📊 HiddenMerit Morning Post · Issue 85

Focus on Database Frontiers, Practical Insights for DBAs August 25, 2026 ｜ 5 Selected Global Breaking News

01｜PostgreSQL Exposes High‑Risk Heap Overflow CVE-2026-14669: PoC Public, Remote Code Execution Possible

On August 13, PostgreSQL released a security update fixing a heap buffer overflow vulnerability tracked as CVE-2026-14669, with a CVSS score of 8.8 (High). Full technical details and PoC exploit code have now been publicly released, significantly increasing the risk.

Vulnerability Details: The vulnerability stems from a flaw in PostgreSQL’s to_char() function when processing timestamps. The internal function datetime_to_char_body() allocates a working buffer based on the format string, but when processing time zone paths, it copies user‑controlled POSIX time zone abbreviations into the buffer without length checking. Attackers can exploit this with an overly long time zone abbreviation to trigger a heap overflow, potentially converting it into full code execution capability.

Affected Versions: The vulnerability affects all PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24, covering multiple major and older version branches. Given PostgreSQL’s widespread deployment as the backend for countless web applications and services, the impact scope is enormous.

Remediation: The PostgreSQL team fixed this vulnerability in the August 2026 update. With public PoC code now available, all affected users are strongly advised to upgrade to the patched versions immediately and not rely solely on network‑layer protections.

• DBA Perspective: This is another high‑risk PostgreSQL vulnerability following CVE-2026-6472 (CREATE TYPE missing permissions) and CVE-2026-6473 (integer wraparound) this year. The CVSS 8.8 rating combined with a public PoC means the exploitation barrier has been significantly lowered. to_char() is a widely used time‑formatting function – any user with SQL execution privileges can trigger it, not just superusers. DBAs are advised to immediately check PostgreSQL versions (SELECT version();), prioritise upgrades within the Q3 patch window, and implement least‑privilege principles for database connections.

02｜DTCC 2026 Conference Recap: AI + Database Becomes Absolute Core Theme, Multiple Vendors Release AI‑Native Strategies

From August 20‑22, the 17th China Database Technology Conference (DTCC 2026) was held in Beijing. The conference, themed “Integrating Data, Aggregating Intelligence, Creating the Future,” featured 2 main venues, 17+ specialised technical tracks, and 100 top industry experts sharing insights. Deep integration of AI and databases became the central theme, with multiple leading vendors releasing AI‑era database strategies and products.

Huawei openGauss: oGRAC Commercial Version Coming Soon. openGauss R&D Director Xiong Qin reviewed six years of open‑source achievements and proposed a “1+2” strategy – “1” is continuing to build a high‑performance, highly stable, high‑security primary‑standby TP database kernel; “2” are the two major directions of oGRAC multi‑write database and AI strategy. oGRAC 2‑node performance has reached 4.7 million tpmC, with a formal commercial version expected on September 30.

China Telecom e‑Surfing Cloud TeleDB: Positioning as an “AI‑Native Hyper‑Converged One‑Stop Intelligent Data Platform.” CTO Li Yuesen proposed a three‑layer architecture from bottom to top: Data Infra provides a centralised‑distributed integrated data foundation; AI Infra integrates vector, full‑text, and graph multi‑modal retrieval capabilities; DB Agent Infra deeply integrates Agent Runtime into the database kernel. TeleDB is the only central SOE database product to pass the distributed database national standard assessment, having served over 2,000 customers.

Mobile Cloud HaishanDB: Proposing “Built‑In Intelligence, Full‑Stack Trustworthy” Architecture. Mobile Cloud Database Product Department Deputy General Manager Hu Jianhua shared HaishanDB’s technology evolution from autonomous control to AI‑native. Core capabilities include: intent understanding (topping the Archer Bench international authoritative leaderboard, ranking first in both Chinese accuracy and overall accuracy), memory management (agent‑native memory hub), and security assurance (full‑chain encrypted processing).

GBASE GBase 8c: Focusing on AI‑Native Architecture Track. GBASE set up a dedicated “AI‑Native · Data Building Xinchuang” track, systematically showcasing GBase 8c’s AI‑native capabilities – vector and scalar fused retrieval, multi‑modal data unified storage, and GBase AIOps natural language‑driven intelligent operations.

Dameng: Dual‑Track Layout in All‑in‑One and Cloud Databases. Dameng All‑in‑One Product Line General Manager Zhu Honglei delivered a keynote on “DAMENG PAI Database All‑in‑One – From Extreme Performance to Intelligent Computing Future”; Dameng Qiyun Database Technology Expert Fan Shuaibing shared “The Intelligent Leap of Cloud Databases: From ‘Managed Operations’ to ‘AI Autonomy’,” outlining Dameng’s complete technology blueprint under the dual waves of domestic replacement and AI.

Domestic Database Three‑Strong Pattern Validated: Dameng was again confirmed as ranking first in China database market share during DTCC.

• DBA Perspective: DTCC is an important window for DBAs to access technology evolution directions. This year, “AI + Database” became the absolute core theme, and the concentrated release of AI‑native strategies by multiple vendors signals that the database industry is evolving from “cloud‑native” to “AI‑native.” DBAs are advised to focus on the following technology directions: openGauss’s oGRAC multi‑write cluster (commercial deployment can be tracked after Q4 2026), TeleDB’s Agent Runtime kernel integration, and HaishanDB’s memory management system – these directions will directly impact DBA operational toolchains and skill development over the next 3‑5 years.

03｜CakePHP Exposes SQL Injection CVE-2026-77635 (CVSS 9.2): jsonPath Parameter Can Lead to Database Compromise

On August 24, CVE-2026-77635 was disclosed, affecting the cakephp/cakephp and cakephp/database components of the CakePHP framework, with a CVSS score of 9.2 (Critical).

