AI Weekly Malaysia

The Hacker News headline reports that a critical FortiSIEM vulnerability — described as unauthenticated remote code execution — now has a public proof-of-concept exploit. The supplied text is truncated mid-sentence, so no CVE identifier, affected version range, patch status, or exploitation-in-the-wild detail is available in the excerpt. Everything beyond the headline claim (public PoC, unauthenticated RCE, critical severity) cannot be verified from the text provided.

The Hacker News headline reports that the Qilin and INC ransomware groups are exploiting a Palo Alto Networks flaw to bypass MFA. The supplied page text is truncated after the headline and contains only site navigation, so no CVE ID, affected product or version, patch status, victim counts, or attack mechanics are available. Nothing beyond the headline claim can be verified from this text.

Y Combinator's profile of Vin Bui describes how he became the first full-time engineering hire at Nowadays (S23), a San Francisco company using AI to plan corporate events end to end, after leaving his own YC Winter 2025 company while on leave from Cornell. He describes the role as being a "technical founder" — building engineering processes from scratch, leading SOC 2 compliance, handling security and IT — and says the most interesting thing he has built is AI voice systems that call hotels and negotiate on behalf of clients. His tooling is Ghostty, the Claude Code CLI over any GUI, and switching between models per task (the excerpt cuts off mid-sentence).

IBM Research's ALTK-Evolve took a stock ReAct customer-service agent running GPT-4.1 — an older, non-reasoning model — to 67.5% Pass^4 on the τ²-bench retail domain, meaning it solved the task on all four independent attempts for 67.5% of tasks, above every retail entry in their October 12, 2026 leaderboard snapshot. The method needs no weight updates: the same GPT-4.1 model analyzes the agent's training-task attempts and distills successes and failures into short behavioral rules (how to authenticate a customer, confirm a transaction, handle a return), which are appended to the system prompt. τ²-bench pairs the agent with an LLM-simulated customer, domain tools, and a written policy, and only counts a task solved when the final database state matches the expected outcome.

A Hacker News submission reports that Facebook Pages now require a paid subscription to post more than two links per month. The linked source is a Mastodon post, and the article body could not be read, so the price, tier names, and exact rollout date are unverified. The thread drew 356 points and 314 comments, which suggests the change is hitting people who use Pages for distribution.

NPR obtained court records showing TikTok employees repeatedly warned executives about child-safety risks, including minors appearing in sexual content that was available for purchase on the platform and minors using loopholes to reach age-restricted content and hide activity from parents. Depositions filed in March 2026 also indicate TikTok skipped user age surveys partly over concern it would have to share results with the Federal Trade Commission. The documents surface as TikTok, Meta, Google and Snap face hundreds of consolidated federal lawsuits alleging platform harm to minors; TikTok has already settled several cases pre-trial.

The supplied page contains no article body — only Ars Technica's cookie-consent boilerplate (GDPR/US-state opt-out notices, social media, essential, targeted, performance, functional, and audience-measurement cookie categories). No claim, number, version, price, or date about Polestar's driving-feel metrics survives in the text, so there is nothing to summarize beyond the headline.

In testimony before the UK Commons Digital, Culture, Media and Sport Committee, Ofcom chief executive Dame Melanie Dawes said the regulator "won't be able to recover every single fine on online safety" if foreign courts block enforcement. The post, written by Preston Byrne (who says he filed the 4chan v. Ofcom suit in the US District Court for the District of Columbia), points to that court's earlier dicta that 4chan has "no presence, infrastructure, or operations abroad," meaning any judgment would have to be enforced through American courts — which, citing Matusevitch v. Telnikoff, generally decline to enforce foreign judgments that contravene the First Amendment, and are not necessarily required to enforce foreign penal judgments.

At its first Config conference in India, Figma announced 20 new MCP partners, including Amp, ClickUp, Linear, Mistral, Notion, OpenCode, and Sarvam Agents. Figma co-founder Dylan Field said MCP is "not a perfect protocol" with "tons of room for improvement" and is "advantaged more to frontier labs," while also noting that Anthropic does not expose artifacts or other cloud resources via MCP. Figma later said it plans to support Pi.

CNBC reports that Anthropic is in talks with U.K. neocloud Nscale for a second multibillion-dollar compute lease, covering a second 460-megawatt data center at the same West Virginia site as an earlier deal. The deal could be worth around $45 billion, according to one unnamed source; Anthropic declined to comment and Nscale was approached for comment. The report also notes that publicly listed neocloud rivals CoreWeave and Nebius saw shares fall 28% and 27% in the past month amid concerns over heavy borrowing.

The Hacker News headline (published 20 Oct 2026) states that attackers used autonomous AI agents to breach company websites, with a stated target scope of over 1,200 sites. The captured page text is only the site's navigation and boilerplate — the article body, the affected platforms, the attack method, and any attribution or timeline are all missing from the excerpt. There is no vendor, tool, CVE, or named researcher detail available in what was provided.

Tom's Hardware reports that an unidentified AMD 'Zen 6' APU with 24GB of LPDDR5 memory has surfaced in benchmark listings, speculating it could power a next-gen Steam Deck or another gaming handheld. Beyond the 24GB LPDDR5 figure and the Zen 6 architecture name, the supplied article text contains no benchmark scores, clock speeds, TDP, pricing, launch dates, or named OEM — only site navigation and subscription boilerplate.

