📊 HiddenMerit Daily · Issue 19 May 14, 2026 ｜ 5 Selected Global Breaking News 01｜Vastbase Plans Private Placement of Over RMB 700M, Doubles Down on HTAP and Multi‑Modal Time‑Series Database On the evening of May 11, Vastbase (603138.SH) disclosed its 2026 private placement plan, intending to issue A-shares to no more than 35 specified investors, raising up to RMB 702 million. After deducting issuance expenses, the net proceeds will be fully invested in two core technology R&D projects: RMB 489 million for a next‑generation high‑performance hybrid transaction/analytical database (HTAP) project, and RMB 213 million for a multi‑modal time‑series database project. The company stated that the traditional OLTP+OLAP separated architecture can no longer meet the rigid requirements of real‑time data processing, integration, and high concurrency in core scenarios such as finance, retail, telecommunications, and manufacturing. Its shortcomings – high O&M costs, data synchronization latency, and difficulty ensuring consistency – have become key bottlenecks in digital transformation. The HTAP architecture, with its two core advantages of row‑column hybrid storage and unified transaction/analytics processing, can deliver both high‑concurrency transaction performance and batch analytical efficiency. The multi‑modal time‑series database project focuses on core needs in industrial IoT and energy dispatch, aiming to solve […]

📊 HiddenMerit Daily · Issue 18 Focus on Database Frontiers, Practical Insights for DBAs May 13, 2026 ｜ 5 Selected Global Breaking News 01｜Dameng Releases Four Strategic New Products, Domestic Database Moves Toward Intelligent Full‑Stack Era Recently, Dameng Data released four strategic flagship new products: the next‑generation Dameng Database Management System DM9, the new DAMENG PAI V2.0 all‑in‑one machine, Qiyun Database V4.0, and the graph database GDMBASE V4.0. The four products cover core scenarios including centralised, distributed, cloud‑native, all‑in‑one, and graph databases. DM9 features a centralised‑distributed integrated architecture, enabling enterprises to migrate smoothly without system refactoring, adding over 450 new features and fully integrating database design agents and operations agents, making AI and databases mutually endogenous. GDMBASE V4.0 supports efficient traversal of trillion‑edge graphs, and its multi‑modal fused query capability helps developers build AI‑native applications with lower complexity. · DBA Perspective: DM9’s intelligent O&M agent capabilities will automate routine inspections, fault diagnosis, and other basic operational tasks at scale. The DBA role will evolve from “manual inspection” to “agent policy manager” – setting automatic response rules, auditing AI decision‑making, customising high‑availability SLAs, and defining capacity management baselines. This is a career watershed – evolve or fall behind. · CTO Perspective: […]

📊 HiddenMerit Daily · Issue 17 Focus on Database Frontiers, Practical Insights for DBAs May 12, 2026 ｜ 5 Selected Global Breaking News 01｜CISA Formally Adds LiteLLM Vulnerability to Catalog, Warns of Active Exploitation On May 8, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) formally added a critical pre‑authentication SQL injection vulnerability (CVE-2026-42208) in the BerriAI open‑source AI gateway LiteLLM to its Known Exploited Vulnerabilities Catalog, signalling that the severity has reached a level requiring immediate remediation by federal agencies. The vulnerability stems from the LiteLLM proxy’s API key validation logic failing to parameterise user input, allowing attackers to bypass signature flows and read all cloud vendor and AI model API credentials stored in the database. The vulnerability was patched in version 1.83.7 on April 19. The Sysdig threat research team reported active in‑the‑wild exploitation approximately 36 hours after public disclosure. Snyk and other security organisations noted that the core issue is that the database query construction mixes caller‑provided key values directly into the query text instead of passing them as separate parameters – a classic SQL injection mistake, now replicated at scale in AI infrastructure. As a single point of entry connecting multiple LLM providers (OpenAI, Azure OpenAI, […]

