AI Weekly Malaysia

GitLab CVE-2026-19478 (CVSS 9.4), a code injection flaw exploitable via a GraphQL directive by unauthenticated attackers, is under active exploitation within days of disclosure. It affects self-hosted GitLab CE/EE versions 18.2 (before 18.11.11), 19.0 (before 19.0.8), 19.1 (before 19.1.6), and 19.2 (before 19.2.4). watchTowr reports attackers can delete repositories, forge merge records, and ban maintainers; they recommend hunting web logs for '@gl_introduced' and patching immediately or restricting unauthenticated access to /api/graphql.

Tesla Malaysia launched its first Supercharger in Perak at Aeon Mall Kinta City Ipoh, featuring 4 V4 DC bays delivering up to 250kW, located near the PLUS highway as a mid-point stop between KL and Penang. Free charging is offered from 21-23 August 2026. This brings Tesla Malaysia's total to 21 Supercharger locations with 92 DC charge points nationwide.

Chinese video-sharing platform Bilibili is expanding internationally with an Android app (iOS forthcoming), targeting Gen Z, affluent, and well-educated users. It has eased restrictions such as ID verification for non-China users, lowering the barrier to entry for global creators and viewers.

A Register 'On Call' anecdote features a developer sent to a power station to document and fix undocumented monitoring code running on a dusty CP/M machine connected to a turbine overspeed detector. Faced with no documentation and the risk of causing a turbine overspeed or city-wide blackout, he decided the safest action was to not touch the code at all.

Update: The story was updated after publication to note that the vulnerability has not been exploited. Although the security bulletin originally marked the "Exploited" field under the Exploitability Assessment table as "Yes," on August 21, 2026, Microsoft corrected the "Exploited" status to "No" after The Hacker News contacted the company for comment. It also noted, "this vulnerability was not

TNG eWallet has received recognition from Jabatan Tenaga Kerja Sarawak (JTK Sarawak) as an alternative salary payment method, completing nationwide coverage across all Malaysian labour authorities. Over half a million users are already receiving wages through TNG eWallet, with more than RM5.7 billion disbursed in 2026 so far. Employers can transfer wages directly from any Malaysian bank into a worker's TNG eWallet via a DuitNow account number assigned to each verified user.

Poolside AI struck a non-exclusive licensing deal with Nvidia worth $6 billion plus a $1 billion investment at a $12 billion pre-money valuation, with 109 of Poolside's ~115 technical employees moving to Nvidia while founders remain. Poolside lost a 40,000 GB300 cluster deal after failing to raise $2 billion in a 6-week window late last year, and concluded that next year's frontier model compute requirements need clusters an order of magnitude larger—constrained not just by capital but by physical data center space.

Article URL: https://sockpuppet.org/blog/2026/08/20/stop-making-tuis/ Comments URL: https://news.ycombinator.com/item?id=49384210 Points: 384 # Comments: 502

Cisco disclosed five vulnerabilities in Secure Workload Software (formerly Tetration), a micro-segmentation tool, with CVSS scores of 10, 10, 9.9, 9.6, and 7.5. SaaS users must update Agent and Connector tools; on-prem users on 3.10 or earlier need 3.10.9.1, and 4.0+ users need 4.0.4.16. Cisco found the bugs through an internal review that used 'frontier AI models,' possibly referencing Project Glasswing access to Anthropic's Mythos model.

Article URL: https://www.xda-developers.com/japan-tried-build-operating-system-entire-world-us-government-intervened/ Comments URL: https://news.ycombinator.com/item?id=49384180 Points: 376 # Comments: 226

An AWS-commissioned study by Strand Partners reports 38% of Malaysian businesses now use at least one AI tool, up from 27% in 2025, totaling 3.4 million businesses. However, 67% remain at basic usage (public chatbots, ready-made tools), only 19% have a formal scaling strategy, and 57% primarily source AI capabilities externally—with 69% saying locally based software providers are important to their adoption.

Alibaba Cloud reported that its AI servers pay back their cost in 3 years and generate free cash flow in years 4-5, with 2018/2020-era Nvidia V100 and A100 machines still running near full capacity. The company plans to shorten payback to 2.5 years by increasing the proportion of self-developed chips in its data centers, replacing commercially purchased chips. Over 650 external customers now use Alibaba's own chips, and Q1 capex hit $10B, up 75% year-over-year, partly driven by anticipated AI agent adoption.