Eight eMudhra intermediate CA private keys were compromised, and reporter Wayne proved it by signing a message with each key before reporting to root programs on 17 October 2026. Firefox and Chrome blocked the certificates from 17 October and Apple from 19 October, while the CA revoked the intermediates; clients that do not consume revocation data need software updates. The page lists patched CA bundles and runtimes, including Go 1.27.3/1.26.10, curl's 2026-10-20 bundle, Ubuntu 20260816 packages and Arch ca-certificates-mozilla 3.131.1-1, with Debian, FreeBSD and Node.js still pending.

On Friday 2 October at 09:35, 333 compromised Tor exit relays — roughly 10% of Tor's ~3000 exit relays — began a coordinated campaign to intercept SSH connections on port 22 and harvest unencrypted mail traffic. The servers had been breached two months earlier in August with an Ebury 1.8.3 payload (an OpenSSH backdoor and Linux credential stealer), and SSH sessions were silently redirected to one of 12 interception servers, which stole passwords, watched commands, and reinfected the connecting server. The author reported it to the Tor Project's network health team that evening; relays were marked BadExit on Sunday 4 October, and by Monday 5 October the attackers' restarted relays could only serve as middle relays before all infected servers were shut down.

Tom's Hardware reports that the U.S. Army is reportedly developing ECHOTRIBBLE, a program that would deploy AI agents to autonomously seek and destroy targets in enemy digital infrastructures. Experts warned the program could have disastrous consequences, according to the headline. The supplied article text contains no further technical details, timeline, named officials, budget figures, or program specifics.

Reliable Robotics raised a $115M extension to its Series D—$90M in equity led by Nimble Partners and $25M in debt from Silicon Valley Bank—bringing the round to $275M and its valuation above $1B. Its first product, continuous autopilot engagement, handles engine start, taxiing, takeoff, and landing while a pilot remains onboard and uses a touchscreen; CEO Robert Rose expects FAA certification in 18–24 months. A second certification that removes the pilot from the cockpit is at least three years away.

The US Department of Homeland Security has ordered federal civilian agencies to stop buying DeepSeek products and to remove them from government IT systems, and the order explicitly extends to third-party products and services built using DeepSeek technology, with exceptions available on request. DHS cited the risk that US government user data could be accessible to Chinese authorities under Chinese law. It follows a December 2025 law restricting DeepSeek in intelligence systems, and Bloomberg reports China is weighing export restrictions on 23 AI-related technologies including chip designs and some advanced models.

Peec AI GEO researcher Metehan Yesilyurt built stateglobe.com in March 2026: 50,000 statistics pages generated in a single day with GPT-4.1, every number invented, covering SEO, content marketing, social, e-commerce and web tech across 200 countries — total cost around $30, plus ~$20 for 15,000 later-added listicles. Google deindexed the site, but ChatGPT kept citing it: 10,000+ AI-referred sessions, 330+ referring domains (Shopify, Bluehost, DHL among them), and the fabricated figures surfaced in an academic paper and a bank's investment research.

Bob McGrew, identified as a former OpenAI executive and former research chief, has built Arda, which raised $230 million at a $1.5 billion valuation from Altimeter Capital, Accel, and Khosla Ventures. Arda sells an AI assistant for manufacturing engineers, described as a UI and agent that does for manufacturing engineers what Claude or Cursor does for programmers, and says its models are already deployed with military tech company Anduril. The company is betting the tool can speed up adapting production when designs for weapons or drones change.

Cloudflare and VoidZero are collaborating with Max Schwenk of Owner.com on tsrs, a Rust port of the TypeScript compiler incubated inside the Oxc toolchain. Early benchmarks claim up to 8x faster type checking and roughly 70% less memory than TypeScript 7.0 with the same number of check workers, while TypeScript 7.1 beta is itself up to 2.5x faster than 7.0 partly from upstreamed optimizations. It ships as an experimental npm package (`npm install tsrs`, `npx tsrs`), and the authors stress it is a faithful port, not a fork, with the TypeScript team keeping control of language design.

Jobs and Skills Australia's 2026 annual report estimates that 13.6 million Australians use AI tools daily, with daily use at 74% among ages 25–34 and 72% among ages 35–49. It also reports that 39% use AI for content generation related to work or study.

Inspired Capital closed a $450M fourth fund, bringing assets under management to nearly $1.4B. The New York-based early-stage firm writes $1M–$15M checks from napkin stage to Series A and backs roughly 10 companies a year. It says 12 companies across its first two funds became unicorns, including MosaicML, which Databricks acquired for $1.3B.

Eka Robotics raised a $150M Series A led by a16z and F-Prime at a $1.45B post-money valuation for a physical-AI manipulation stack: a force-sensitive gripper plus a new deep-learning model. TechCrunch reports it can pick up about 1,500 objects weighing up to 1 kg per hour, versus about 600 for a human, with >95% reliability, and adapt to many objects without retraining; roboticists quoted call the demo unusually impressive.

The Hacker News headline reports that a Pegasus spyware infection was confirmed on a Serbian university rector's iPhone in the days before an election. The supplied article text is almost entirely site navigation and boilerplate, so no technical detail is available: no iOS version, no infection vector, no forensic method, no timeline beyond the headline, and no named sources or quotes.

Tom's Hardware reports that the US has restarted three previously shut-down nuclear reactors, bringing 2.25 GW of capacity online, with backing from Microsoft and Google. The article frames the recommissioning as a response to power demand from AI data centers. The excerpt gives no plant names, locations, commissioning dates, or pricing details.