<p><strong>TLDR:</strong> Amazon DynamoDB now supports native vector search in general availability across all commercial AWS regions, letting teams run similarity search directly against operational data without a separate vector store. A Huntress investigation documented attackers embedding a post-exploitation toolkit inside an Oracle database using CREATE JAVA SOURCE, achieving SYSTEM-level OS access through a SQL injection entry point. PostgreSQL’s COUNT(DISTINCT col) silently kills parallel query execution, and there’s a clean subquery rewrite that delivers a 3.4x speedup on large tables. Debezium 3.6.1.Final is out with fixes for BC-era date parsing in PostgreSQL and Oracle RowId corruption in change events.</p>
<hr>
<h2>DynamoDB native vector search hits general availability</h2>
<p>DynamoDB now supports a vector index type with a SearchVectors API, covering Euclidean, Cosine, and Dot product distance functions and embeddings up to 4096 dimensions. AWS claims single-digit millisecond latency at 99%+ recall with a serverless, pay-per-request model. The main appeal is consolidation: if you’re already on DynamoDB for operational data, you no longer need a separate vector store and a sync pipeline between them. A few things worth knowing before you commit: the index configuration is immutable after creation, on-demand capacity mode is required (provisioned isn’t supported), and vector search results are eventually consistent — not a fit if you need read-your-own-writes guarantees. <a href="https://daily.dev/posts/6Qzzpil4v" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Attackers embed post-exploitation toolkit inside Oracle database via SQL injection</h2>
<p>Huntress documented an attack where a SQL injection flaw in a public-facing Java/Tomcat app gave attackers a foothold, which they used to load a custom toolkit called ‘khunt’ directly into the Oracle database using CREATE JAVA SOURCE. The toolkit ran as database schema objects and included modules for OS command execution, credential extraction, and file system access — ultimately achieving SYSTEM-level privileges on the underlying Windows server and dumping SAM/SECURITY/SYSTEM registry hives. The technique is notable because malicious code stored as database objects is largely invisible to endpoint security tooling. Mitigations are the basics: parameterized queries, input sanitization, and least-privilege database accounts — but this is a good reminder that an overprivileged database account is a full OS compromise waiting to happen. <a href="https://daily.dev/feed-by-ids?id=2OUPltTjp&amp;id=nRzsMiW3v" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>COUNT(DISTINCT col) in PostgreSQL disables parallel query execution</h2>
<p>PostgreSQL’s COUNT(DISTINCT col) has no combine function, so the planner can’t merge partial results from parallel workers — it falls back to a single-core serial sort that often spills to disk. The fix is to push deduplication into a GROUP BY subquery, which the planner can parallelize via partial hash aggregates. On a 10M-row table the rewrite goes from 1211ms to 360ms and eliminates the disk spill. The same parallelism block hits any aggregate with an inner ORDER BY: string_agg, array_agg, percentile_cont. Worth auditing any query that uses these on large tables. <a href="https://daily.dev/posts/iEQWEKRgt" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>PostgreSQL HOT updates: fillfactor tuning yields 13.5-47.8% throughput gains</h2>
<p>A HammerDB TPROC-C benchmark across three dataset sizes shows that per-table fillfactor tuning can deliver 13.5–47.8% throughput gains and reduce vacuum time by up to 7x. The key diagnostic metric is n_tup_newpage_upd — updates that couldn’t stay on their original page. The important caveat: fillfactor shouldn’t be applied uniformly. Only 4 of 9 TPC-C tables benefited, and tables with high per-row update frequency are often self-healing via opportunistic pruning. If your HOT ratio is poor because you’re indexing mutable columns, no fillfactor value fixes that — it’s a schema problem. <a href="https://daily.dev/posts/DJhMoRrdL" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Debezium 3.6.1.Final: BC-era date parsing, Oracle RowId corruption, credential leak fixes:</strong> Debezium 3.6.1.Final resolves 27 issues including correct parsing of BC-era dates in PostgreSQL, consistent schema mapping for MySQL INTEGER UNSIGNED columns, Oracle RowId corruption in change events, and prevention of credential leakage in log output — worth upgrading if you’re running Oracle or PostgreSQL connectors. <a href="https://daily.dev/posts/bHEWToxSR" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AWS DMS CDC tasks can silently retry for 30 minutes before failing with default settings:</strong> With default error-handling settings, AWS DMS CDC tasks use unbounded exponential backoff and can retry recoverable errors for up to 30 minutes before surfacing a failure; tuning RecoverableErrorCount, RecoverableErrorInterval, and RecoverableErrorThrottlingMax to the recommended Scenario C configuration brings task failure down to roughly 225 seconds. <a href="https://daily.dev/posts/N4fOQo10x" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Aurora Serverless now scales to 12 ACUs within one second on platform versions 3 and 4:</strong> Amazon Aurora Serverless now reaches 12 ACUs within one second during scale-up events, enabled by default on platform versions 3 and 4 with no configuration changes required — directly relevant for bursty agentic or event-driven workloads that previously hit cold-start latency spikes. <a href="https://daily.dev/posts/VNCbsli9v" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Snowflake SQL injection via compile-time constant folding with SYSTEM$WAIT:</strong> A researcher found that Snowflake’s three-phase query processing exposes a blind injection point: applications that suppress execution errors but return compilation errors verbatim leak session metadata (current database, current user) because SYSTEM$WAIT’s constant-argument requirement forces the compiler to evaluate session functions at compile time, before any error suppression runs. <a href="https://daily.dev/posts/j7J8eNpzX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>pgx CollectRows was 1.8x slower with 10x more allocations; pgx v5.6 and pgx-collect address it:</strong> Benchmarking pgx’s CollectRows against a hand-written loop revealed 1.8x slower throughput and 10x more memory allocations due to repeated reflection lookups and per-row scan target allocation; fixes landed in pgx v5.6, and the pgx-collect library redesigns the abstraction to allow per-query setup to run once and scan targets to be reused. <a href="https://daily.dev/posts/wFMGvGSg0" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Query optimization, schema design, and data store coverage across PostgreSQL, MongoDB, Redis, and more.

Databases Digest

Amazon DynamoDB now supports native vector search in general availability across all commercial AWS regions, letting teams run similarity search directly against operational data without a separate vector store. A Huntress investigation documented attackers embedding a post-exploitation toolkit inside an Oracle database using CREATE JAVA SOURCE, achieving SYSTEM-level OS access through a SQL injection entry point. PostgreSQL's COUNT(DISTINCT col) silently kills parallel query execution, and there's a clean subquery rewrite that delivers a 3.4x speedup on large tables. Debezium 3.6.1.Final is out with fixes for BC-era date parsing in PostgreSQL and Oracle RowId corruption in change events.

DynamoDB adds native vector search, Oracle database used as malware host