Charge+ has activated its first EV charging station in Sungai Petani, Kedah, at Murtadha Dakwah Centre (MADAD), a 24/7 community hub. The site offers a 40kW DC charger (RM1.25/kWh, two CCS2 nozzles) and two 22kW AC charge points (RM1.00/kWh), activatable via the Charge+ app or TNG eWallet's EV Charging mini programme, with a RM150 pre-authorisation hold.

CelcomDigi has commercialised Sophia AI, an agentic AI digital workforce for Malaysian SMEs, after deploying 400+ automations across its own operations. The product targets workflow orchestration in retail (invoice-to-payment), manufacturing (procurement, warehousing, finance), healthcare (appointments, claims, billing), and public sector, positioning itself as a no-large-tech-team-needed entry point for SMEs.

Supermicro fired staff across sales, technical support, and business development for failing to follow export compliance policies, after a probe into a $2.5 billion scheme to smuggle Nvidia GPU-packed servers to China. The company cleared its current senior management of knowledge of the diversion but admitted its compliance program was insufficient and is implementing board-recommended enhancements.

Article URL: https://annas-archive.gl/blog/physical-destruction.html Comments URL: https://news.ycombinator.com/item?id=49383026 Points: 608 # Comments: 892

MyDIGITAL Corporation and Pepper Labs signed an MoU at the AI-Ready Malaysia Summit 2026 (14 Aug 2026) to bring the Rakyat Digital national learning platform into Program Perumahan Rakyat (PPR) communities via Pepper Labs' Dapur Digital network, targeting up to 50,000 Malaysians. The partnership supports the National AI Action Plan 2026-2030 and uses a 3A approach (Awareness, Access, Adoption) to deliver AI and digital skills training in physical community spaces alongside online learning.

Mark Zuckerberg and Priscilla Chan have purchased Strancally Castle, a Gothic Revival property in County Waterford, Ireland, built in 1827 and bought from the Alen-Buckley family for an undisclosed price. The article notes Meta's existing presence in Ireland, where it has its international headquarters and roughly 1,500 employees.

Samsung Malaysia has confirmed a Galaxy Event on 27 August 2026 at 8pm MYT, expected to reveal the Galaxy S26 FE. Leaked specs include a deca-core Exynos 2500, 50MP/12MP/8MP triple camera, 4,900mAh battery with 45W charging, and a likely price increase over the S25 FE's RM3,099 starting price due to global RAM shortages.

Gamescom 2026 in Cologne is underway amid industry-wide layoffs, intensified competition, and a shift away from physical game discs. GTA VI's impending release is causing other studios to reshuffle their launch calendars to avoid direct competition, even though Rockstar isn't exhibiting at the show.

Nevada's Transportation Authority approved permits for Tesla (up to 5,000), Waymo (1,000), and Uber (1,000 via Motional and Zoox) to operate commercial robotaxis in Clark County/Las Vegas over the next 12 months. Tesla's Cybercab chief engineer Eric Early admitted they likely won't deploy more than ~2,500 vehicles in that timeframe, citing non-technology constraints.

Google's Threat Intelligence Group is tracking three suspected Russian cyber-spy groups (UNC6293, UNC7005, UNC5976) that have added OAuth phishing to their toolkit, targeting under 100 individuals per campaign in academia, aerospace, defense, government, and think tanks across Europe and the US. UNC6293, linked to APT29/Cozy Bear, now requests victims share either the full callback URL or the verification code after a legitimate OAuth login to an external provider, allowing attackers to hijack the token exchange without needing passwords.

Article URL: https://mathstodon.xyz/@maxpool/117128107757895678 Comments URL: https://news.ycombinator.com/item?id=49382041 Points: 189 # Comments: 209

AI data-labeling startup Micro1 grew its gross annual run rate from $100M to $500M in eight months, retaining 60-70% for a net run rate of $150M-$200M. The company hires domain experts on contract and is increasingly generating synthetic data (e.g., automated video descriptions) that can be resold to multiple customers at 80-90% gross margins. Founder Ali Ansari publicly stated Micro1 does not sell data to Chinese model makers, contrasting with competitors whose off-the-shelf data sales to Chinese developers have drawn criticism, citing Kimi K3 as evidence of the risk.