📊 HiddenMerit Daily · Issue 18 Focus on Database Frontiers, Practical Insights for DBAs May 13, 2026 ｜ 5 Selected Global Breaking News 01｜Dameng Releases Four Strategic New Products, Domestic Database Moves Toward Intelligent Full‑Stack Era Recently, Dameng Data released four strategic flagship new products: the next‑generation Dameng Database Management System DM9, the new DAMENG PAI V2.0 all‑in‑one machine, Qiyun Database V4.0, and the graph database GDMBASE V4.0. The four products cover core scenarios including centralised, distributed, cloud‑native, all‑in‑one, and graph databases. DM9 features a centralised‑distributed integrated architecture, enabling enterprises to migrate smoothly without system refactoring, adding over 450 new features and fully integrating database design agents and operations agents, making AI and databases mutually endogenous. GDMBASE V4.0 supports efficient traversal of trillion‑edge graphs, and its multi‑modal fused query capability helps developers build AI‑native applications with lower complexity. · DBA Perspective: DM9’s intelligent O&M agent capabilities will automate routine inspections, fault diagnosis, and other basic operational tasks at scale. The DBA role will evolve from “manual inspection” to “agent policy manager” – setting automatic response rules, auditing AI decision‑making, customising high‑availability SLAs, and defining capacity management baselines. This is a career watershed – evolve or fall behind. · CTO Perspective: […]

📊 HiddenMerit Daily · Issue 17 Focus on Database Frontiers, Practical Insights for DBAs May 12, 2026 ｜ 5 Selected Global Breaking News 01｜CISA Formally Adds LiteLLM Vulnerability to Catalog, Warns of Active Exploitation On May 8, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) formally added a critical pre‑authentication SQL injection vulnerability (CVE-2026-42208) in the BerriAI open‑source AI gateway LiteLLM to its Known Exploited Vulnerabilities Catalog, signalling that the severity has reached a level requiring immediate remediation by federal agencies. The vulnerability stems from the LiteLLM proxy’s API key validation logic failing to parameterise user input, allowing attackers to bypass signature flows and read all cloud vendor and AI model API credentials stored in the database. The vulnerability was patched in version 1.83.7 on April 19. The Sysdig threat research team reported active in‑the‑wild exploitation approximately 36 hours after public disclosure. Snyk and other security organisations noted that the core issue is that the database query construction mixes caller‑provided key values directly into the query text instead of passing them as separate parameters – a classic SQL injection mistake, now replicated at scale in AI infrastructure. As a single point of entry connecting multiple LLM providers (OpenAI, Azure OpenAI, […]

📊 HiddenMerit Daily · Issue 16 Focus on Database Frontiers, Practical Insights for DBAs May 9–11, 2026 ｜ 5 Selected Global Breaking News 01｜OceanBase CEO Yang Bing: Real‑Time Online Processing of Unstructured Data Is the Biggest Database Need in the AI Era On the afternoon of May 9, at the 2026 China Economic Annual Observation and Xinhua Finance Global Ecosystem Partners Conference, Yang Bing, Vice President of Ant Group and CEO of OceanBase, stated that whether unstructured data can truly be processed online in real time is the biggest need in the AI era. How to build an open, real‑time, multi‑modal, and hybrid data lake is the core problem that the technology foundation of the AI era must solve. Yang Bing believes that the software industry is undergoing a fundamental transformation from “serving people” to “serving agents”. Databases in the AI era must simultaneously handle two major demands: core business critical workloads and AI innovation workloads – intelligently searching and retrieving multi‑modal data at the retrieval level, breaking through the integration of structured, unstructured, and semi‑structured data storage, and providing enterprises with unified data services. Quoting the ancient saying “long divided, must unite”, he interpreted that the data foundation has […]

📊 HiddenMerit Daily · Issue 15 Focus on Database Frontiers, Practical Insights for DBAs May 10, 2026 ｜ 5 Selected Global Breaking News 01｜Community Controversy Continues: MySQL 9.7 LTS “True Vector” Capabilities Shrunk, Some Are Voting with Their Feet Although MySQL 9.7 LTS moved several previously enterprise‑only features (vector functions, Hypergraph Optimizer, JSON Duality Views) to the Community Edition at the end of April, the open‑source “sweet spot” has fallen far short of community expectations. The reality: in Chapter 14.21 of the 9.7 Reference Manual, the entire vector section is missing core support such as vector indexes and nearest‑neighbour search. Vector columns cannot be used as primary keys, foreign keys, or unique keys, nor do they support any aggregate functions. The only function usable for vector retrieval, DISTANCE(), is marked as an enterprise‑only paid feature in the manual. This means Community Edition users have the VECTOR_TYPE concept but cannot efficiently perform vector search. Some developers even accuse Oracle of lacking strategic sincerity in opening up the community with 9.7, and community activity and user satisfaction have fallen to a 24‑month low. The strained relationship between the MySQL community and Oracle may accelerate developer migration to forks like PostgreSQL and MariaDB. […]

