📊 HiddenMerit Daily · Issue 27 Focus on Database Frontiers, Practical Insights for DBAs May 22, 2026 ｜ 5 Selected Global Breaking News 01｜ChromaDB Exposed to Highest Severity Vulnerability: 10 Million Downloads AI Vector Database Hides “Remote Hijacking” Risk for RAG Applications ChromaDB, an open‑source vector database widely used by application developers, has recently been disclosed to have a highest‑severity security vulnerability, numbered CVE-2026-45829. The vulnerability allows an unauthenticated attacker to execute arbitrary code on servers exposed to the internet, posing a risk of full system compromise. The vulnerability was discovered by security company HiddenLayer. The core issue lies in a logical flaw in an API endpoint marked as requiring authentication in the Python FastAPI version of the server – the system allows embedding model parameters to be set before performing authentication checks. Attackers can craft specific requests to force ChromaDB to load malicious models from the Hugging Face platform and execute them locally on the server, without authentication intercepting the request. By the time the authentication step is triggered, the malicious model has already been loaded and executed. ChromaDB’s PyPI package has nearly 14 million monthly downloads, indicating its high popularity among the global developer community. CVE-2026-45829 was introduced […]

📊 HiddenMerit Daily · Issue 11 Focus on Database Frontiers, Practical Insights for DBAs May 6, 2026 ｜ 5 Selected Global Breaking News 01｜Twenty-Year-Old Vulnerabilities Exposed: AI Security Tool Finds Core Memory Safety Flaws in PostgreSQL and MariaDB At Wiz’s ZeroDay.Cloud security conference, security researchers using the AI‑powered security analysis tool Xint Code disclosed a set of serious vulnerabilities that have lain dormant in the PostgreSQL core extension pgcrypto for two decades, as well as a heap buffer overflow vulnerability (CVE-2026-32710) in MariaDB’s JSON_SCHEMA_VALID() function. The PostgreSQL vulnerabilities are tracked as CVE-2026-2005 (CVSS 8.8) and CVE-2026-2006 (CVSS near 9.0). CVE-2026-2005 is a heap buffer overflow issue. An attacker can craft specific input to trigger a size mismatch that leads to out‑of‑bounds writing on the heap. In environments where pgcrypto processes user‑controlled input, this can be exploited for remote code execution (RCE) on the database server. Researchers noted that the vulnerable code has existed since pgcrypto was first contributed in 2005 – over twenty years. The flaws have been fixed in versions v18.2, v17.8, v16.12, v15.16, and v14.21. However, Wiz analysis found that among cloud environments using PostgreSQL, 45% are still directly exposed to the internet. Users affected by CVE-2026-2005 must […]

📊 HiddenMerit Daily · Issue 3 Focus on Database Frontiers, Practical Insights for DBAs April 29, 2026 ｜ 5 Selected Global Hot Topics 01｜Oracle Ushers in a “New Era” for MySQL: Vector Functions Coming to Community Edition, Independent Foundation on the Table Facing developer dissatisfaction with MySQL’s stagnant development, Oracle has finally made significant adjustments, promising to usher in a “new era” for MySQL. Core Community Grievances: Code commits have dropped sharply over the past year, with even months of no new code Lack of development transparency, roadmap and decisions lack community participation New features prioritized for Enterprise Edition and HeatWave, Community Edition “left in the cold” New developers gravitate towards PostgreSQL, MySQL developer demographic is aging Oracle’s “Three-Pronged” Commitment: Feature Downward Migration: Bring vector functions and other previously Enterprise-only features to the Community Edition Ecosystem Expansion: Provide more MySQL tools, frameworks, and connectors Transparent Governance: Publish development roadmap, encourage community contributions (work logs + bug reports) Foundation Progress: Approximately 100 signatures have been collected in support of establishing an independent MySQL Foundation, with the goal of allowing the community to guide MySQL’s development direction. DBA Perspective This is major news worth the attention of all MySQL users. Over the past […]

📊 HiddenMerit Daily · Issue 2 Focus on Database Frontiers, Practical Insights for DBAs April 28, 2026 ｜ 5 Selected Global Hot Topics 01｜Dameng Releases Four New Products: Domestic Databases Make Waves Again On April 22, the 2026 China Database Technology and Industry Conference, themed “Dameng Builds Foundation, AI Opens a New Era,” was held in Beijing. Dameng Data centrally released four strategic new products: DM9 Intelligent Database, DAMENG PAI V2.0 All-in-One Machine, Dameng Qiyun Database V4.0, and GDMBASE V4.0 Graph Database, covering centralized, distributed, cloud-native, all-in-one, and graph database scenarios. Core Highlights: Product Core Capabilities Key Metrics DM9 Centralized & distributed integration, supports vector/multi-model data, database agents 450+ new features DAMENG PAI V2.0 Ultra-fast storage + compute offload + full-stack RDMA I/O latency reduced from 400μs to 80μs, 12M+ IOPS Qiyun V4.0 AI-powered intelligent O&M, multi-cluster hybrid disaster recovery Solves “low O&M efficiency, complex disaster recovery, fragmented compute power” GDMBASE V4.0 Graph-native + vector integration, AI long-term memory Sub-500ms retrieval for billion-level nodes/edges Market Data: According to CCID Consulting, China’s database market reached 43.02 billion yuan in 2025, with domestic vendors already leading foreign vendors in market share. Dameng firmly ranks first among domestic vendors. DBA Perspective This is […]

