# 📊 HiddenMerit Daily · Issue 52
> Focus on Database Frontiers, Practical Insights for DBAs
> July 1, 2026 ｜ 5 Selected Global Breaking News
## 01｜OceanBase Releases “Lakehouse‑Integrated” AI Database: One Engine Replaces Transaction DB + Data Warehouse + Vector DB + Data Lake
On June 29, OceanBase officially released its Lakehouse‑Integrated AI Database for the AI era, proposing “Lakehouse Integration” as the core architecture – unifying the openness and massive storage capabilities of data lakes, the transaction processing and analytical capabilities of databases, and multi‑modal data processing capabilities into a single strongly‑consistent data foundation, enabling agents to obtain complete business context in one go, so that AI can truly “understand” the enterprise.
Core Judgement: OceanBase CEO Yang Bing believes that the bottleneck for AI implementation is shifting from “whether the model can think” to “whether it understands the business.” Over the past three years, large model capabilities have rapidly advanced, and compute power has continued to break through, but enterprise AI implementation has not yet delivered the expected value release. Model capabilities are converging rapidly, and business differentiation is shifting toward the data layer. Data consumers are shifting from “humans” to “agents,” and the form of data is shifting from structured to multi‑modal. Together, these changes mean databases must be rebuilt from the architectural layer rather than patched.
Product System Trio: OceanBase AI Database simultaneously forms a product system covering the data engine, data governance, and business entry point.
| Product | Positioning | Core Capability |
|---------|-------------|-----------------|
| Lakebase | Underlying engine | Enables structured, unstructured, and vector data to be managed, processed, retrieved, and invoked within a unified architecture |
| DataStudio | Data governance layer | Covers data access, processing, orchestration, semantic modelling, and agent collaboration, transforming scattered data assets into invocable data services |
| DataPilot | Business intelligence entry point | Business users complete analytical reports and data dashboards through natural language, turning professional analytical processes into interactive, reusable intelligent decision‑making capabilities |
Five Key Technical Features:
1. Lakehouse Integration: Structured, semi‑structured, and unstructured data are all governed under a single metadata, permission, and transaction system.
2. Multi‑Modal Tables and AI Columns: Vectors, text, images, audio, and video are uniformly managed under the semantics of a single table. AI columns can automatically generate semantic results such as summaries, tags, and vectors.
3. Agent‑Friendly: Natively supports storage and retrieval of agent memory, context, state, and action records, providing precise context through hybrid search.
4. Open Ecosystem: Supports S3‑compatible object storage and the Iceberg open table format, capable of interfacing with compute engines such as Spark and Ray.
5. Integrated Design: A single system handles transaction processing, real‑time analytics, and AI workloads, with TCO reduced by 30%‑50%.
Validation: Already validated in AI scenarios such as Ant Afu and Lingguang. Among them, Lingguang has generated tens of millions of “flash applications,” validating the feasibility of the lakehouse‑integrated architecture in scenarios with tens of millions of agents. OceanBase CTO Yang Chuanhui stated: “True integration must occur at the architectural layer. Lakehouse integration is not a simple splicing of database and data lake, but the unified management of multi‑modal data within a single engine, bridging online and offline processing.”
- DBA Perspective: OceanBase’s “lakehouse‑integrated” approach directly addresses the biggest headache for DBAs in the AI era – the operational complexity and data consistency issues caused by data scattered across multiple systems (transaction DB + data warehouse + vector DB + data lake). In the past, DBAs had to maintain ETL pipelines across multiple systems, ensure data consistency, and manage monitoring and alerting for different engines. Now, Lakebase handles everything within a single engine. The 30%‑50% TCO reduction provides a quantitative basis for DBAs’ cost arguments in technology selection. The design of multi‑modal tables and AI columns also means DBAs need to learn new skills in multi‑modal data modelling and vector index maintenance.
- CTO Perspective: OceanBase’s judgement is highly aligned with current industry consensus. The Lakebase + DataStudio + DataPilot trio covers the entire chain from data engine to data governance to business entry point, providing CTOs with an “All‑in‑One” option for AI data architecture planning. It has already been validated in real scenarios such as Ant Afu, handling tens of millions of agents, reducing selection risk. Yang Bing stated: “We have the opportunity to move from ‘followers’ to ‘co‑definers,’ participating in the formation of the AI database paradigm. This is both China’s opportunity and OceanBase’s opportunity.”
- Investor Perspective: OceanBase’s strategic upgrade path from “distributed database replacement” to “AI data infrastructure” is clear. Combined with OceanBase’s three consecutive years as #1 in the financial distributed market, the AI database is expected to become a core variable in its valuation restructuring.
## 02｜DB-Engines June 2026 Ranking: PostgreSQL Closes in on SQL Server, Traditional Big Three Lose Momentum
The June 2026 DB-Engines global database ranking shows that the database landscape is undergoing the most dramatic structural changes in nearly 20 years.
