📊 HiddenMerit Daily · Issue 18 Focus on Database Frontiers, Practical Insights for DBAs May 13, 2026 ｜ 5 Selected Global Breaking News 01｜Dameng Releases Four Strategic New Products, Domestic Database Moves Toward Intelligent Full‑Stack Era Recently, Dameng Data released four strategic flagship new products: the next‑generation Dameng Database Management System DM9, the new DAMENG PAI V2.0 all‑in‑one machine, Qiyun Database V4.0, and the graph database GDMBASE V4.0. The four products cover core scenarios including centralised, distributed, cloud‑native, all‑in‑one, and graph databases. DM9 features a centralised‑distributed integrated architecture, enabling enterprises to migrate smoothly without system refactoring, adding over 450 new features and fully integrating database design agents and operations agents, making AI and databases mutually endogenous. GDMBASE V4.0 supports efficient traversal of trillion‑edge graphs, and its multi‑modal fused query capability helps developers build AI‑native applications with lower complexity. · DBA Perspective: DM9’s intelligent O&M agent capabilities will automate routine inspections, fault diagnosis, and other basic operational tasks at scale. The DBA role will evolve from “manual inspection” to “agent policy manager” – setting automatic response rules, auditing AI decision‑making, customising high‑availability SLAs, and defining capacity management baselines. This is a career watershed – evolve or fall behind. · CTO Perspective: […]

📊 HiddenMerit Daily · Issue 17 Focus on Database Frontiers, Practical Insights for DBAs May 12, 2026 ｜ 5 Selected Global Breaking News 01｜CISA Formally Adds LiteLLM Vulnerability to Catalog, Warns of Active Exploitation On May 8, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) formally added a critical pre‑authentication SQL injection vulnerability (CVE-2026-42208) in the BerriAI open‑source AI gateway LiteLLM to its Known Exploited Vulnerabilities Catalog, signalling that the severity has reached a level requiring immediate remediation by federal agencies. The vulnerability stems from the LiteLLM proxy’s API key validation logic failing to parameterise user input, allowing attackers to bypass signature flows and read all cloud vendor and AI model API credentials stored in the database. The vulnerability was patched in version 1.83.7 on April 19. The Sysdig threat research team reported active in‑the‑wild exploitation approximately 36 hours after public disclosure. Snyk and other security organisations noted that the core issue is that the database query construction mixes caller‑provided key values directly into the query text instead of passing them as separate parameters – a classic SQL injection mistake, now replicated at scale in AI infrastructure. As a single point of entry connecting multiple LLM providers (OpenAI, Azure OpenAI, […]

📊 HiddenMerit Daily · Issue 16 Focus on Database Frontiers, Practical Insights for DBAs May 9–11, 2026 ｜ 5 Selected Global Breaking News 01｜OceanBase CEO Yang Bing: Real‑Time Online Processing of Unstructured Data Is the Biggest Database Need in the AI Era On the afternoon of May 9, at the 2026 China Economic Annual Observation and Xinhua Finance Global Ecosystem Partners Conference, Yang Bing, Vice President of Ant Group and CEO of OceanBase, stated that whether unstructured data can truly be processed online in real time is the biggest need in the AI era. How to build an open, real‑time, multi‑modal, and hybrid data lake is the core problem that the technology foundation of the AI era must solve. Yang Bing believes that the software industry is undergoing a fundamental transformation from “serving people” to “serving agents”. Databases in the AI era must simultaneously handle two major demands: core business critical workloads and AI innovation workloads – intelligently searching and retrieving multi‑modal data at the retrieval level, breaking through the integration of structured, unstructured, and semi‑structured data storage, and providing enterprises with unified data services. Quoting the ancient saying “long divided, must unite”, he interpreted that the data foundation has […]

