<p><strong>TLDR:</strong> DuckDB announced Quack, a native HTTP-based protocol enabling concurrent multi-user analytics on a shared database, claiming 3.5x faster data transfer than Arrow Flight. LinkedIn engineers used off-CPU eBPF profiling to diagnose recurring 10-15 second database outages in their user feed. A PostgreSQL patch more than doubles sorting speed for inet and cidr types by adding SortSupport abbreviated keys. A CVE in MongoDB’s time-series code (CVSS 8.8) affects any authenticated user with readWrite access, regardless of whether time-series collections exist.</p>
<hr>
<h2>DuckDB Quack: native HTTP protocol for multi-user shared database access</h2>
<p>DuckDB shipped Quack, an HTTP-based remote protocol that lets multiple DuckDB instances connect to and share the same database concurrently — something previously impossible with DuckDB’s embedded-only model. The team claims roughly 3.5x faster large dataset transfer than Arrow Flight and significantly faster than PostgreSQL wire protocol, achieved by using DuckDB’s native data format end-to-end. They deliberately skipped Arrow Flight SQL to retain full control over protocol evolution. Quack ships as an autoloadable core extension in DuckDB v1.5.3, with DuckLake integration, replication, and a production-ready release targeting DuckDB 2.0 later in 2026. <a href="https://app.daily.dev/posts/kcLxReZZV" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>LinkedIn traced recurring 10-15 second feed database outages using off-CPU eBPF profiling</h2>
<p>LinkedIn’s user feed database was experiencing ephemeral 10-15 second outages with no obvious external trigger and no clear pattern. The team reached for off-CPU profiling with eBPF — a technique that captures what a process is waiting on rather than what it’s actively executing — to find the root cause. This is a meaningful case study for anyone debugging intermittent database latency that doesn’t show up in CPU profiles or query logs. <a href="https://app.daily.dev/posts/72Gpul57S" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>PostgreSQL inet/cidr sorting more than doubled with SortSupport abbreviated keys</h2>
<p>A PostgreSQL patch adds SortSupport abbreviated keys for the inet and cidr network types, more than doubling their sorting speed. The implementation packs all four sort criteria (family, netmask bits, subnet bits, address) into a pointer-sized datum on 64-bit machines with IPv4, enabling nearly full sort resolution without heap lookups. The patch benefits any Postgres installation sorting or indexing on network types — relevant for anyone doing IP-based analytics, access log processing, or network inventory queries. <a href="https://app.daily.dev/posts/rkPON0I8J" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>CVE-2026-8053: MongoDB time-series RCE reachable by any readWrite user</h2>
<p>A critical heap buffer overflow (CVSS 8.8) in MongoDB’s time-series collection code can be triggered by any authenticated user with the standard readWrite role — no time-series collections need to exist on the target database. Exploitation can lead to arbitrary code execution as the mongod process. Patches are available for Percona Server for MongoDB 7.0 now and 8.0 shortly; 6.0 source is available but no binaries. Teams running PSMDB on Kubernetes should update the image tag immediately rather than waiting for the next operator release. <a href="https://app.daily.dev/posts/tFsYDHQHK" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>pgvector CVE below 0.8.2: buffer overflow in parallel HNSW index builds:</strong> A CVE in pgvector affects versions below 0.8.2, specifically in parallel HNSW index builds — upgrade immediately if you’re running parallel index construction on any pgvector installation. <a href="https://app.daily.dev/feed-by-ids?id=tFsYDHQHK&amp;id=hchK3IkNh" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PostgreSQL 18 releases with async I/O, skip scan, and UUID v7 as headline features:</strong> PostgreSQL 18 shipped with asynchronous I/O (20-33% typical gains, up to 3x in some workloads), B-tree skip scan for multi-column indexes, native UUID v7 for time-ordered primary keys, and checksums enabled by default — the most operationally significant Postgres release in several years. <a href="https://app.daily.dev/posts/SrxwnVX7D" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Stripe migrated 100M MongoDB subscription records with zero downtime using dual-write and shadow reads:</strong> Stripe’s four-phase approach — dual write, snapshot backfill via distributed map-reduce, shadow-mode read comparison, then write path flip — migrated 100 million records between MongoDB schemas while maintaining rollback capability throughout and catching inconsistencies before cutover. <a href="https://app.daily.dev/posts/0pA4M3yG4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub sharded a 950K QPS MySQL monolith using virtual schema domains before physical migration:</strong> GitHub’s two-tier strategy — virtual partitioning with schema domains and query linters first, then physical migration to separate clusters via ProxySQL with sub-100ms cutover — is a replicable pattern for breaking apart large relational monoliths without downtime. <a href="https://app.daily.dev/posts/S6jTte7UY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Product Quantization can compress a 61 GB pgvector index to ~480 MB with recall as the primary tradeoff:</strong> A detailed walkthrough of PQ math, Python implementation, and integration with Milvus, Weaviate, and Qdrant shows 64x compression ratios are achievable for RAG pipelines, enabling billion-scale search on commodity hardware when recall loss is acceptable. <a href="https://app.daily.dev/posts/ujzShTfX2" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Query optimization, schema design, and data store coverage across PostgreSQL, MongoDB, Redis, and more.

Databases Digest

A roundup of notable database and infrastructure developments: DuckDB ships Quack, a native HTTP protocol enabling concurrent multi-user access with claimed 3.5x faster transfers than Arrow Flight, targeting DuckDB 2.0. LinkedIn engineers used off-CPU eBPF profiling to diagnose intermittent 10-15 second feed database outages. A PostgreSQL patch more than doubles sorting speed for inet/cidr types via SortSupport abbreviated keys. A CVSS 8.8 heap buffer overflow in MongoDB's time-series code (CVE-2026-8053) is exploitable by any readWrite user. Also covered: pgvector buffer overflow CVE, PostgreSQL 18 release highlights, Stripe's zero-downtime MongoDB migration of 100M records, GitHub's MySQL sharding strategy, and Product Quantization for pgvector compression.

DuckDB Quack ships multi-user HTTP protocol, LinkedIn traces feed outages to eBPF