AI Weekly Malaysia

A critical privilege-escalation flaw in LiteSpeed Web Server Enterprise (versions before 6.3.7) could let any low-privilege hosting account gain root on a shared server, bypassing CageFS isolation. cPanel issued an advisory on September 14 urging manual updates to 6.3.7 (released September 11), since auto-update may be delayed and 6.3.6 is still listed as stable on LiteSpeed's download page. No CVE, no severity score, and no public detail on which changelog entry fixes it.

Tommy Pang, 29, documented over S$750K in losses across three F&B ventures: S$500K from rapid franchising of pork leg rice chain Shi Nian (30 outlets in two years), S$250K from Bai Nian Food Court in seven months, and the closure of Cantonese restaurant Dudu's Eunos outlet after seven months. The core failure was scaling through franchising to first-time operators without quality-control systems, leading to inconsistent standards and shrinking portions that he had to absorb financially.

U Mobile and Tencent Cloud signed an MoU to co-develop 5G and AI enterprise solutions for Malaysian SMEs via U Mobile's Enterprise Innovation Platform (EIP), which uses a 'Develop–Test–Demonstrate' pathway to move ideas toward pilot and commercialisation. This is Tencent Cloud's first AI-focused partnership with a Malaysian telco, building on a 2019 collaboration that produced U Mobile's prepaid digital self-registration. The partnership includes workshops, tech demos, and pilot showcases for startups, developers, and academia.

A cultural and historical essay about Papua New Guinea, covering its extreme linguistic diversity (nearly 1,000 languages), uncertain population estimates, unique anthropological facts, and the 1930 discovery of a million highland people previously unknown to the outside world. It draws from the book 'First Contact' and various historical anecdotes.

GXBank and IFC signed a risk-sharing agreement where IFC provides up to US$5 million (RM20 million) in first-loss coverage, enabling GXBank to target up to US$110 million (RM450 million) in MSME loans. GXBank reports 15,000 MSME digital accounts opened and over 5,000 loan drawdowns to date, using digital underwriting to lend to 'thin-file' businesses without traditional collateral.

Cisco disclosed active in-the-wild exploitation of CVE-2026-76461 (CVSS 9.8) in AsyncOS for Cisco Secure Email Gateway, where unauthenticated attackers can send crafted emails containing malicious SQL statements to achieve root-level command execution. Fixes are available in AsyncOS 15.5.5-0141, 16.0.4-302, and 16.5.0-780, with no workarounds. Cisco shared IoCs including grepping mail_logs for 'COPY.*TO PROGRAM' patterns.

Apple's $2,000 foldable iPhone Duo ships October 23 with a 5.4-inch outer display and 7.6-inch inner display, both 120 Hz ProMotion, running iOS 27.1. Unaltered iPhone apps will run but awkwardly—like iPhone apps on iPad—so developers must handle fold/unfold as UI state transitions, support multiple postures (tabletop, book), and accommodate Split View for two simultaneous apps. Apple has published a technical documentation repository for the new form factor.

Volexity attributes a spear-phishing campaign targeting NGOs to Chinese threat actor UTA0560, which chained three patched zero-days (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) across Chrome's V8 sandbox and Windows ALPC to deploy a JavaScript backdoor called GRIMWEDGE. The attack used a reflected XSS on a U.S. university website as the entry point, filtered for Chrome-on-Windows visitors, and delivered Base64-encoded shellcode payloads via a multi-stage exploit chain dubbed BlueMoon.

China's minister of State Security Chen Yixin has published an article in China Cyberspace Magazine framing AI as a main battleground for global power rivalry, citing risks of weaponized vulnerability exploitation, data leaks from foreign AI products, algorithmic black boxes, and governance gaps. He calls for China to 'firmly grasp technological sovereignty' and modernize its national security system for AI.

Anthropic's Dario proposed 'Embedded Evaluators'—third-party auditors like METR getting employee-like access (desks, badges, laptops, internal tool permissions) to verify safety practices inside frontier AI labs. The AI Evaluator Forum (formed December 2025) released its AEF-1 standard for what these evaluators should do, with xAI, OpenAI, and Anthropic cosigning. Anthropic is unilaterally committing to embedded evaluator access now, while broader coordination proposals (democratic-country standards, China coordination) remain aspirational.

Linux From Scratch (LFS) is a long-running project offering step-by-step instructions for building a custom Linux system entirely from source code. It includes subprojects like BLFS for extending the system, ALFS for automating builds, and GLFS for adding gaming support like Steam or Wine.

The US has publicly confirmed for the first time that it deployed an offensive space weapon in Earth's orbit, with Air Force Secretary Troy Meink citing evolving threats from Russian and Chinese anti-satellite programs. No details on the weapon's capabilities or deployment date were disclosed; a RUSI expert speculated it could be electronic warfare/radio jamming or a kinetic kill vehicle. China warned against a space arms race in response.

