# 📊 HiddenMerit Daily · Issue 60
> Focus on Database Frontiers, Practical Insights for DBAs
> July 22, 2026 ｜ 5 Selected Global Breaking News
## 01｜Oracle Releases Largest Quarterly Patch in History: 1,449 Patches Fix 1,235 CVEs, 261 Critical
On July 21, Oracle released its July 2026 Critical Patch Update (CPU), setting a record for the largest single patch release in the company’s history. This CPU contains 1,449 security patches fixing 1,235 independent CVEs across 32 Oracle product families, of which 261 patches are rated Critical.
Patch Distribution by Product Family:
| Product Family | Patches | Remotely Exploitable Without Authentication |
|----------------|---------|---------------------------------------------|
| Oracle E‑Business Suite | 410 | 45 |
| Oracle Fusion Middleware | 355 | 219 |
| Oracle Communications | 168 | 122 |
| Oracle MySQL | 54 | 9 |
| Oracle Database Server | 15 | 6 |
Context for This Patch: Oracle had already issued an urgent “Prepare Now” warning a week earlier, emphasising that AI is fundamentally lowering the barrier to discovering and exploiting vulnerabilities – frontier AI models can analyse software changes, reverse‑engineer security patches, and develop attack paths at unprecedented speed. Oracle has collaborated with state‑of‑the‑art models from Anthropic and OpenAI to proactively identify and fix potential security vulnerabilities. Oracle strongly recommends that customers immediately test and deploy this update in their monthly patch cycles.
- DBA Perspective: This CPU sets a new record for Oracle’s largest patch release ever, sending two clear signals: first, AI‑driven security threats are accelerating vulnerability discovery, and DBAs must shift from a “quarterly patch” cadence to a “monthly security baseline” response mode; second, Oracle E‑Business Suite (410 patches) and Fusion Middleware (355 patches) are the hardest hit areas – if an enterprise uses both products, the urgency of the patch window is doubled. Although Oracle Database Server has only 15 patches (6 remotely exploitable without authentication), as the core database, DBAs should still set patch priority to P0 and follow Oracle’s blog recommendations for immediate deployment planning.
## 02｜Apache Doris Critical Vulnerability CVE-2026-58319 (CVSS 9.1): Unauthenticated Attackers Can Execute Administrative Operations
Apache Doris, a real‑time analytical database, has been found to have a critical authentication bypass vulnerability (CVE-2026-58319, CVSS 9.1). Its frontend HTTP REST management API lacks authentication, allowing unauthenticated attackers with network access to execute administrative operations, threatening cluster stability and data availability.
Vulnerability Details: The vulnerability stems from improper authentication checks in the Apache Doris frontend (FE) HTTP service. Certain administrative REST endpoints do not verify the caller’s identity. Attackers with network access to the FE HTTP port can send unauthorised administrative requests, affecting cluster integrity and potentially causing denial of service or cluster instability. Affects Apache Doris versions 2.1.0 through 3.0.x. Fixed in version 3.1.0.
- DBA Perspective: The CVSS 9.1 rating means this vulnerability has an extremely low exploitation barrier. As a widely deployed real‑time analytical database and lakehouse acceleration engine, Apache Doris’s management API being accessible without authentication is like leaving the front door unlocked. DBAs using Doris should immediately check versions and upgrade to 3.1.0 or higher, or implement strict network access controls on the FE HTTP port (default 8030) before upgrading.
## 03｜Transwarp Releases GPU‑Native Cognitive Database: 66x TPC‑DS Performance Improvement, Rebuilding the Data Foundation for the AI Agent Era
On July 18, at the 2026 World Artificial Intelligence Conference (WAIC), Transwarp released a preview of its next‑generation GPU‑Native Cognitive Database for AI agents, moving the complete database functionality – SQL analytics, vector search, graph computing, full‑text search – entirely to run on the GPU.