Key Data:
| Database | June 2026 Score | Monthly Change | Annual Change | Gap to Previous |
|----------|----------------|----------------|----------------|-----------------|
| Oracle | 1140.04 | -3.24 | -90.35 | — |
| MySQL | 856.29 | -0.21 | -97.29 | 283.75 |
| SQL Server | 698.04 | -2.95 | -78.71 | 158.25 |
| PostgreSQL | 688.23 | +5.55 | +7.58 | 9.81 |
Key Observations:
- The three traditional commercial/semi‑commercial databases – Oracle, MySQL, and SQL Server – continued their downward trend, with a combined annual loss of over 260 points.
- PostgreSQL is the only database in the top tier to achieve both monthly and annual growth. Its gap to SQL Server has narrowed dramatically from 86.29 points a year ago to just 9.81 points . It is expected to surpass SQL Server in Q4 2026 to become the world’s third most popular database.
- pgvector downloads have surpassed 100 million . Over 80% of RAG applications choose PostgreSQL as their vector database.
PostgreSQL’s growth is driven by three factors: community‑driven innovation, perfect fit with cloud‑native environments, and the explosive growth of pgvector in the AI era.
- DBA Perspective: PostgreSQL is now only 9.81 points behind SQL Server, meaning the historic inflection point of “open‑source databases surpassing commercial databases” is approaching. For DBAs, this is not just a technology trend, but a clear career signal – PostgreSQL skills are moving from “nice‑to‑have” to “must‑have.” pgvector downloads surpassing 100 million shows that vector retrieval capability has become a standard feature of databases. DBAs need to urgently close the skill gap in vector index maintenance and RAG scenario optimisation.
- CTO Perspective: The combined annual loss of over 260 points by the traditional big three shows that the pendulum of enterprise database selection is irreversibly swinging toward open source. PostgreSQL has already achieved large‑scale replacement in finance, healthcare, e‑commerce, and other sectors (China Merchants Bank, ByteDance, Netflix, etc. have all migrated). When planning technology roadmaps, CTOs should default to PostgreSQL as the evaluation benchmark, not just as a backup option.
## 03｜Weekly Security Vulnerabilities Focus: Redis Lua Script RCE, Splunk Pre‑Auth RCE Chain, Aix‑DB Unauthorised SQL Queries
Multiple high‑risk database‑related security vulnerabilities were disclosed this week, demanding urgent attention from DBAs:
Redis Lua Script Remote Code Execution (CVE-2026-23631) : CVSS 8.1, affecting multiple Redis versions 7.2.x through 8.6.x. An authenticated attacker can exploit the master‑slave data synchronisation mechanism to trigger a memory management flaw on a replica server with read‑only mode disabled. By constructing specific Lua script operations, they can cause memory reference errors, ultimately achieving remote code execution and full system control. PoC and EXP have been made public. The affected version range is extensive; immediate upgrade to versions 7.2.14, 7.4.9, 8.2.6, 8.4.3, or 8.6.3 or higher is recommended. Special Note: Ensure all replica nodes are configured with replica-read-only yes, and strictly restrict any user’s permission to modify this configuration.
Splunk Enterprise Pre‑Auth RCE Vulnerability Chain (CVE-2026-20253) : CVSS 9.8, affecting Splunk Enterprise version 10 and later. The vulnerability stems from the newly introduced PostgreSQL Sidecar Service component in newer Splunk versions, which is enabled by default in AWS cloud deployments. Attackers can send specially crafted HTTP requests through Splunk’s main web interface to access internal API endpoints, exploiting directory traversal and PostgreSQL connection string injection to achieve arbitrary file writing and ultimately execute arbitrary commands on the target system. Splunk Enterprise users on AWS should prioritise patching.
Aix‑DB Unauthorised SQL Queries (CVE-2026-8335) : Affects Aix‑DB 1.2.4 and earlier. The “/llm/process_llm_out” endpoint lacks authentication checks, allowing unauthenticated clients to execute arbitrary SELECT SQL queries and retrieve database data, as this endpoint does not enforce the token validation mechanism adopted by all other application endpoints.
Oracle MySQL NDB Cluster Privilege Vulnerability (CVE-2026-46861) : Affects versions 8.0.11 through 9.7.0. A low‑privilege attacker can gain network access to create, delete, modify, or read critical data.
- DBA Perspective: The PoC/EXP for the Redis vulnerability has been made public. It is recommended to urgently check Redis versions and upgrade. Special attention should be paid to the replica-read-only configuration on replica servers – one of the core conditions for exploiting this vulnerability is that this configuration is set to no. The particularity of the Splunk vulnerability is that the attack surface is the “database middleware layer,” not the database kernel itself – an authentication flaw in the PostgreSQL Sidecar Service is used as a springboard to achieve RCE. This pattern reminds DBAs that auxiliary services around databases (Sidecars, proxies, migration tools) are becoming new attack entry points. The Aix‑DB unauthorised SQL query vulnerability shows that the security maturity of emerging database components for AI/LLM applications remains concerning. CVE-2026-46861 covers MySQL NDB Cluster 9.7.0 and below, meaning 9.7 LTS users also need to pay attention.