📊 HiddenMerit Daily · Issue 15 Focus on Database Frontiers, Practical Insights for DBAs May 10, 2026 ｜ 5 Selected Global Breaking News 01｜Community Controversy Continues: MySQL 9.7 LTS “True Vector” Capabilities Shrunk, Some Are Voting with Their Feet Although MySQL 9.7 LTS moved several previously enterprise‑only features (vector functions, Hypergraph Optimizer, JSON Duality Views) to the Community Edition at the end of April, the open‑source “sweet spot” has fallen far short of community expectations. The reality: in Chapter 14.21 of the 9.7 Reference Manual, the entire vector section is missing core support such as vector indexes and nearest‑neighbour search. Vector columns cannot be used as primary keys, foreign keys, or unique keys, nor do they support any aggregate functions. The only function usable for vector retrieval, DISTANCE(), is marked as an enterprise‑only paid feature in the manual. This means Community Edition users have the VECTOR_TYPE concept but cannot efficiently perform vector search. Some developers even accuse Oracle of lacking strategic sincerity in opening up the community with 9.7, and community activity and user satisfaction have fallen to a 24‑month low. The strained relationship between the MySQL community and Oracle may accelerate developer migration to forks like PostgreSQL and MariaDB. […]

📊 HiddenMerit Daily · Issue 14 Focus on Database Frontiers, Practical Insights for DBAs May 9, 2026 ｜ 5 Selected Global Breaking News 01｜AI Infrastructure Security Alert: Severe Pre‑Auth SQL Injection in LiteLLM Sparks Storm On May 6, the Bishop Fox security research team publicly released a technical reproduction report for CVE-2026-42208. This vulnerability exists in the popular open‑source AI gateway LiteLLM proxy developed by BerriAI, affecting versions 1.81.16 through 1.83.6. An attacker can send specially crafted requests to public endpoints (e.g., LLM API routes like /v1/chat/completions) without any authentication. Because the server returns the same 401 HTTP response for every probe, the attacker uses PostgreSQL’s pg_sleep() function for time‑based blind injection to evade detection. More seriously, the default Docker Compose deployment grants the application user superuser privileges on the database, enabling the attacker not only to steal sensitive metadata but also to perform full read/write operations on all tables managed by LiteLLM – including the LiteLLM_VerificationToken table which stores all virtual keys. Active in‑the‑wild exploitation was observed approximately 36 hours after the GitHub advisory. Upgrade to version 1.83.7 or later immediately. Separately, the PraisonAI multi‑agent system just patched another series of critical SQL injection vulnerabilities (CVE-2026-41496, CVSS 8.1) affecting […]

📊 HiddenMerit Daily · Issue 13 Focus on Database Frontiers, Practical Insights for DBAs May 8, 2026 ｜ 5 Selected Global Breaking News 01｜CETC Kingware Replaces Oracle+PG Hybrid Architecture in Real‑World Tests: TPS Up 35%, Breaking the “One Database Replaces Two” Barrier In a recent migration validation for a large telecom group’s core network management system, CETC Kingware (formerly Renda Kingware) achieved a 35% increase in core transaction throughput (TPS) after replacing the existing Oracle and PostgreSQL hybrid architecture. The system covers 12 professional domains (transmission, wireless, etc.), involved full migration of 8 TB of historical data, and smoothly switched 11 Oracle instances and 2 PostgreSQL instances, with 100% data accuracy. Under dual high loads – maintaining strong transaction consistency while delivering excellent GIS spatial data processing capability – peak CPU usage dropped from 88% to 72%. Average response latency decreased by 27%, and GIS spatial query time was reduced by 20.8%. Kingware’s kernel‑level dynamic syntax adaptation technology simultaneously supports multiple syntax modes (Oracle, PostgreSQL, MySQL, etc.) in a single database, compressing complex heterogeneous “multi‑database collaboration” architectures into a single domestic platform. · DBA Perspective: This validation of “one database replacing two heterogeneous databases” directly establishes Kingware’s unique cost and […]

📊 HiddenMerit Daily · Issue 12 Focus on Database Frontiers, Practical Insights for DBAs May 7, 2026 ｜ 5 Selected Global Breaking News 01｜AI Security Microscope Strikes Again: 20‑Year‑Old RCE Flaw Exposed, 80% of Cloud PostgreSQL Directly Exposed On May 4, Wiz’s AI‑powered security analysis tool Xint Code, during the ZeroDay.Cloud security event, uncovered a heap buffer overflow vulnerability (CVE-2026-2005) that had lain dormant in the PostgreSQL pgcrypto extension for two decades, as well as a still‑widespread JSON schema validation flaw in MariaDB (CVE-2026-32710). These vulnerabilities have existed since pgcrypto was first contributed in 2005. Affected PostgreSQL instances must be upgraded immediately to patched versions such as v18.2, v17.8, etc. Further analysis by Wiz found that among cloud environments running PostgreSQL, 80% are deployed, and of those, 45% are directly exposed to the internet. · DBA Perspective · Immediate inventory of two high‑risk indicators: First, check production environments for pgcrypto extension loading and identify PostgreSQL instances directly exposed to the internet. Second, urgently review user creation permissions and establish a strict approval process for extension creation. · Beware of cloud network exposure risks: 45% of cloud PG instances exposed to the internet is a devastating risk. You must scan forward‑facing […]

