AI Weekly Malaysia

Google patched 230 Chrome vulnerabilities including CVE-2026-87491, an actively exploited out-of-bounds write in the V8 engine allowing arbitrary code execution inside the sandbox via a crafted HTML page, fixed in Chrome 153.0.8010.36. This is the seventh actively exploited Chrome zero-day patched in 2026. Notably, one of the other patched bugs (CVE-2026-87639, a use-after-free in WebPackaging) was credited to OpenAI Codex Security, suggesting AI-assisted vulnerability discovery.

Switzerland's Federal Chancellery plans to offer a browser-based FOSS workplace suite (openDesk from Germany's ZenDIS) to 3,000 of its 47,000 federal employees by end of 2027, costing CHF 9 million in its first phase. This follows a 172-user proof-of-concept (BOSS) that explicitly scoped the suite as NOT a Microsoft 365 replacement, NOT 1:1 functional, and NOT fully M365-compatible — managing expectations that perfect fidelity is impossible. For context, the Swiss federal government has spent CHF 1.1 billion on Microsoft licenses.

OpenAI claims a system of ~10,000 concurrent coordinating agents, powered by an internal AI model, produced a solution to the Navier-Stokes Millennium Prize problem in 88 hours. The agents were subdivided into groups with intra-group communication, cached internet access, and code execution. NYU mathematics professor Tristan Buckmaster has raised questions about the work.

cPanel patched CVE-2026-67401, an SQL injection flaw in the EmailTrack module that lets any authenticated hosting account with mail privileges create arbitrary files and escalate to root access on the entire server. Every supported cPanel/WHM version is affected; fixed builds are 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, and WP Squared 11.138.1.9. The advisory does not provide a mitigation for servers that cannot upgrade immediately.

Bloomberg's Mark Gurman reports Apple's foldable iPhone will be called iPhone Duo, not iPhone Ultra, with a base 256GB model at USD 2,000 (~RM8,136) and a 2TB variant at USD 3,000 (~RM12,204). The device features an A20 Pro chip, Apple C2 modem, magnetic hinge, and notably supports Apple Pencil—countering Samsung's decision to drop S Pen support from its foldable lineup.

Sophos published analysis on September 7, 2026 revealing that malware targeting F5 BIG-IP APM appliances injects a PHP web shell directly into Apache's memory at runtime, modifying three specific scripts (apm_css.php3, full_wt.php3, webtop_popup_css.php3) only in-memory so disk-based file integrity checks return clean. The malware is linked to CVE-2025-53521, which F5 initially rated as denial-of-service in October 2025 but reclassified as a 9.8 CVSS remote code execution flaw on March 27, 2026 after discovering active exploitation; CISA added it to its Known Exploited Vulnerabilities catalog the same day.

Security researcher Chaotic Eclipse released a proof-of-concept for 'ShieldCrash,' a patch bypass for Microsoft Defender vulnerability CVE-2026-69414 (CVSS 7.8, dubbed ShieldBreak). The PoC demonstrates arbitrary file read as SYSTEM on fully patched Windows desktops; the fix ships in Malware Protection Engine version 1.1.26080.3, which updates automatically and requires no customer action.

Microsoft's Edge team reports that AI-assisted coding has caused extension submission volumes to surge, overwhelming their manual review pipeline and increasing turnaround times—especially as staff cuts have reduced reviewer headcount. Their response is automating repeatable validation checks to flag policy violations and security issues, letting human reviewers focus on complex cases.

The GrapheneOS project account posted on Mastodon that copyright does more harm than good and should be abolished. The provided text contains only the post title and fragments of replies, with no substantive argument or evidence included.

SAP patched CVE-2026-44756 (CVSS 10.0), a memory corruption flaw in SAP Extended Passport (EPP) kernel processing dubbed OVERPASS, enabling unauthenticated remote code execution with SAP admin privileges. The flaw is reachable via web, SAP GUI, and RFC layers without credentials, allowing attackers to read the SAP secure store, recover database credentials, and move laterally across SAP systems.

Apple is expected to unveil the iPhone 18 Pro, iPhone 18 Pro Max, and its first foldable iPhone ('Ultra') at a keynote on 10th September. Accessory makers dbrand and Spigen have already published case designs, giving an early look at the physical form factors.

Federico Felici and Jonas Buchli, who previously worked at Google DeepMind, founded Lausanne-based Fusionality in 2026 to build control systems for fusion reactors. They raised a $3.7 million pre-seed from Founderful and Playfair, targeting the 80% of control system functionality that fusion companies currently build from scratch.