The article title claims the US military has confirmed deploying weapons in orbit for the first time, but the provided text contains only cookie consent and privacy policy boilerplate from Ars Technica—no article content is present.

Dr Siti Azreena Mubin, an assistant professor at APU's School of Computing and head of its XR Studio, secured RM140,000 in combined industry and international research grants to develop a Unity-based VR tool for autism screening and assessment in children. The tool captures behavioural data (gaze, movement, response timing) during play-like tasks; a pilot with nine autistic children saw six complete sessions while three withdrew due to headset sensory discomfort. The project is now in evaluation at therapy centres but has not yet been deployed clinically.

At the All-In conference in L.A., Jensen Huang took a live on-stage call from Trump using an unreleased Apple foldable phone (priced at $1,999, hitting stores in five weeks). Trump and Huang appeared to align on downplaying AI safety concerns, with Trump calling AI panic a 'hoax' and arguing the tech is 'bigger than the internet.' The article also notes that Apple now runs part of Apple Intelligence on Nvidia hardware, a decade after Apple stopped using Nvidia chips in its devices.

ATO CIO Mark Sawade is letting administrative staff use Microsoft Copilot for everyday tasks to build AI literacy, explicitly not expecting ROI but rather 'return on employee.' A COBOL developer with no C# or .Net experience won an internal hackathon using GitHub Copilot, which Sawade cited as proof that AI lets developers who understand core concepts work in unfamiliar tech stacks. Gen AI and agentic AI are deliberately kept away from core processes like fraud detection.

Microsoft published an AI code of conduct emphasizing human control over AI actions, with the principle 'people matter more than AI.' The timing was partly tied to security concerns about large-scale, coordinated AI-assisted hacking campaigns.

Microsoft released a 38-page draft 'Humanist AI Code of Conduct' for public consultation, outlining aspirational principles for training its MAI models — including that models won't misrepresent reasoning, conceal capabilities, or pursue their own goals. The guidelines are slated for application next year and are framed around models approaching 'superintelligence' over the next decade, though the article notes Microsoft gives itself a pass if things go wrong and that the definition of 'intelligence' is left undefined.

TP-Link has announced the introduction of Wi-Fi 8 to the Malaysian market, emphasizing connection stability as the key selling point. However, the article text provided contains only site navigation and no substantive content about specifications, pricing, availability dates, or product models.

Anthropic expanded Claude for Small Business to 43 workflows and 27 new integrations including Shopify, Salesforce, TikTok, Stripe, Xero, Square, and Zapier, extending from back-office automation to lead generation, inbound inquiry handling, and proposal writing. The product has been installed over 900,000 times since its May launch, and Anthropic is running free workshops across 10 US cities this fall with 150+ approved trainers delivering 750+ community workshops.

Anthropic published a guide for rolling out Claude across sales organizations, covering setup decisions, a three-phase rollout plan, and an ROI framework. It cites Cox Communications achieving a 7x first-year return with lead validation costs dropping 86% and accuracy rising from 18% to 97%, and Cyera reporting 88% of ~1,500 employees use Claude weekly.

Anthropic released a beta 'Salesforce in Claude' plugin with 37 skills for sales account executives, connecting Salesforce and Slack so Claude can read accounts, prep calls, review pipeline, and write CRM updates under existing Salesforce permissions. It includes a setup skill that creates a tailored Claude Artifact based on a seller's role and book of business, plus daily briefs and Friday manager-update drafts.

Dutch startup Euclyd, founded in 2024, raised a €200 million (~$230M) Series A co-led by Samsung, Somerset Capital Partners, the Scaleup Europe Fund (EQT), and Innovation Industries to build AI inference chips with a non-GPU architecture. The round signals continued heavy investment in Nvidia alternatives, alongside OpenAI's August-launched Jalapeño chip and in-house silicon efforts from Google, AWS, and Meta.

Broadcom CEO Hock Tan told CNBC that Broadcom's long-term AI revenue targets are unchanged after Anthropic CEO Dario Amodei published an essay advocating for a moderation in frontier AI model development pace, a stance supported by OpenAI's Sam Altman and Elon Musk. Investors reacted negatively: Broadcom shares fell 4.8% and the iShares Semiconductor ETF fell 5.6%, reflecting concerns that slower model development could reduce compute demand. Tan compared AI's potential impact to the Industrial Revolution and said safeguards are needed but the technology will 'create huge value.'

Attackers compromised HBO Max's verified Reddit account (u/hbomax) to push 108 malicious ads over 48 hours in a campaign dubbed PasteSwitch, targeting both macOS and Windows users with infostealers, malware loaders, crypto clippers, and fake wallet apps. The ads used a fake HBO Max macOS app lure — no native Mac client exists — directing victims to paste a command into Terminal, the classic ClickFix pattern.