📊 HiddenMerit Daily · Issue 16 Focus on Database Frontiers, Practical Insights for DBAs May 9–11, 2026 ｜ 5 Selected Global Breaking News 01｜OceanBase CEO Yang Bing: Real‑Time Online Processing of Unstructured Data Is the Biggest Database Need in the AI Era On the afternoon of May 9, at the 2026 China Economic Annual Observation and Xinhua Finance Global Ecosystem Partners Conference, Yang Bing, Vice President of Ant Group and CEO of OceanBase, stated that whether unstructured data can truly be processed online in real time is the biggest need in the AI era. How to build an open, real‑time, multi‑modal, and hybrid data lake is the core problem that the technology foundation of the AI era must solve. Yang Bing believes that the software industry is undergoing a fundamental transformation from “serving people” to “serving agents”. Databases in the AI era must simultaneously handle two major demands: core business critical workloads and AI innovation workloads – intelligently searching and retrieving multi‑modal data at the retrieval level, breaking through the integration of structured, unstructured, and semi‑structured data storage, and providing enterprises with unified data services. Quoting the ancient saying “long divided, must unite”, he interpreted that the data foundation has […]

📊 HiddenMerit Daily · Issue 15 Focus on Database Frontiers, Practical Insights for DBAs May 10, 2026 ｜ 5 Selected Global Breaking News 01｜Community Controversy Continues: MySQL 9.7 LTS “True Vector” Capabilities Shrunk, Some Are Voting with Their Feet Although MySQL 9.7 LTS moved several previously enterprise‑only features (vector functions, Hypergraph Optimizer, JSON Duality Views) to the Community Edition at the end of April, the open‑source “sweet spot” has fallen far short of community expectations. The reality: in Chapter 14.21 of the 9.7 Reference Manual, the entire vector section is missing core support such as vector indexes and nearest‑neighbour search. Vector columns cannot be used as primary keys, foreign keys, or unique keys, nor do they support any aggregate functions. The only function usable for vector retrieval, DISTANCE(), is marked as an enterprise‑only paid feature in the manual. This means Community Edition users have the VECTOR_TYPE concept but cannot efficiently perform vector search. Some developers even accuse Oracle of lacking strategic sincerity in opening up the community with 9.7, and community activity and user satisfaction have fallen to a 24‑month low. The strained relationship between the MySQL community and Oracle may accelerate developer migration to forks like PostgreSQL and MariaDB. […]

📊 HiddenMerit Daily · Issue 14 Focus on Database Frontiers, Practical Insights for DBAs May 9, 2026 ｜ 5 Selected Global Breaking News 01｜AI Infrastructure Security Alert: Severe Pre‑Auth SQL Injection in LiteLLM Sparks Storm On May 6, the Bishop Fox security research team publicly released a technical reproduction report for CVE-2026-42208. This vulnerability exists in the popular open‑source AI gateway LiteLLM proxy developed by BerriAI, affecting versions 1.81.16 through 1.83.6. An attacker can send specially crafted requests to public endpoints (e.g., LLM API routes like /v1/chat/completions) without any authentication. Because the server returns the same 401 HTTP response for every probe, the attacker uses PostgreSQL’s pg_sleep() function for time‑based blind injection to evade detection. More seriously, the default Docker Compose deployment grants the application user superuser privileges on the database, enabling the attacker not only to steal sensitive metadata but also to perform full read/write operations on all tables managed by LiteLLM – including the LiteLLM_VerificationToken table which stores all virtual keys. Active in‑the‑wild exploitation was observed approximately 36 hours after the GitHub advisory. Upgrade to version 1.83.7 or later immediately. Separately, the PraisonAI multi‑agent system just patched another series of critical SQL injection vulnerabilities (CVE-2026-41496, CVSS 8.1) affecting […]

📊 HiddenMerit Daily · Issue 13 Focus on Database Frontiers, Practical Insights for DBAs May 8, 2026 ｜ 5 Selected Global Breaking News 01｜CETC Kingware Replaces Oracle+PG Hybrid Architecture in Real‑World Tests: TPS Up 35%, Breaking the “One Database Replaces Two” Barrier In a recent migration validation for a large telecom group’s core network management system, CETC Kingware (formerly Renda Kingware) achieved a 35% increase in core transaction throughput (TPS) after replacing the existing Oracle and PostgreSQL hybrid architecture. The system covers 12 professional domains (transmission, wireless, etc.), involved full migration of 8 TB of historical data, and smoothly switched 11 Oracle instances and 2 PostgreSQL instances, with 100% data accuracy. Under dual high loads – maintaining strong transaction consistency while delivering excellent GIS spatial data processing capability – peak CPU usage dropped from 88% to 72%. Average response latency decreased by 27%, and GIS spatial query time was reduced by 20.8%. Kingware’s kernel‑level dynamic syntax adaptation technology simultaneously supports multiple syntax modes (Oracle, PostgreSQL, MySQL, etc.) in a single database, compressing complex heterogeneous “multi‑database collaboration” architectures into a single domestic platform. · DBA Perspective: This validation of “one database replacing two heterogeneous databases” directly establishes Kingware’s unique cost and […]

