AI Weekly Malaysia

SpaceX shares rose about 9-10% after Q3 revenue hit $14.6 billion, up 161% year over year and above the $12.72 billion LSEG consensus, with operating income of $2.8 billion and net income of $4.4 billion versus a $1.05 billion loss a year earlier. SpaceX attributed the results to its growing AI business and recurring satellite revenue, while Elon Musk floated a potential SpaceX-Tesla merger and said boards of both companies have formed committees to discuss consolidation.

Tom's Hardware reports the 4TB Samsung 990 Pro — a PCIe Gen 4 M.2 drive — dropped 27% to $0.20 per gigabyte. That per-gigabyte figure works out to roughly $800 for the full 4TB capacity. The article body supplied here is almost entirely subscription and navigation boilerplate, so there is no named retailer, listed price, or deal expiry date in the text.

Part 1 of a Hugging Face/Amazon series walks through system-level profiling of TorchNeuron on AWS Trainium. It shows how to set NeuronConfig with DEVICE and RUNTIME modes, capture_enabled_for_nc='0', and correlate_device_time=True, then use NeuronProfiler.export_trace to write trace.json and read key_averages() to compare Self CPU time with Neuron device time. The walkthrough follows one operation through Neuron Explorer from PyTorch dispatch to runtime scheduling to NeuronCore execution, and compares three implementations of the same operation.

The PHP project shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 Oct 2026 to fix two critical unauthenticated RCEs: CVE-2026-109618 (memory corruption when a request hits memory_limit at the wrong moment, demonstrable on Apache with mod_php before any application code runs, and reachable on PHP-FPM through app-level paths) and CVE-2026-109619 (a fatal error leaving stale state so a later request on the same worker reuses freed memory). The Foundation traces the OOM bug partly to its first external audit in years, funded by the Sovereign Tech Agency and run through OSTIF by Quarkslab, and notes a 2024 exploit theory that was never pursued because other issues took priority. The post's real ask is funding and organisational support from companies that depend on PHP, not just patching.

Elon Musk says ASML and unspecified "other critical semiconductor equipment suppliers" will expedite shipments to his Terafab facility, which targets volume chip production by Q3–Q4 2028 — a timeline Tom's Hardware itself labels "highly aspirational." The article body contains no further substance: no capacity figures, no dollar amounts, no named suppliers beyond ASML, no site details, and no confirmation from ASML or any equipment vendor.

The supplied page text contains no article content — only Condé Nast's cookie-consent and targeted-advertising opt-out boilerplate for US state residents. Nothing in the text names the company, explains the $15 billion valuation, or describes what the ad-powered AI product does in a clinical setting. The only concrete information is the headline itself and a publication timestamp of 2026-10-21.

IBM's Granite team published three speech models: the new granite-speech-5.0-2b, plus updated granite-speech-5.0-470m-turboctc and granite-speech-4.1-2b-plus. The 2B model handles transcription in English, French, German, Spanish, Portuguese and Japanese, translates to and from English in those languages plus English-to-Italian and Mandarin, and was trained on 390,000 hours of public audio with synthetic data added for Japanese ASR, keyword biasing and translation. New controls include language-ID prompting, keyword lists of up to 2,000 terms, and improved long-form and noisy/distant-microphone performance, while the 4.1-2b-plus update targets speaker attribution and timestamps for multi-speaker recordings.

AMD has added official Ryzen overclocking support on Linux through AOD driver support, per Tom's Hardware. There is no official AMD overclocking application yet, though third-party options are expected to arrive soon. The article text available here is mostly page boilerplate and gives no kernel version, supported CPU list, or release date.

Cloudflare WAF added full transaction detections, which evaluate each HTTP request together with its response, plus response rules that can block an origin response before it reaches the requester. The capabilities are generally available to all Cloudflare customers, including Free plans, and the first managed protections target the recently disclosed php2shell vulnerability.

Dennis Crowley, Foursquare's co-founder and former CEO, wrote a blog post saying investors received no returns from Infillion's acquisition of the location-data platform last month at an undisclosed price, citing an angel investor's post to infer that neither preferred nor common stockholders got value. Foursquare had raised over $411 million per PitchBook, ran consecutive years above $100 million in revenue after pivoting to enterprise, brought in a private equity firm in 2019, and installed the banker who led that raise as CEO in 2021; the consumer app shut down in 2024. Crowley blamed the outcome on that management transition and apologized to roughly 1,600 former employees over 17 years.

Techdirt's Mike Masnick writes that the No Kings Instagram account was suspended for about an hour during a get-out-the-early-vote protest push, with admin access locked out for a few more hours; Reuters reported Meta apologized. The article uses the incident to argue that movements and builders should not rely on rented social platforms for critical distribution. The Hacker News thread drew 449 points and 411 comments.

DuckDB 2.0.0 LTS, codenamed "Cinnamon Teal", is out with close to 20,000 commits since 1.5 and is supported until at least October 2027. Headline features include a polished Quack client-server protocol with a new CONNECT statement for attaching and switching to a remote database in one command, asynchronous I/O, a first-class VARIANT type, agent mode, triggers, and an extensible SQL parser. It is explicitly a feature release with breaking changes and a migration guide, and only the CLI and Python clients are available immediately — Go, R, Java and some extensions can lag by a few days.