前一阵子 爸爸住院， 出院的几周，我神奇的掌握了一些厨艺， 烧了几顿饭，做了一些家常菜， 前几年一直想学烧菜，一直没有启动， 这次为了让爸爸休息，自己和老婆一起买菜、洗菜、备菜、烧菜 竟然很有天赋， 特色的烧了一个菠萝排骨，红烧鳊鱼第一次也基本成功了， 后续，多看看下厨房，给lp、女儿做一次寿司看看。   另外这一周，折腾了很多极空间NAS， 装好了wordpress，把博客从小芳那里搬到自己家， 装了一个Solara，可以免费下歌， 装了mihomo，可以在局域网使用VPN代理， 折腾的过程很开心，一步一步解决问题，一点点走向成功。   另外，最近把秋乐苑的wifi电视取消了， 把白洋苑的全屋wifi取消了， 几张手机卡升级了一下芯片。   最近白洋苑的房子打算装修了， 陆续联系了几家装修公司， 慢慢看方案，争取在下个月定好方案， 期待儿童节开始开启装修。   学习方面，开始看李尚龙的一人公司， 学习一下，进步一点，多动起来。

从小芳那里搬回了自己的NAS， 经过一天一夜一天的折腾， 顺利配置好，还原好， 数据都回来了， 一切安好。  

过年的时候，用小米电视看剧， 发现什么都要会员， 遂想起来有什么办法给电视装个浏览器， 然后通过网页的方式，实现免费看剧， 上网找了好久也没法安装第三方软件， 想装个当贝市场，小米的app store也没有 找啊找的， 找到一个叫野草助手的软件，ios Android市场都有的安装 在app store安装了一个， 然后，又在公众号找了一个叫好好看的apk文件 打开野草助手， 界面是这样的                                                                     可以通过别人分享的口令直接装软件，不需要自己找apk， 对于需要手动安装apk的 里面有一个教程                                                                     这是盒子打开开发者模式，并开启ADB功能 打开后，就能安装自己下载的软件了 安装软件，点选本地安装                                                                         选择本地下载好的apk 就可以安装到电视了， 过年的时候，安装的是 好好看 apk 安装好后，可以搜到很多电视 电影 看了 年少有为， 百年孤独，呼啸山庄，灌篮高手等等 后来又搜索了一些关于野草口令的公众号， 有些人专门免费分享口令， 又装了一个K歌的app，可以听原声，实现了听歌K歌自由， 网上免费的东西东西真多，大家要善于发现，善于使用。    

今天凌晨的时候醒来， 又拿起收集看《天香》 吭哧吭哧，就这么熬夜看完了， 看完了想着要不要公众号发个读后感， 想用AI代劳， 看了几个版本，感觉太正式， 然后跑去豆瓣看评论， 有喜欢的，有批评的， 各式各样，带着感情。 我也点上看完，4颗星，评论到“平易近人” 评完自己也觉得怪怪的， 自己看这本书的时候，一点也不累， 书本慢慢地叙述家族的变迁，绣艺的传承， 不紧不慢，也不是大起大落， 结尾的时候，浅浅列了几个主要人物的卒年， 就结束了。 平淡的感觉，像我在Simplenote里记的日记。 摘一句评论里的话“书里给我最大的感受是光阴悠然就流走了”。 看完豆瓣评论，我又去翻了微博，翻了知乎， 内容不多，有一个消息是《天香》要拍成连续剧， 也许等上映了，我也可以再看看。

国庆的最后两天和大宝在图书馆度过， 在图书馆随机找了些书看， 后来通过deepseek推荐， 下了电子书 《天香》， 还挺对胃口， 就开始看了， 这两天看了一些，到今天大概要看掉三分之二了。 今天早上的时候，在微信里搜了搜方法， 把视频号的入口给拿掉了， 也许是不让自己刷短视频， 昨天晚上听龙哥的有KFC两桶的优惠卷，抖音的，50+两桶，还免外送费， 今天上午点了，和办公室的同事分享， 午餐的时候也加餐了一下。 今天上午，和肖老板研究如何在HA下获取客户端真实IP， 曲曲折折 还是没有弄出来，不过倒是佩服肖老板的耐心，屡败屡战，不停研究。 明天中午，大A请吃饭，庆祝升了协理， 恭喜恭喜~

今天是生日， 早起，发了个早安朋友圈， 研究了一下创建定位 创建了🐜❤️🐘的定位 今天也挺平淡的 就龙哥跟我说说生日快乐 lp给我发了个大红包 别的就银行、游戏、旺仔俱乐部给我了祝贺 中午加了个菜 恢复了健步走 还在看lp发给我的小说《咸鱼飞升》 大宝去学农了， 一切平淡和安详 我在心里许一个愿望 生日快乐🎂