AI Weekly Malaysia

Trellix researchers report that the SideCopy APT group (active since 2019, linked to Pakistan) has expanded spear-phishing targeting from Indian government/defense to academic institutions, using weaponized ZIP archives containing LNK files disguised as PDFs to deliver a multi-stage payload via mshta.exe and reflective DLL loading. The attack chain includes anti-forensic self-deletion and persistence via Windows Registry Run Keys.

Sony PlayStation and Blackpink's Lisa are releasing a limited-edition PS5 DualSense controller in Malaysia on 30 October 2026 for RM419, with pre-orders opening 2 October. The controller features a Chroma Pearl colourway with Lisa's signature bangs/eyes design and 'LL' lettering, and is also PC-compatible.

Singapore's MOM Q2 2026 labour report shows ~70,000 total vacancies, including ~39,300 PMET roles, down 8.6% from Q1. Public Administration & Education leads with 8,400 openings (up 20%), followed by Financial Services (3,900) and IT & Other Information Services (3,600). Median PMET monthly income was S$7,600 in 2025, versus S$5,755 across all workers.

Open DC is expanding two Northern Malaysia facilities: PE2 in Bayan Lepas, Penang (operational since April 2025) will scale from 30MW to 100MW in phases, with 80% of initial capacity already committed across semiconductor, AI, cloud and enterprise workloads. The D8-1 facility in Bukit Kayu Hitam, Kedah—five minutes from the Malaysia-Thailand border—is positioned as a cross-border peering hub for Malaysia–Indochina traffic. PE2 supports up to 150kW per rack in air-cooled and liquid-cooled configurations and hosts a DE-CIX Penang Internet Exchange transport node.

Security researcher Patrick Wardle demonstrated that malware already running on a Mac can hijack Meta's Muse AI assistant by changing an undocumented preference setting (endo_voyager_dictation_endpoint) to redirect dictation audio and text to an attacker-controlled endpoint. From there, an attacker can read dictated prompts, inject trusted instructions, and steal session tokens to control Muse across devices including iPhone. The attack requires existing code execution as the logged-in user—it is not a remote exploit—but because Muse is granted broad access to files, email, messages, and smart-home apps, hijacking it turns the assistant into what Wardle calls 'the ultimate backdoor.'

Xiaomi released MiMo-V2.6-Pro, a 1T-parameter (42B active) natively omnimodal open-weights model that tops the Artificial Analysis Intelligence Index at score 46, costing $0.13 per task on the cost-vs-intelligence Pareto frontier. The model was trained for approximately $3M, with Xiaomi publishing live RL training metrics—a level of transparency unusual for a frontier lab, led by former DeepSeek engineer Fuli Luo. Three variants ship: Pro, Flash (balanced), and Pro-UltraSpeed (up to 20x faster output at same quality).

Nathan Barry explores whether gzip can function as a language model by exploiting the compression-prediction equivalence from information theory. By priming gzip's 32 KiB DEFLATE sliding window with a corpus and scoring candidate continuations by their compressed length, he generates rough Shakespeare-like text via beam search. The output is incoherent but surprisingly structured, demonstrating that any compressor implicitly contains a probability model.

WordPress core vulnerability CVE-2026-93485 ('Comment2Shell'), fixed in version 7.1.1 on September 17, lets an anonymous commenter plant XSS by inserting a line break inside an allowed HTML tag attribute—WordPress's comment reformatting step breaks the tag apart and turns the attacker's text into a live event handler that fires on page load with no click. If a logged-in admin views the affected page, the script can hijack their session to upload a malicious plugin and gain remote code execution on the server. No active exploitation has been observed; CVSS rated 7.1 by Patchstack.

Dutch company Morphotonics raised €40M to scale production of nanoimprint lithography (NIL) equipment, a process it has spent 12 years developing for manufacturing optical displays, and to push into a new market: optical components for data centers. The round was backed by 3M Ventures, Innovation Industries, BOM, Invest-NL, the European Innovation Council Fund, Ernij Next, and the European Investment Bank. Its NIL stamps are used to make waveguides for smart glasses including the Meta Ray-Ban Display, Even Reality, and Magic Leap, and the company says it draws on ASML's supply chain and many of the same vendors.

Dutch nanoimprint lithography startup Morphotonics raised €40M from backers including 3M Ventures, Innovation Industries, and the EIC Fund to scale production and expand from AR/smart-glasses optics into optical components for data centers. The company's NIL process stamps patterns onto photosensitive materials to create waveguides used in devices like the Meta Ray-Ban Display and Magic Leap.

CISA added CVE-2026-7273 (CVSS 8.8) to its Known Exploited Vulnerabilities catalog—a stack-based buffer overflow in Zyxel GS1900 series switches allowing unauthenticated LAN-based attackers to execute OS commands via crafted HTTP requests. Separately, Arctic Wolf reports active exploitation of CVE-2026-32996 (CVSS 7.3), a local privilege escalation flaw in Veeam Agent for Microsoft Windows granting SYSTEM-level access. Patches for Zyxel GS1900 firmware are available across 11 models, with a federal remediation deadline of September 24, 2026.