📊 HiddenMerit Daily · Issue 12 Focus on Database Frontiers, Practical Insights for DBAs May 7, 2026 ｜ 5 Selected Global Breaking News 01｜AI Security Microscope Strikes Again: 20‑Year‑Old RCE Flaw Exposed, 80% of Cloud PostgreSQL Directly Exposed On May 4, Wiz’s AI‑powered security analysis tool Xint Code, during the ZeroDay.Cloud security event, uncovered a heap buffer overflow vulnerability (CVE-2026-2005) that had lain dormant in the PostgreSQL pgcrypto extension for two decades, as well as a still‑widespread JSON schema validation flaw in MariaDB (CVE-2026-32710). These vulnerabilities have existed since pgcrypto was first contributed in 2005. Affected PostgreSQL instances must be upgraded immediately to patched versions such as v18.2, v17.8, etc. Further analysis by Wiz found that among cloud environments running PostgreSQL, 80% are deployed, and of those, 45% are directly exposed to the internet. · DBA Perspective · Immediate inventory of two high‑risk indicators: First, check production environments for pgcrypto extension loading and identify PostgreSQL instances directly exposed to the internet. Second, urgently review user creation permissions and establish a strict approval process for extension creation. · Beware of cloud network exposure risks: 45% of cloud PG instances exposed to the internet is a devastating risk. You must scan forward‑facing […]

📊 HiddenMerit Daily · Issue 11 Focus on Database Frontiers, Practical Insights for DBAs May 6, 2026 ｜ 5 Selected Global Breaking News 01｜Twenty-Year-Old Vulnerabilities Exposed: AI Security Tool Finds Core Memory Safety Flaws in PostgreSQL and MariaDB At Wiz’s ZeroDay.Cloud security conference, security researchers using the AI‑powered security analysis tool Xint Code disclosed a set of serious vulnerabilities that have lain dormant in the PostgreSQL core extension pgcrypto for two decades, as well as a heap buffer overflow vulnerability (CVE-2026-32710) in MariaDB’s JSON_SCHEMA_VALID() function. The PostgreSQL vulnerabilities are tracked as CVE-2026-2005 (CVSS 8.8) and CVE-2026-2006 (CVSS near 9.0). CVE-2026-2005 is a heap buffer overflow issue. An attacker can craft specific input to trigger a size mismatch that leads to out‑of‑bounds writing on the heap. In environments where pgcrypto processes user‑controlled input, this can be exploited for remote code execution (RCE) on the database server. Researchers noted that the vulnerable code has existed since pgcrypto was first contributed in 2005 – over twenty years. The flaws have been fixed in versions v18.2, v17.8, v16.12, v15.16, and v14.21. However, Wiz analysis found that among cloud environments using PostgreSQL, 45% are still directly exposed to the internet. Users affected by CVE-2026-2005 must […]

📊 HiddenMerit Daily · Issue 10 Focus on Database Frontiers, Practical Insights for DBAs May 5, 2026 ｜ 5 Selected Global Breaking News 01｜OceanBase Fully Discloses Global Business for First Time: Covering Over 1.3 Billion Users, Overseas Revenue Up 200% On May 3, at the Infinity2026 conference held in Kuala Lumpur, Malaysia, OceanBase for the first time fully disclosed its global business progress, and simultaneously announced the launch of its Global Support Center in Kuala Lumpur, promising 7×24 hour response – another core hub following its Singapore international headquarters. Public data shows that in the fintech sector, OceanBase has served over 100 enterprises, covering more than 20 e-wallets and over 50 payment platforms, with its customers collectively covering more than 1.3 billion end users. In traditional finance sectors such as banking, it has served over 400 financial institutions, including banks, insurance companies, and wealth management firms, with more than 60% deploying OceanBase in their core business systems. Customers include cross‑border institutions like HSBC and Hang Seng Bank. Among its benchmark clients, the Philippines’ top national super app GCash reduced storage space by 70% and resource costs by 40% after migration, while Malaysia’s TNG eWallet, which has over 26 million verified […]