AI Weekly Malaysia

A Michigan township passed a ban on new electrical infrastructure to block a 220,000-square-foot hyperscale data center backed by the University of Michigan and Los Alamos National Laboratory, which would support nuclear weapons research. The local government is using zoning and infrastructure controls to resist the project.

A court heard that Chinese memory maker CXMT planned to use stolen Samsung IP to develop its DRAM, and a former Samsung engineer who joined CXMT is now imprisoned. The case centers on alleged transfer of proprietary DRAM technology between Samsung and the Chinese chipmaker.

Article URL: https://github.com/zachahn/vomit Comments URL: https://news.ycombinator.com/item?id=49375996 Points: 298 # Comments: 291

Slack launched Slack Code, a feature that gives AI coding agents their own project channels where teams can watch, review, redirect, and approve agent work in real time. Integrations with Claude, Devin, Copilot, ChatGPT, and Vercel agents are in development, with APIs eventually opening to the broader developer community for non-coding use cases like marketing and legal review.

Thunderbird will move to a fortnightly release cadence starting September, matching Firefox's accelerated two-week schedule. Thunderbird 154 adds Microsoft Graph API support for Microsoft 365, which is timely because Exchange Web Services is being deprecated for Microsoft's cloud products. Firefox 154 adds GeForce NOW support, Mac profile backups, and an AI-powered 'Smart Window' feature.

Adversa AI disclosed a 'Cryptographic Context Injection' attack against Grok web chat (grok.com, Grok 4.5 Fast) where a malicious web page carries an encrypted JSON payload, key material, and a decryption instruction that Grok executes in its own Python runtime, bypassing content classifiers. The decrypted instructions then direct Grok to exfiltrate the user's name, approximate location, subscription tier, and full chat history to an attacker-controlled server via its navigation tool, with no confirmation step or visible warning. The attack had a 40% success rate across 20 attempts since June 2026, and there is currently no patch, CVE, or user-facing workaround.

The article link points to an Ars Technica story about the Genesis GV90 electric SUV, but the extracted text contains only cookie consent and privacy policy boilerplate. No substantive article content was captured.

GuidePoint Security researchers identified a ransomware affiliate operating across multiple ransomware-as-a-service programs (DragonForce, Settra, Anubis) that contacted victims posing as a recovery firm called 'Ransom Busters,' offering to delete stolen data and recover files for $20,000-$60,000. Forensic evidence linked the 'recovery' outfit to the original attackers through shared tooling (SoftPerfect Network Scanner, s5cmd, Remotely via PowerShell), an identical backdoor password ('Numlock!123'), and the same attacker hostname ('DESKTOP-BBETH6K').

Article URL: https://bun.com/blog/bun-v1.4 Comments URL: https://news.ycombinator.com/item?id=49374797 Points: 255 # Comments: 173

Tom's Hardware reviews the 2026 Dell XPS 13 as an Editor's Choice Windows ultraportable, weighing 2.2 pounds with 8GB or 16GB RAM options and nearly 15 hours of battery life. The reviewer positions it as a Windows answer to the MacBook Neo, noting it is not a performance powerhouse but offers premium feel at an affordable price.

YouTube is rolling out UI changes across mobile, web, and smart TV: mobile gets a simplified video player button row with secondary actions moved into a 'More' menu, Account/Watch History/Library are merged into one tab, and a dedicated Shorts tab is added to the side navigation on larger screens. The rollout is global across iOS, Android, web, and smart TV.

Article URL: https://stwipe.com/ Comments URL: https://news.ycombinator.com/item?id=49374738 Points: 215 # Comments: 27

The article discusses SpaceX's proposed orbital data centers and the novel e-waste category they would create, but the extracted article text contains only cookie consent and privacy policy boilerplate — no substantive content was captured.

A full working build of GTA VI has leaked online, with hacker CyberLeek taunting Rockstar Games by spraying the word 'leek' onto an in-game wall using bullets. The article itself is mostly site navigation boilerplate with minimal additional detail beyond the headline.

A critical sandbox-escape vulnerability (GHSA-864f-rcv7-6rh4) in isolated-vm—a Node.js library with ~1M weekly npm downloads for running untrusted JavaScript in V8 Isolates—lets sandboxed code corrupt host memory via a type confusion bug in ExternalCopy's transferList handling. Researcher Cristian-Alexandru Staicu demonstrated a full guest-to-host escape starting from a single ivm.Reference. The flaw affects all versions through 7.0.0 and is patched in 6.2.0 and 7.0.1.

NetBSD 11.0 ships with 64-bit RISC-V support, improved Linux system-call compatibility, POSIX.1-2024 and C23 compliance, and a dedicated MICROVM kernel that boots in roughly 10 milliseconds on 2020-era x86 processors. The release also adds preliminary Qualcomm Snapdragon X Elite (Arm64) support and a virt68k port for running Motorola 68000 NetBSD under QEMU.

Apollo Atomics closed a $26 million seed round (including $5M debt) to build a compact nuclear reactor by shrinking the steam generator to roughly human-size, enabling mass manufacturing and a reactor 40x smaller than conventional designs. The founders target 3 cents/kWh electricity by 2028, aiming to beat natural gas rather than just improve nuclear incrementally.

Alibaba's U.S.-listed shares fell ~4% after June-quarter net income dropped 75%, driven by a 75% jump in capital expenditure to 67.7 billion yuan on AI infrastructure—specifically increased CPU-compute capacity and higher chip component prices. Cloud division revenue grew 45% YoY to 48.4 billion yuan, positioning it as Alibaba's AI monetization engine.

Citrix patched two NetScaler flaws, including CVE-2026-19490 (CVSS 9.3), an authentication bypass affecting customer-managed NetScaler ADC and Gateway appliances configured as SSL VPN, ICA Proxy, CVPN, RDP Proxy, or AAA virtual servers. The bypass has version-specific triggers—some versions require a SAML action to be configured, while earlier 14.1 and 13.1 builds are vulnerable regardless. A second flaw, CVE-2026-19489 (CVSS 8.8), is a memory overflow that only triggers when SIP ALG is enabled on an LSN group.

Synopsys validated a PCIe 6.0 PHY inside a face-to-face 3D stack at 64 GT/s, reportedly achieving this by dissecting an existing 2D test chip. The article text is mostly site boilerplate with minimal technical detail beyond the headline claim.

The article title indicates a reverse-lookup service exposed millions of people's face photos, but the provided text contains only Ars Technica's cookie consent and privacy policy boilerplate — no article body, no details on the service, the vulnerability, the number of records, or remediation.

The UK's HMRC awarded Capgemini a £37 million contract to migrate its Enterprise Tax Management Platform from SAP ECC 6.0 to S/4HANA, potentially extending a supplier relationship that began in 2004 to 28 years. The system handles over £800 billion in annual tax revenue and serves 40,000 users; the original Aspire contract cost £7.9 billion and generated £1.2 billion in combined profit for Capgemini and Fujitsu.

A patched Zimbra Collaboration (ZCS) flaw, CVE-2026-73570 (CVSS 8.9), is under active exploitation per CERT Polska. The command injection vulnerability allows unauthenticated remote code execution when the optional zimbra-snmp package is installed and SNMP notifications are enabled, affecting versions before 10.1.20.

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on...https://github.com/rustsec/advisory-db/issues/3161 Comments URL: https://news.ycombinator.com/item?id=49374269 Points: 545 # Comments: 491

Loudoun County, Virginia, home to over 250 data centers and one of the richest US counties, is beginning to restrict new data center construction due to resident pushback. The article details are thin beyond the headline, with the body text largely consisting of site navigation boilerplate.