameng surpassed foreign database vendors for the first time in 2025, ranking first in China’s database management system market. Since 2019, Dameng has maintained the top position among domestic vendors for seven consecutive years. This marks a historic breakthrough, moving from “number one domestic” to “number one overall.”

Dameng’s 2025 revenue was RMB 1.306 billion. The company adheres to a path of original innovation and independent R&D, with 100% self‑developed source code, and is the first domestic database product to pass the independent control assessment. Its products serve major customers including China Construction Bank, PICC, State Grid, China Travelsky, and China Mobile, with successful deployments in finance, energy, aviation, telecommunications, and dozens of other sectors. In the AI era, Dameng is accelerating the integration of AI capabilities into its database products, launching next‑generation AI‑native databases and multi‑modal converged databases.

During the same period, Dameng registered the “Dameng Bailing Connection Database Development and Management Tool Software V4.0” software copyright. R&D investment in 2025 was RMB 253 million, up 22.63% year‑on‑year. Dameng also recently won the CNOOC data center infrastructure upgrade project, further penetrating the energy sector.

• DBA Perspective: Dameng’s first‑place overall ranking is a milestone for domestic databases – a domestic vendor surpassing Oracle and other foreign giants in revenue for the first time. For DBAs, this means the “leading candidates” for Xinchuang selection now have stronger market data backing. The 100% self‑developed code path and continued deployments in energy, finance, government, and other core sectors provide quantifiable references for DBAs selecting Dameng products in critical sectors.

04｜Vastbase Adjusts Private Placement Plan: Total Fundraising Reduced to RMB 614 Million, HTAP Remains Priority

On August 18, Vastbase (603138.SH) announced an adjustment to its 2026 private placement plan, reducing total fundraising from RMB 702 million to RMB 614 million (RMB 613,750,900). The next‑generation high‑performance hybrid transaction/analytical database (HTAP) project remains the top priority with RMB 488,750,900 allocated. The multi‑modal time‑series database project allocation has been reduced from RMB 212,863,600 to RMB 125 million.

Vastbase believes the traditional “OLTP database + OLAP data warehouse” separated architecture can no longer meet the real‑time, integrated, and high‑concurrency data processing requirements of finance, retail, telecommunications, manufacturing, and other core sectors. The HTAP project will deepen transaction database capabilities while integrating OLAP analytics to achieve unified transaction and analytics processing.

• DBA Perspective: Vastbase’s adjusted private placement maintains nearly RMB 490 million in HTAP investment, confirming that HTAP integration remains a deterministic trend. For DBAs, HTAP architecture means moving away from ETL pipelines and dual‑system maintenance, but requires mastering mixed‑load tuning – coordinating transaction response and batch analytics within a single system. The reduction in multi‑modal time‑series project size suggests DBAs should monitor the vendor’s timeline in this direction.

05｜DTCC 2026 China Database Technology Conference Opens This Week: AI + Database Becomes Core Theme

From August 20‑22, the 17th China Database Technology Conference (DTCC 2026) will be held at the Langes Hotel in Beijing. The conference theme is “Integrating Data, Aggregating Intelligence, Creating the Future,” featuring 2 main venues, 17+ specialised technical tracks, and over 100 industry technical experts participating.

Key Highlights:

• Data+AI Full‑Chain Integration: Three‑part series covering low‑cost enterprise large model implementation, AI‑native databases, vector retrieval, and AI agent data engineering.
• AI for DB Intelligent Autonomous Operations: Focused on operations agents, multi‑agent collaboration, and ontology‑driven fault localisation, showcasing AIOps implementation in telecommunications, internet, and other industries.
• Database Kernel and Xinchuang Autonomous Control: Real‑world domestic replacement practices in finance, telecommunications, and insurance core systems, plus all‑in‑one transformation practices.
• Frontier Niches: Specialised tracks for vector databases, multi‑modal databases, distributed systems, and real‑time lakehouses.

The conference program committee includes Professor Wang Hongzhi from Harbin Institute of Technology, Hou Shengwen from China Telecom E‑Surfing Cloud, Li Haixiang from Tencent TDSQL, and Zhou Zhengzhong from the PostgreSQL China community.

• DBA Perspective: DTCC is the largest technical conference in China’s database field. This year, “Data+AI” is the absolute core theme – with both AI For DB and DB For AI tracks running in parallel. DBAs are advised to focus on the Data+AI Full‑Chain Integration and AI for DB Intelligent Operations tracks – these two directions will directly impact the skill evolution path for DBAs over the next 3‑5 years. The real‑world domestic replacement practice cases shared at the conference in finance, telecommunications, and other sectors are also important references for Xinchuang selection.

📚 SQL Little Knowledge Point

This Issue’s Knowledge Point: What is the CCID China Database Market Ranking?

CCID Consulting is a research institution directly under China’s Ministry of Industry and Information Technology. Its “China Platform Software Market Research Annual Report” is one of the most authoritative industry reports in the domestic database market.

Historical Significance of the 2025 Ranking: Dameng surpassing foreign vendors for the first time to top the Chinese market is a milestone event in the domestic database field. Since 2019, Dameng has maintained the top position among domestic vendors for seven consecutive years, and this marks the transition from “number one domestic” to “number one overall.”

Ranking Indicator System: The report comprehensively evaluates vendors based on annual revenue, market share, customer coverage depth, industry penetration rates, and other dimensions. Dameng’s 2025 revenue was RMB 1.306 billion, with products serving dozens of critical sectors including finance, energy, aviation, and telecommunications.

Implications for DBAs: The CCID report is an authoritative third‑party data source that can be referenced in Xinchuang selection. Metrics such as leading vendor ranking changes, revenue scale, and industry penetration rates serve as important reference dimensions for evaluating the long‑term competitiveness of domestic databases.

HiddenMerit Team Production Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.