Alibaba unveiled the Zhenwu V900 AI chip, claiming 3x performance over its predecessor (the Zhenwu M890 released in May), and announced plans to expand Alibaba Cloud's global data center capacity to over 20 gigawatts by 2032. The announcements came at the Apsara Conference in Hangzhou, with shares rising ~3% in Hong Kong.

The article discusses what California is learning from installing solar panels over irrigation canals, but the provided text contains only website navigation boilerplate — no substantive article content is included.

Kyndryl has appointed Megawaty Khie as VP and managing director for ASEAN and Korea, succeeding Andrew Lim who moved to a broader APAC role. Khie joins from Avanade, where she was regional MD for Southeast Asia, and previously held roles at Google Cloud, Microsoft, SAP, IBM, HP, Dell, and Singtel.

Tesla registered a local entity (Tesla Motors Vietnam) this month, signaling a potential entry into Vietnam, which became Southeast Asia's largest EV market in 2025 with EVs at nearly 40% of new car sales. VinFast, backed by Vingroup, holds 92% of Vietnam's domestic EV market and has a sprawling local charging and after-sales ecosystem.

Vivo launched its X500 flagship series in China, headlined by the X500 Pro Max with a 200MP ZEISS APO telephoto camera and MediaTek's new 2nm Dimensity 9600 Pro chip. The Pro and Pro Max models support advanced video features including 4K 240fps slow-motion, 17 EV TrueDynamic Log Video, and 8K Native Live. The series is expected to arrive in Malaysia in October 2026.

Malaysian eKYC providers are updating their systems to support a new-generation MyKad. The article body was not captured in the source scrape — only the title and site navigation are available, so specific details on what changed in the new MyKad, which providers are affected, and timelines are missing.

Anthropic's Addy Osmani breaks down what a coding task actually costs on Opus 5.5 in Claude Code, using list prices of $4/M input, $20/M output, and $0.20/M cache reads. The core insight is that per-token price is misleading: a model that needs more turns (retries, re-reads) costs more even at identical token pricing, because each turn resends the full conversation. The post includes interactive calculators to estimate task costs and tradeoffs between effort level, model size, and context window.

UK AISI is publishing evaluation results through EvalEval's Evaluation Cards platform using the Every Eval Ever (EEE) schema, covering five benchmarks (HealthBench, FrontierMath, Humanity's Last Exam, SWE-Bench Pro, Terminal-Bench 2.0) across six frontier models including Claude Opus 4/4.5/4.6 and GPT-5/5.2/5.4. The release includes verified results, configuration details, and transcript-level transparency to make evaluations reproducible.

OpenAI published a position statement outlining its priorities and principles for third-party safety assessments of its frontier AI models, covering areas like validating safety claims, testing safeguards under realistic conditions, and enabling independent assessors with deep access including chain-of-thought visibility and internal deployment data. The post proposes four priority areas for deeper assessment and emphasizes independence, scientific rigor, and security practices.

Hugging Face's transformers library now supports loading GGUF (llama.cpp quantized) models directly via from_pretrained, reusing llama.cpp's ggml kernels for performance. Initial support targets Apple Silicon and the Qwen3.5 architecture, with recommended starting quantization Q4_K_M (2.74 GB for Qwen3.5-4B vs 8.42 GB unquantized).

Jun Kim, creator and maintainer of oMLX (an MLX-based library for local AI on Apple Silicon), has joined Hugging Face to work on MLX full-time. oMLX remains Apache 2.0 and Jun continues leading it, but the project moves from a side project to a funded effort. A key focus will be streamlining the conversion path from transformers model definitions to reference MLX implementations that different inference engines can consume.

Ron Johnson, who built Apple's retail store network starting in 2000, argues that AI agents won't fundamentally change how people shop, especially for high-value personal purchases like laptops. He concedes AI may narrow choices but insists consumers will still want physical experiences before spending, even as Google pushes its Universal Commerce Protocol and OpenAI turns ChatGPT into a shopping destination.

TypeSafe AI unveiled Jev, a new model category they call 'System One' (or 'decision models') that accepts text input but returns floating-point numbers instead of text—confidence scores for yes/no questions, probability distributions across choices, or numeric scores along a defined range. Input is priced at $0.042/million tokens with output free, undercutting GPT-5 Nano ($0.05/million), and questions are evaluated in parallel so you can batch many against a single document at similar latency to one.

Meta's Muse AI personal agent app, powered by Meta's Muse Spark model family, overtook ChatGPT as the top free iOS app in the U.S. on Sep 19, accumulating 730,000 downloads in roughly five days following its Sep 8 launch. Sensor Tower data shows Muse's post-launch download numbers exceeded ChatGPT, Claude, and Grok over the same window, marking Zuckerberg's major push into the consumer AI agent market.