📊 HiddenMerit Daily · Issue 14 Focus on Database Frontiers, Practical Insights for DBAs May 9, 2026 ｜ 5 Selected Global Breaking News 01｜AI Infrastructure Security Alert: Severe Pre‑Auth SQL Injection in LiteLLM Sparks Storm On May 6, the Bishop Fox security research team publicly released a technical reproduction report for CVE-2026-42208. This vulnerability exists in the popular open‑source AI gateway LiteLLM proxy developed by BerriAI, affecting versions 1.81.16 through 1.83.6. An attacker can send specially crafted requests to public endpoints (e.g., LLM API routes like /v1/chat/completions) without any authentication. Because the server returns the same 401 HTTP response for every probe, the attacker uses PostgreSQL’s pg_sleep() function for time‑based blind injection to evade detection. More seriously, the default Docker Compose deployment grants the application user superuser privileges on the database, enabling the attacker not only to steal sensitive metadata but also to perform full read/write operations on all tables managed by LiteLLM – including the LiteLLM_VerificationToken table which stores all virtual keys. Active in‑the‑wild exploitation was observed approximately 36 hours after the GitHub advisory. Upgrade to version 1.83.7 or later immediately. Separately, the PraisonAI multi‑agent system just patched another series of critical SQL injection vulnerabilities (CVE-2026-41496, CVSS 8.1) affecting […]

📊 HiddenMerit Daily · Issue 13 Focus on Database Frontiers, Practical Insights for DBAs May 8, 2026 ｜ 5 Selected Global Breaking News 01｜CETC Kingware Replaces Oracle+PG Hybrid Architecture in Real‑World Tests: TPS Up 35%, Breaking the “One Database Replaces Two” Barrier In a recent migration validation for a large telecom group’s core network management system, CETC Kingware (formerly Renda Kingware) achieved a 35% increase in core transaction throughput (TPS) after replacing the existing Oracle and PostgreSQL hybrid architecture. The system covers 12 professional domains (transmission, wireless, etc.), involved full migration of 8 TB of historical data, and smoothly switched 11 Oracle instances and 2 PostgreSQL instances, with 100% data accuracy. Under dual high loads – maintaining strong transaction consistency while delivering excellent GIS spatial data processing capability – peak CPU usage dropped from 88% to 72%. Average response latency decreased by 27%, and GIS spatial query time was reduced by 20.8%. Kingware’s kernel‑level dynamic syntax adaptation technology simultaneously supports multiple syntax modes (Oracle, PostgreSQL, MySQL, etc.) in a single database, compressing complex heterogeneous “multi‑database collaboration” architectures into a single domestic platform. · DBA Perspective: This validation of “one database replacing two heterogeneous databases” directly establishes Kingware’s unique cost and […]

📊 HiddenMerit Daily · Issue 12 Focus on Database Frontiers, Practical Insights for DBAs May 7, 2026 ｜ 5 Selected Global Breaking News 01｜AI Security Microscope Strikes Again: 20‑Year‑Old RCE Flaw Exposed, 80% of Cloud PostgreSQL Directly Exposed On May 4, Wiz’s AI‑powered security analysis tool Xint Code, during the ZeroDay.Cloud security event, uncovered a heap buffer overflow vulnerability (CVE-2026-2005) that had lain dormant in the PostgreSQL pgcrypto extension for two decades, as well as a still‑widespread JSON schema validation flaw in MariaDB (CVE-2026-32710). These vulnerabilities have existed since pgcrypto was first contributed in 2005. Affected PostgreSQL instances must be upgraded immediately to patched versions such as v18.2, v17.8, etc. Further analysis by Wiz found that among cloud environments running PostgreSQL, 80% are deployed, and of those, 45% are directly exposed to the internet. · DBA Perspective · Immediate inventory of two high‑risk indicators: First, check production environments for pgcrypto extension loading and identify PostgreSQL instances directly exposed to the internet. Second, urgently review user creation permissions and establish a strict approval process for extension creation. · Beware of cloud network exposure risks: 45% of cloud PG instances exposed to the internet is a devastating risk. You must scan forward‑facing […]

Here is the corrected **fully English** version of **”HiddenMerit Daily · Issue 5″** with all remaining Chinese phrases properly translated. — # 📊 HiddenMerit Daily · Issue 5 > **Focus on Database Frontiers, Practical Insights for DBAs** > May 1, 2026 ｜ 5 Selected Global Hot Topics — ## 01｜Domestic Database Industry Enters Knockout Round: AI Rewrites the Rules, Ecosystem Determines Survival On April 22, the 2026 China Database Technology and Industry Conference was held in Beijing. Beyond Dameng’s release of four new products, the market report released by CCID Consulting revealed deeper industry trends: China’s database industry is moving from “large-scale replacement” into a new phase of “high-quality development and market shakeout.” **Core Data**: | Metric | Value | Interpretation | |——–|——-|—————-| | 2025 Market Size | 43.02 billion yuan | Domestic vendors already lead foreign vendors in market share | | Leading Domestic Brand Sales | Steady and sustained growth | Market concentration rapidly increasing | | New Industry Entrants | Continuously decreasing | Era of extensive expansion is over | **Three Driving Forces Behind the Knockout Round**: 1. **Deep AI Penetration**: Databases need to simultaneously handle both data elementization and intelligent application demands. The ability to natively […]