Why a GPU‑Native Database is Needed: Transwarp founder and CEO Sun Yuanhao pointed out that the way AI is used has evolved from “question‑and‑answer” to “reasoning loops” – in a single task, an agent may repeatedly call data hundreds of times. In traditional architectures, GPUs handle inference while CPUs handle queries, with data being transferred back and forth over the PCIe bus. A significant amount of time is wasted on “data waiting.” A single CPU typically has only a few hundred compute cores and approximately 400GB/s memory bandwidth, while a GPU has tens of thousands of parallel compute units and several TB/s of high‑bandwidth video memory.
Core Performance Data:
- In TPC‑DS SF1000 benchmarks: completed 99 queries with a 100% pass rate; 70x performance improvement over mainstream open‑source databases; 66x over Snowflake and Databricks, with 14x better price‑performance.
- In TPC‑H SF1000 benchmarks: completed 22 queries with 28x performance improvement.
- On the same 100GB standard dataset, a well‑known cloud data platform took over 6 minutes, while Transwarp’s product took only 10 seconds – a 40x gap.
- In unstructured data processing: document parsing performance improvement of 10‑30x, vector index build performance improvement of up to nearly 50x.
Sun Yuanhao emphasised the key word “native”: “If you only offload a few operators to the GPU as a coprocessor, the bottleneck is still data transfer and scheduling, and the speedup is only 1.5x, which is not economical. You must completely rewrite the entire execution engine, storage management, and transaction processing so that database computation is completed directly in GPU video memory.” He predicted: “In the next three to five years, computers will shift entirely from a CPU‑centric to a GPU‑centric architecture.”
- DBA Perspective: Transwarp moving the complete database to the GPU represents a paradigm revolution at the database architecture level. For DBAs, the dimensions of tuning will expand from “CPU core count, memory allocation, disk I/O” to “GPU video memory management, parallel stream scheduling, and data residency strategies.” A 20x‑plus performance improvement is not incremental optimisation but a qualitative leap from architectural restructuring. Sun Yuanhao’s timeline – general availability by the end of 2026 – means DBAs need to accelerate their knowledge of GPU database architecture over the next six months.
## 04｜Weekly Security Vulnerabilities Focus: SurrealDB Session Hijacking (CVSS Pending), CVE-2026-63755 Privilege Bypass
Multiple security vulnerabilities in emerging databases were disclosed this week:
SurrealDB Session Hijacking (GHSA-5qfp-32cf-69jh) : SurrealDB’s HTTP /rpc session method returns all attached session UUIDs without authentication, and the /rpc handler accepts arbitrary session fields without ownership checks. Unauthenticated attackers can enumerate UUIDs and impersonate any authenticated session. Attackers can read, write, or delete any data accessible to that session and escalate to that session’s permission level (up to root). Fixed in version 3.1.0.
SurrealDB Privilege Bypass (CVE-2026-63755) : Affects SurrealDB versions 3.0.x and earlier. When processing WHERE conditions in SELECT statements, the system evaluates full record data before enforcing permission restrictions, allowing authenticated users to bypass table‑level permission checks and read the full contents of any table. Fixed in version 3.1.0.
- DBA Perspective: SurrealDB has disclosed two severe vulnerabilities in a single week – one allowing unauthenticated attackers to fully hijack authenticated sessions, and another allowing authenticated users to bypass table‑level permissions to read full table data. As a multi‑model database for AI and real‑time applications, SurrealDB’s security maturity is still in a “rapid iteration” phase. DBAs using SurrealDB should immediately upgrade to 3.1.0 or higher. The commonality of these two vulnerabilities – order‑of‑checks flaws in the permission model – reminds DBAs that when evaluating emerging database components, permission model completeness should be included in security baseline checks.
