--- title: Oracle drops 1,449-patch CPU, text-to-SQL accuracy... description: Oracle's July 2026 Critical Patch Update is its largest ever, covering 1,235 CVEs including a CVSS 9.9 flaw in DBMS_CLOUD that lets a low-privileged attacker... canonical: https://daily.dev/posts/oracle-drops-1-449-patch-cpu-text-to-sql-accuracy-collapses-on-real-warehouses-gbtvu63gs twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Oracle drops 1,449-patch CPU, text-to-SQL accuracy collapses on real warehouses | daily.dev og:description: Oracle's July 2026 Critical Patch Update is its largest ever, covering 1,235 CVEs including a CVSS 9.9 flaw in DBMS_CLOUD that lets a low-privileged attacker... og:url: https://daily.dev/posts/oracle-drops-1-449-patch-cpu-text-to-sql-accuracy-collapses-on-real-warehouses-gbtvu63gs og:image: https://api.daily.dev/og/posts/gbTvu63gS.png og:image:alt: Oracle drops 1,449-patch CPU, text-to-SQL accuracy collapses on real warehouses og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Oracle drops 1,449-patch CPU, text-to-SQL accuracy collapses on real warehouses **[Databases Digest](https://daily.dev/sources/databases_digest)** · 5 min read · 0 upvotes · 0 comments ## Summary Oracle's July 2026 Critical Patch Update is its largest ever, covering 1,235 CVEs including a CVSS 9.9 flaw in DBMS_CLOUD that lets a low-privileged attacker take full control of the RDBMS. A new benchmark called Beaver shows that text-to-SQL systems scoring 80-90% on public benchmarks drop to 10-30% accuracy on real enterprise data warehouses — a gap that should recalibrate expectations for anyone building NL-to-SQL tooling. MySQL 26.7 Early Access lands post-quantum cryptography support and moves the Thread Pool plugin to Community Edition. OpenAI published a detailed account of how its internal data agent actually works, and the engineering lessons are worth reading for anyone building similar systems. ## Content **TLDR:** Oracle's July 2026 Critical Patch Update is its largest ever, covering 1,235 CVEs including a CVSS 9.9 flaw in DBMS_CLOUD that lets a low-privileged attacker take full control of the RDBMS. A new benchmark called Beaver shows that text-to-SQL systems scoring 80-90% on public benchmarks drop to 10-30% accuracy on real enterprise data warehouses — a gap that should recalibrate expectations for anyone building NL-to-SQL tooling. MySQL 26.7 Early Access lands post-quantum cryptography support and moves the Thread Pool plugin to Community Edition. OpenAI published a detailed account of how its internal data agent actually works, and the engineering lessons are worth reading for anyone building similar systems. --- ## Oracle July 2026 CPU: 1,449 patches, CVSS 9.9 flaw in DBMS_CLOUD Oracle's July 2026 Critical Patch Update covers 1,235 unique CVEs across 32 product families — the largest quarterly release the company has issued. The two database-specific vulnerabilities to act on immediately: CVE-2026-61211 (CVSS 9.9) in DBMS_CLOUD lets a low-privileged authenticated attacker take full control of the RDBMS, and CVE-2026-47040 hits Oracle Net Services. Fusion Middleware has 219 remotely exploitable unauthenticated vulnerabilities, including ten scoring a perfect 10.0. If you're running Oracle Database Server in any capacity, this one isn't optional. [Read more](https://daily.dev/posts/YDkB1Rru6) ## Beaver benchmark: text-to-SQL accuracy drops from 80-90% to 10-30% on real warehouses Public benchmarks like Spider and Bird-SQL report 80-90%+ accuracy for text-to-SQL systems, but those benchmarks use clean, well-named schemas that don't reflect real data warehouses. The Beaver benchmark, built from actual MIT and enterprise warehouses, exposes the gap: schema rot, domain-specific naming, and complex multi-join queries push pure LLM approaches to zero accuracy, and even RAG plus prompt engineering plus agentic AI only reaches 10-30%. That's a 50%+ drop from what the leaderboards suggest. If you're evaluating or building NL-to-SQL tooling for internal data warehouses, Beaver is the benchmark to run against. [Read more](https://daily.dev/posts/EWtJyORaI) ## How OpenAI built its internal data agent: context assembly matters more than the model OpenAI's internal data agent handles thousands of employee queries daily using a single model (GPT-4.5), 13 tools, and a runtime loop — deliberately simple. The real complexity is in context assembly: table descriptions built from usage metadata, human annotations, and nightly Codex enrichment jobs that read table code, supplemented by Slack, Docs, Notion, and conversation memory. Five lessons worth internalizing: good data foundations matter more than the agent itself; fewer non-overlapping tools outperform many; rank past queries by trust rather than using all of them; guide with high-level goals not step-by-step prompts. They also used Codex for data migrations across 90K tables and 600 petabytes over two months. [Read more](https://daily.dev/posts/hX53mapj8) ## MySQL 26.7 Early Access: post-quantum cryptography and Thread Pool moves