Vulnerability Details: CakePHP’s FunctionsBuilder::jsonValue() method, when used with the PostgresDriver, contains an SQL injection vulnerability when user‑controlled data is passed to the jsonPath parameter. Attackers can exploit this remotely over the network without authentication, with low attack complexity, no user interaction required, and high impact on confidentiality and integrity.

Affected Versions: CakePHP 5.1.x (<5.1.10), 5.2.x (<5.2.15), 5.3.x (<5.3.7). Fixed in versions 5.1.10, 5.2.15, and 5.3.7.

• DBA Perspective: CakePHP is a widely used PHP development framework. The jsonValue() SQL injection vulnerability could allow attackers to directly read and write to the backend database. DBAs using the CakePHP framework should immediately check the CakePHP versions in project dependencies and work with development teams to upgrade to patched versions. The vulnerability is exploitable without authentication, and the CVSS 9.2 rating means it should be placed in the high‑priority queue within the Q3 patch window.

04｜Metabase Zero‑Day CVE-2026-72898 (CVSS 10.0) In‑Wild Exploitation Expands, Multiple Companies Confirm Attacks

The Metabase zero‑day SQL injection vulnerability (CVE-2026-72898, CVSS 10.0) disclosed on August 6 continues to escalate. The vulnerability allows remote unauthenticated attackers to inject arbitrary SQL via the /api/session/reset_password endpoint, gaining full administrator privileges.

Attack Scope and Confirmed Victims: Shodan has tracked approximately 2,500 exposed Metabase instances; Wiz reported that approximately 13% of cloud environments have deployed self‑hosted Metabase, with approximately 25% fully exposed to the public internet. Multiple companies have publicly confirmed being attacked, including Kilo Code (acquired by Anaconda), Y Combinator‑backed Tally, PC manufacturer Framework, workflow automation platform n8n, and AI testing provider ChecklyHQ.

Data Exfiltrated: Attackers stole sensitive information including usernames, email addresses, cloud passwords, OpenTelemetry API key hashes, and Slack access tokens.

Remediation: Self‑hosted instances must be upgraded to 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, or 1.63.5. After patching, immediately revoke active sessions, review administrator accounts, and rotate all credentials to connected databases.

Checkly reflected after the incident: “Rotating credentials solved the immediate problem, but did not address the root cause – the analytics environment stored more sensitive data than actually needed, with overly broad access permissions.”

• DBA Perspective: A CVSS 10.0 vulnerability is rare in 2026. Metabase typically holds high‑privilege database connections – once compromised, it can directly access downstream production databases. All DBAs using Metabase self‑hosted instances should immediately check versions and upgrade. Checkly’s reflection is worth learning from: rotating credentials is “treating the symptom”; re‑examining the data storage scope and permission boundaries of analytics environments is “treating the root cause.”

05｜OceanBase Seeks Series A Funding: Targeting RMB 2‑3 Billion, Annualized Revenue Exceeds RMB 1.4 Billion

According to Caijing reports, Ant Group’s independent database company OceanBase is seeking Series A funding of approximately RMB 2‑3 billion and has already engaged with multiple leading investment institutions. This marks OceanBase’s first external funding since its establishment.

Key Data: In 2026, OceanBase’s annualized revenue has exceeded RMB 1.4 billion (approximately $200 million) , up approximately 70% year‑on‑year. Global customers have exceeded 4,000, with the non‑financial customer ratio expected to approach 50‑50 in 2026. OceanBase ranked first in China’s distributed database market in 2025.

Strategic Benchmarking: OceanBase has been referred to in the media as “China’s Databricks.” Databricks extends from data analytics into databases, while OceanBase starts from distributed databases and financial core systems, expanding into enterprise‑wide data management, agent data foundations, and data services.

IPO Plans: OceanBase CEO Yang Bing previously stated that the company aims to go public in approximately three to four years.

• DBA Perspective: OceanBase’s first external funding is a landmark event for domestic databases moving toward “market‑oriented independent operations.” The annualized revenue exceeding RMB 1.4 billion and 70% growth validate the commercial maturity of domestic distributed databases. Benchmarking against Databricks means its strategic direction is extending from a “database company” to an “AI data platform” – DBA skills need to expand from “distributed database operations” to “AI data platform architecture and multi‑modal data management.”

📚 SQL Little Knowledge Point

This Issue’s Knowledge Point: What is DTCC (China Database Technology Conference)?

DTCC (China Database Technology Conference) is the largest and most influential technical conference in China’s database field, hosted by IT168 in partnership with the ITPUB and ChinaUnix technical communities, held annually in Beijing in August.

DTCC 2026 Core Theme: The conference was themed “Integrating Data, Aggregating Intelligence, Creating the Future,” with “AI + Database” becoming the absolute core theme. Multiple leading vendors concentrated on releasing AI‑era database strategies and products, covering:

Vendor	Release/Disclosure	Key Highlights
Huawei openGauss	oGRAC commercial version (Sep 30)	2‑node 4.7M tpmC, multi‑write cluster
China Telecom TeleDB	AI‑Native Hyper‑Converged Platform	Only central SOE product to pass distributed DB national standard
Mobile Cloud HaishanDB	Built‑In Intelligence Architecture	Top in Archer Bench dual categories
GBASE GBase 8c	AI‑Native track	Vector + scalar fused retrieval
Dameng	All‑in‑One + Cloud DB dual track	#1 market share

Implications for DBAs: The technology directions at DTCC often预示 the skill evolution path for DBAs over the next 3‑5 years. This year, “AI‑Native” became the consensus across the conference. When planning career development, DBAs should focus on building new skills in both “AI for DB” (AI empowering database operations) and “DB for AI” (databases supporting AI applications).

HiddenMerit Team Production Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.