LiteLLM 1.107.0 on PyPI shipped with three malicious files in site-packages across all seven wheels (Linux, macOS, Windows): cook.pth, which imports cook.py and runs on every Python interpreter start — even in processes that never import litellm — harvesting SSH keys, cloud credentials, CI/CD secrets, AI tool tokens, browser passwords and the LLM provider keys stored in a LiteLLM proxy database, encrypting them and posting to www.litellm[.]dev; and sitecustomize.py, which launches a daemon that hourly re-reads a server address from a GitHub file, re-runs the stealer and executes downloaded code. The upstream GitHub source does not contain the implant, and PyPI has since removed the release. Versions 1.106.2, 1.107.0rc1 and 1.107.0rc2 are clean, as are the pinned companions litellm-proxy-extras==0.4.110 and litellm-enterprise==0.1.78.

The Hacker News reports that PHP has shipped emergency patches for two critical remote code execution flaws grouped under the name "PHP2Shell," with the article stating that exploit attempts are already being observed. The excerpt provided here is almost entirely page navigation and boilerplate, so it contains no affected version numbers, no CVE identifiers, no patch release versions, and no technical detail on the vulnerable code path.

A Nielsen survey of 1,700 directors and senior managers across seven countries, commissioned by Monday.com, found that more than half say AI makes it harder to evaluate employees' work because output arrives already polished. Nearly half say they spend more time reviewing and guiding output, while 94% are excited about AI and 78% have changed how they evaluate staff—weighting prompt-writing, task delegation to AI, and experimentation. Michal Miller Levi, head of market research and customer insights at Monday.com, said AI is moving faster than organizational processes can adapt.

Cloudflare says it deployed WAF rules for two PHP runtime flaws, CVE-2026-109618 and CVE-2026-109619 (php2shell), affecting PHP 5.4+ and potentially enabling denial of service, remote code execution, and data exposure. Protections were live by default for Free and paid WAF customers from October 21 03:02 UTC, about nine hours before public disclosure, using a new full-transaction detection capability that combines request and response signals. Cloudflare still says customers must patch their PHP repos because the WAF is only defense-in-depth.

Tom's Hardware reports that Trump announced a mandate requiring AI data centers to pay 'energy dividends' to local communities and said excess energy should be given or sold back to prevent cost increases or even lower costs. The provided article text gives no effective date, covered-facility threshold, dividend rate, enforcement mechanism, or link to official rule text.

PHP 8.2.35 was released on 21 Oct 2026 as a security release fixing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution. The release says there are no complete mitigations and that updating is the only safe choice. PHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date.

Nebius chief revenue officer Marc Boroditsky told CNBC that AI computing prices are rising faster than the company expected, and that its 2027 capacity would sell out if brought online, with a similar dynamic possible in 2028. The comments landed as investors scrutinise neocloud economics: CoreWeave's cost of borrowing spiked, and shares of Nebius and Iren dropped sharply over the past month. Boroditsky said Nebius is not in CoreWeave's position because it does not carry the same level of debt.

Wiz Research disclosed PHP2Shell, two CVEs in the core PHP engine (CVSS up to 9.2) allowing unauthenticated remote code execution and Heartbleed-style memory disclosure — leaking passwords, tokens, API keys and certificates across requests — independent of the app running on top. Every PHP release going back to 5.4 is affected by at least one flaw, and PHP shipped patches on October 21, 2026. The researchers state that the exploit chain was at the edge of what human researchers could practically achieve, and that frontier AI models substantially lowered that barrier.

Pascal, co-founded by CEO Adam Slavney and CTO Jinyoung Seo, raised an $8.5 million follow-on to its seed round, co-led by Sazze Partners and LB Investment with KDB Silicon Valley participating. The startup says its material makes refrigerators, air conditioners, and heat pumps about 20% more efficient, and it has signed a pilot contract with a multinational beverage company. Pascal expects its first prototype early next year and more polished refrigerators in 2028.

The Hacker News reports that Google Chrome is adding ClickFix warnings aimed at stopping users from running malicious commands. Beyond the headline, the supplied text is almost entirely site navigation and boilerplate: it contains no Chrome version number, rollout date, warning wording, or technical description of how the detection works. Published 2026-10-21, but no measurable detail is available to summarize further.

Claude Mods are Claude Code plugins made of TypeScript or JavaScript functions that run inside Claude Code and respond to events such as prompts, tool calls, and interface renders; they can observe, change rendering, or replace default behavior in the CLI and Desktop. Anthropic has shipped six built-in mods, and Claude Code includes a built-in skill that lets users ask Claude in plain language to build a mod. The article frames this as reversing the agent harness toward an 'Attention Interface' that makes the human layer programmable.

Qualcomm is cutting jobs globally in what the article calls "performance-based" layoffs, with the CEO framing the move as building a "stronger performance culture" while the company pivots toward AI data center and edge products. The provided text gives no number of roles affected, locations, timeline, severance details, or product roadmap.

OpenAI says ChatGPT Ads is expanding to 26 more countries, taking availability to 89 countries, roughly eight months after launch. Over 100,000 advertisers have already run campaigns on the platform, which OpenAI says reaches 1.2 billion weekly ChatGPT users. Ads appear only on Free and Go plans — Plus, Pro and Enterprise stay ad-free — and buying is via self-service Ads Manager or technology partners. New markets named include 14 more Latin American countries (Argentina, Chile, Colombia, Peru among them) plus Nigeria, South Africa, Serbia, Ukraine, Cambodia, Bangladesh and Pakistan, following earlier launches across Europe, Southeast Asia and Taiwan.