## 05｜Kingware Releases H2 2026 Technology Trends: Vector Internalisation + Storage‑Compute Separation + Intelligent Autonomy Become Core Themes
In mid‑July, CETC Kingware published a series of technical analysis articles, systematically assessing the core evolution directions of domestic databases in the second half of 2026:
Trend 1: Vector Compute Internalisation. As large model applications penetrate vertical industries, traditional relational databases can no longer meet the storage and retrieval needs of unstructured data. Over the next three years, databases with native vector retrieval capability will become standard in core areas such as finance and government. Leading domestic database vendors are progressively integrating vector processing capabilities into their core engines, achieving unified governance of relational and vector data.
Trend 2: Storage‑Compute Separation Architecture Becomes the Norm. Faced with exponential growth in business volume, the scalability bottlenecks of monolithic databases are becoming increasingly prominent. Databases supporting transactional transparent distributed clusters can achieve linear scaling, effectively solving the single‑node performance ceiling problem. Future architectures must support cross‑region, cross‑cloud native distributed deployment.
Trend 3: Intelligent Operations Evolves from “Auxiliary” to “Autonomous”. Traditional script‑based operations can no longer cope with complex architectural changes. Over the next three years, machine learning‑based intelligent operations will become mainstream, capable of automatically identifying potential faults and executing predefined policies, shifting the focus of operations from “firefighting” to “prevention.”
Trend 4: Multi‑Modal Data Unified Governance. With the proliferation of IoT devices, time‑series data volumes will experience explosive growth. Future architectures must efficiently handle relational business data, massive time‑series monitoring data, and unstructured documents within a single system, requiring databases to have multi‑modal data engine capabilities.
CETC Kingware’s KingbaseES V9 has already completed its architectural layout in multi‑modal data integration, HTAP hybrid workloads, and vector retrieval capabilities, supporting a unified foundation for core transactions and AI applications through a “steady‑state + agile‑state” dual‑mode architecture.
- DBA Perspective: Kingware’s four trend judgments are highly consistent with the CAICT report’s “AI‑native evolution” direction and OceanBase’s “lakehouse‑integrated” strategy – the domestic database industry is forming a consensus framework of “vector internalisation + cloud‑native + intelligent operations.” For DBAs, this framework defines the core directions for future skill development: vector index maintenance, multi‑modal data modelling, HTAP hybrid workload tuning, and elastic scaling management under cloud‑native architectures. Kingware’s emphasis on the “steady‑state + agile‑state” dual‑mode architecture – high‑availability clusters (RPO=0/RTO<30s) for core transactions and distributed scaling for AI applications – provides DBAs with a clear reference paradigm for architectural design in hybrid scenarios.
## 📚 SQL Little Knowledge Point
This Issue’s Knowledge Point: What is a CPU (Critical Patch Update)?
A CPU (Critical Patch Update) is a collection of security patches periodically released by Oracle to fix security vulnerabilities across its product families. Starting in 2026, Oracle transitioned from a traditional “quarterly CPU” model to a dual‑track mechanism of “quarterly CPU + monthly CSPU.”
Key Features of the July 2026 CPU:
- Largest in Oracle’s history: 1,449 patches fixing 1,235 CVEs.
- 261 critical patches (18%), 763 high‑severity patches (52.7%).
- AI‑assisted security engineering: Oracle has collaborated with state‑of‑the‑art models from Anthropic and OpenAI to proactively identify and fix vulnerabilities.
Patch Distribution by Product Family: Oracle E‑Business Suite (410 patches, 45 remotely exploitable without authentication), Oracle Fusion Middleware (355 patches, 219 remotely exploitable), Oracle Communications (168 patches, 122 remotely exploitable), Oracle MySQL (54 patches, 9 remotely exploitable), Oracle Database Server (15 patches, 6 remotely exploitable).
Oracle’s “Monthly CSPU” Mechanism: Future CSPUs will be released on the third Tuesday of each month. Enterprises need to adjust from a “quarterly patch” cadence to a “monthly security baseline” response mode.
> HiddenMerit Team Production
> Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.
No comments yet