📊 HiddenMerit Daily · Issue 10 Focus on Database Frontiers, Practical Insights for DBAs May 5, 2026 ｜ 5 Selected Global Breaking News 01｜OceanBase Fully Discloses Global Business for First Time: Covering Over 1.3 Billion Users, Overseas Revenue Up 200% On May 3, at the Infinity2026 conference held in Kuala Lumpur, Malaysia, OceanBase for the first time fully disclosed its global business progress, and simultaneously announced the launch of its Global Support Center in Kuala Lumpur, promising 7×24 hour response – another core hub following its Singapore international headquarters. Public data shows that in the fintech sector, OceanBase has served over 100 enterprises, covering more than 20 e-wallets and over 50 payment platforms, with its customers collectively covering more than 1.3 billion end users. In traditional finance sectors such as banking, it has served over 400 financial institutions, including banks, insurance companies, and wealth management firms, with more than 60% deploying OceanBase in their core business systems. Customers include cross‑border institutions like HSBC and Hang Seng Bank. Among its benchmark clients, the Philippines’ top national super app GCash reduced storage space by 70% and resource costs by 40% after migration, while Malaysia’s TNG eWallet, which has over 26 million verified […]

📊 HiddenMerit Daily · Issue 9 Focus on Database Frontiers, Practical Insights for DBAs May 4, 2026 ｜ 5 Selected Global Breaking News — 01｜Southeast Asian Military Government Network Suffers Chain Attack: cPanel Zero-Day + PostgreSQL Command Injection as Key Breach Points A recent cyberattack targeting government and military infrastructure in Southeast Asia has been exposed, leveraging CVE-2026-41940 and other vulnerabilities in combination. Attackers first used a critical authentication bypass vulnerability in cPanel and WHM (CVSS 9.8, affecting all versions after v11.40) to gain administrator privileges by bypassing login authentication. Targeting a training portal of an Indonesian defense agency, attackers exploited valid credentials already in hand and a zero-day vulnerability to bypass the CAPTCHA mechanism by directly reading the expected verification code value from session cookies issued by the server. During the core data exfiltration phase, attackers injected SQL through a file-saving endpoint via the document-name field, then used PostgreSQL’s COPY … TO PROGRAM functionality to elevate privileges from the database layer directly to the operating system, executing arbitrary shell commands, capturing the output, and re-ingesting it into application records via pg_read_file() – achieving silent data infiltration. Approximately 110 files (about 4.37 GB) were stolen, including sensitive materials such as […]

HiddenMerit Daily · Issue 8 May 3, 2026 Introduction: This issue focuses on the latest developments in the database sector, with emphasis on SQL Server, MySQL, PostgreSQL, Oracle, and domestic Chinese databases in areas such as security, AI integration, compatibility, and localized innovation (信创). Over the past two days (May 1–2, 2026), the industry has centered on security patch rollouts, PostgreSQL maintenance updates, and discussions around domestic database advancements—reflecting the ongoing evolution of data infrastructure under the AI-driven wave and a strong emphasis on security. Below are 10 selected key updates, each commented on from DBA (operational execution), CTO (strategic decision-making), and Investor (market potential) perspectives. 1. Microsoft SQL Server 2025 April 2026 Security Updates (CU3/GDR) Continue to Roll Out Recent SQL Server 2025 security patches addressing RCE and privilege escalation vulnerabilities are being rapidly deployed in enterprise environments.  DBA Perspective: Immediately validate CU/GDR in staging environments and use rolling upgrades to minimize business impact. Update monitoring alerts post-deployment. CTO Perspective: Strengthen security baselines in the Microsoft stack and accelerate migration of core systems to cloud-managed services while evaluating tighter integration with AI toolchains. Investor Perspective: Microsoft’s moat in enterprise AI + data security is further solidified, supporting long-term […]