to Community MySQL 26.7 Early Access, available via MySQL Labs, adds 13 new variables for post-quantum cryptography via OpenSSL 3.5, covering TLS key exchange and PQC signing across admin, replication, and MySQLX interfaces — all defaulting to OFF in this build. More immediately useful for most teams: the Thread Pool plugin, previously Enterprise-only, is now available in MySQL Community Server. Three new replication applier columns also appear in the schema. Worth spinning up against your workload if you're on Community and have been waiting on Thread Pool. [Read more](https://daily.dev/posts/2xJsShtE5) --- ## Also notable - **Apache Arrow cuts Snowflake fetch peak memory 60-79% for ML workloads:** Adding an Apache Arrow fetch path for Snowflake reads dropped median peak RSS growth 60-79% across three query shapes and peak Python allocations 69-87%, with one large workflow doubling its training-data window on the same cluster — the root cause was the default pandas path materializing results as Python objects at roughly 3x the final DataFrame size before building the DataFrame. [Read more](https://daily.dev/posts/0tuJNnBZf) - **Canva replaced MySQL session revocation with S3-backed binary chunks, cut memory 87.5%:** Canva's gateway pods were loading over a million session revocations from MySQL into memory on each deploy, causing database stampedes; replacing MySQL with S3-backed 16-byte binary records partitioned into 30-minute windows reduced in-memory footprint by 87.5% and eliminated read replica sprawl. [Read more](https://daily.dev/posts/fREpTFJr1) - **Hardwood Parquet 1.1.0.Beta1: 2.5-3.9x faster reads for fixed-length lists like embeddings:** Hardwood Parquet 1.1.0.Beta1 ships an opt-in fast path that detects fixed-length lists (e.g., 768-element embeddings) and bypasses Dremel record reconstruction, delivering 2.5x speedup for the column reader and up to 3.9x for the row reader with under 2% detection overhead. [Read more](https://daily.dev/posts/lzc3bQLYi) - **MySQL 9.7 Hypergraph Optimizer cuts 8-table join from 451ms to 122ms:** MySQL 9.7 Community Edition makes the Hypergraph Optimizer generally available; on an 8-table join benchmark it reduced execution time from ~451ms to ~122ms by introducing an early hash join, though simpler queries may see no benefit or slight regressions — test with EXPLAIN ANALYZE before enabling broadly. [Read more](https://daily.dev/posts/iSta0aaR3) - **MariaDB ending MySQL Galera Cluster support September 30, 2026:** MariaDB is dropping MySQL Galera Cluster on September 30, 2026; Percona XtraDB Cluster is the migration path that stays within the MySQL ecosystem and avoids the incompatible system tables and manual account recreation required by MariaDB Galera Cluster. [Read more](https://daily.dev/posts/n0M5i0a5F) ## Similar posts on daily.dev - [Oracle July 2026 Critical Patch Update 1235 CVEs](https://daily.dev/posts/oracle-july-2026-critical-patch-update-1235-cves-irkciptx1) · Tenable Blog · 0 upvotes · 0 comments --- Tags: [#backend](https://daily.dev/tags/backend), [#llm](https://daily.dev/tags/llm), [#mysql](https://daily.dev/tags/mysql), [#oracle](https://daily.dev/tags/oracle), [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/oracle-drops-1-449-patch-cpu-text-to-sql-accuracy-collapses-on-real-warehouses-gbtvu63gs) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/oracle-drops-1-449-patch-cpu-text-to-sql-accuracy-collapses-on-real-warehouses-gbtvu63gs","headline":"Oracle drops 1,449-patch CPU, text-to-SQL accuracy collapses on real warehouses","text":"Oracle's July 2026 Critical Patch Update is its largest ever, covering 1,235 CVEs including a CVSS 9.9 flaw in DBMS_CLOUD that lets a low-privileged attacker take full control of the RDBMS. A new benchmark called Beaver shows that text-to-SQL systems scoring 80-90% on public benchmarks drop to 10-30% accuracy on real enterprise data warehouses — a gap that should recalibrate expectations for anyone building NL-to-SQL tooling. MySQL 26.7 Early Access lands post-quantum cryptography support and moves the Thread Pool plugin to Community Edition. OpenAI published a detailed account of how its internal data agent actually works, and the engineering lessons are worth reading for anyone building similar systems.","url":"https://daily.dev/posts/oracle-drops-1-449-patch-cpu-text-to-sql-accuracy-collapses-on-real-warehouses-gbtvu63gs","datePublished":"2026-07-23T04:17:56.230Z","dateModified":"2026-10-15T02:19:05.901Z","author":{"@type":"Organization","name":"Databases Digest","logo":"https://media.daily.dev/image/upload/s--ir1hdV8b--/f_auto,q_auto/v1773839400/logos/databases_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/databases_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/databases_digest","name":"Databases Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Databases Digest","item":"https://daily.dev/sources/databases_digest"},{"@type":"ListItem","position":3,"name":"Oracle drops 1,449-patch CPU, text-to-SQL accuracy collapses on real warehouses"}]} ```