- CTO Perspective: Two high‑risk vulnerabilities in Redis and Splunk were disclosed on the same day, both with publicly available PoC/EXP. Security teams should treat them as emergency response items. The Splunk vulnerability is enabled by default in AWS cloud environments, significantly impacting enterprises using Splunk in cloud deployments. It is recommended to establish a security scanning mechanism for “database peripheral components,” including Sidecars, proxies, and other auxiliary services in vulnerability management scope.
## 04｜Tencent Cloud PostgreSQL Kernel Update: Supports Cloning, AI Model Extensions Continue to Evolve
Tencent Cloud Database for PostgreSQL recently released kernel version updates. Key updates include:
- Cloning Feature: Based on Copy‑on‑Write technology, database cloning is reduced from minutes to milliseconds, with storage overhead approaching zero. Suitable for development testing, AI agent sandboxes, CI/CD parallel testing, and other scenarios.
- tencentdb_ai Plugin Continued Enhancement: Added TokenHub backend support, enabling invocation of multiple models from the large model marketplace via OpenAI‑compatible protocols.
- DBA Perspective: The millisecond‑level response of the cloning feature means DBAs can quickly create a completely isolated database environment for each AI agent, fundamentally changing the workflow for development testing and agent sandboxes. The iteration speed of AI capabilities in PostgreSQL on the cloud is worth attention – from tencentdb_ai supporting NL2SQL to pgvectorscale productisation, to the millisecond‑level delivery of cloning, Tencent Cloud is building PostgreSQL into a complete “AI database” puzzle.
- CTO Perspective: Millisecond‑level cloning makes “one independent sandbox per agent” possible, significantly reducing the environment preparation cost for AI application development and testing. Cloud databases are evolving from “storage foundations” to a complete “AI development platform” puzzle.
## 05｜PostgreSQL 14 End‑of‑Life Countdown: Less Than 5 Months Remaining, AWS RDS Extended Support Provides a Buffer
PostgreSQL 14 will officially stop receiving patch updates on November 12, 2026. Less than 5 months remain until EOL. PG 14 has already released its final version, 14.23 (on May 14), with no further security patches or bug fixes.
AWS Provides Buffer Option: AWS has announced extended support for RDS for PostgreSQL, providing up to an additional three years of critical security and bug fixes after the standard support period for major versions ends, giving users more time to upgrade to new major versions.
- DBA Perspective: With less than 5 months until PG 14 EOL, DBAs must immediately initiate upgrade assessments. It is recommended to use pg_upgrade --check for compatibility pre‑checks, with special attention to extension module dependencies and postgresql.conf parameter differences. PG 18 is the current recommended LTS version, with support extending to May 2031. For AWS users unable to complete upgrades within the deadline, RDS extended support can be considered as a buffer, but note that this is a paid service.
- CTO Perspective: The EOL of PG 14 and the stabilisation of PG 18 create a clear upgrade window. It is recommended to formulate a phased upgrade plan for Q3, prioritising migration of non‑core environments to validate compatibility before advancing to production core systems. AWS extended support provides an additional three‑year buffer, but it is advisable to avoid over‑reliance to prevent further accumulation of technical debt.
## 📚 SQL Little Knowledge Point
This Issue’s Knowledge Point: What is “Lakehouse Integration”?
“Lakehouse Integration” is a new database architecture paradigm proposed by OceanBase for the AI era – unifying the open storage capabilities of data lakes with the transaction processing and analytical capabilities of databases within a single engine.
Traditional Architecture vs. Lakehouse Integration:
| Dimension | Traditional Multi‑System Architecture | Lakehouse Integration |
|-----------|--------------------------------------|----------------------|
| Number of Systems | Transaction DB + Data Warehouse + Vector DB + Data Lake | Single Engine |
| Data Consistency | ETL sync across multiple systems, with latency | Native consistency |
| Operations Complexity | Independent maintenance of multiple systems | Unified management |
| AI Support | Requires additional vector retrieval components | Built‑in multi‑modal + vector retrieval |
| TCO | High | Reduced by 30%‑50% |
Five Key Technical Features of OceanBase Lakebase:
1. Lakehouse Integration: Unified metadata, permissions, transactions, and lifecycle management.
2. Multi‑Modal Tables and AI Columns: Structured data, text, images, and vectors managed under the semantics of a single table.
3. Agent‑Friendly: Unified storage of agent memory, context, and action records.
4. Open Ecosystem: Supports S3‑compatible object storage and the Iceberg open table format.
5. Integrated Design: A single system handles transactions, analytics, and AI workloads.
OceanBase CTO Yang Chuanhui stated: “True integration must occur at the architectural layer. Lakehouse integration is not a simple splicing of database and data lake, but the unified management of multi‑modal data within a single engine, bridging online and offline processing.”
Significance for DBAs: Lakehouse integration means DBAs will be freed from the heavy work of “maintaining multiple systems,” but it also requires DBAs to develop new skills in multi‑modal data modelling, vector index maintenance, and mixed‑load tuning.
> HiddenMerit Team Production
> Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.
No comments yet