The Philippines government released its AI+ Infrastructure Masterplan (PAIIM), targeting $34.4 billion in investment to grow national datacenter capacity from 50MW to 1.5GW by 2033, housing ~152,000 GPUs. The plan explicitly positions the country against Singapore and Thailand as a regional AI hub but omits Malaysia, despite the article noting Johor already has nearly 4GW of datacenter projects in place.

SkyGate NHJ Technology Sdn Bhd, a JV between Penang-based SkyGate Solutions and Singapore-based NJH (wholly owned by Suzhou New Hongji Precision Part Co Ltd), opened a 36,000 sq ft precision manufacturing facility in Perai Free Industrial Zone, Penang. The facility focuses on digitalised CNC manufacturing, five-axis machining, and automation, serving semiconductors, electronics, medical, optical, and aerospace sectors. MIDA and Penang's CM positioned it as tech transfer and high-skilled job creation aligned with the New Industrial Master Plan 2030.

Accessory makers dbrand and Spigen have published case listings and renders for the iPhone 18 Pro, iPhone 18 Pro Max, and Apple's first foldable iPhone 'Ultra' just ahead of Apple's 'Surprise and Shine' keynote at 1am on 10th September Malaysian Time. The foldable features a raised rectangular dual-camera module with rounded corners, and cases cover front, rear, and spine. This is Apple's first iPhone keynote under new CEO John Ternus after Tim Cook's departure, with a global RAM shortage expected to raise starting prices.

OpenAI announced an AI-assisted solution to the Navier-Stokes Millennium Prize Problem, produced by ~10,000 agents collaborating over 88 hours using a next-generation model beyond GPT-6 Astra, consuming 130B tokens at a cost exceeding $40M. Ethan Knight indicated OpenAI spent the past year training models to collaborate via multi-agent RL, with hard problems yielding to massive unstructured parallel test-time compute. The result—a finite-time singularity/blow-up finding—still awaits formal mathematical acceptance, though OpenAI and authors assert the achievement is real.

Microsoft's September 2026 Patch Tuesday set a record with 974 vulnerabilities patched (999 including non-Microsoft CVEs), including two actively exploited Windows zero-days: CVE-2026-85880 (heap-based buffer overflow in Windows ALPC, CVSS 7.8) and CVE-2026-81963 (improper link resolution in Windows Update Stack, CVSS 7.8), both allowing local privilege escalation to SYSTEM. Over 110 flaws were rated critical, with privilege escalation, RCE, and information disclosure accounting for ~90% of patches.

CISA added CVE-2026-86218 (CVSS 10.0), a pre-auth static code injection RCE in N-able N-central, to its Known Exploited Vulnerabilities catalog after active exploitation was confirmed. The flaw was patched in N-central 2026.3 Hotfix 4 (released September 5, 2026), while two related auth-bypass vulnerabilities (CVE-2026-86206 and CVE-2026-86207) were fixed the same day in Hotfix 3. Huntress reported a compromised fully-patched N-central production environment on September 4 but could not confirm which specific CVE was used due to limited appliance logging.

Acer announced the Predator Atlas 7 (PA07-151), a 7-inch Windows 11 gaming handheld at IFA 2026, featuring up to Intel Arc G3 Extreme graphics with Xe3 architecture, XeSS 3 AI upscaling, up to 24GB LPDDR5x RAM, a 1080p 120Hz display, optional TMR anti-drift joysticks, and up to an 80Wh battery at 700-750g.

UK-based CloudNC raised a $20M Series B extension, bringing lifetime funding to $128M. Its CAM Assist software plugs into traditional CAM systems like Autodesk Fusion and Mastercam to auto-generate CNC machining strategies—selecting tools, approach directions, feeds/speeds, and drafting machine code—while leaving final review and approval to the machinist.

The NSA, FBI, and CISA issued a joint advisory alleging that DeepSeek, Alibaba, Moonshot AI, MiniMax, StepFun, and Z.AI use distillation as their core AI development strategy, extracting capabilities from US frontier models via APIs, third-party aggregators, and proxy 'transfer stations' that bypass geographic restrictions and terms of use. The advisory claims China's government is 'likely' aware of these campaigns.

American cinnamon roll chain Cinnabon will close its last Singapore outlet at ION Orchard on Sept 22 after 3.5 years in the country. The closure follows the earlier shutdown of its Raffles City and Jewel Changi outlets, and comes amid a broader wave of dessert and patisserie closures in Singapore.

Nintendo announced a Switch 2-exclusive remake of 'Zelda: Ocarina of Time' releasing November 5, alongside a commemorative Switch 2 Zelda edition with Pro Controller and case, an electric ocarina, and details about an upcoming Zelda movie. The announcement came during a Nintendo Direct streamed for the franchise's 40th anniversary.

Jacob Coxon announced his resignation from Anthropic, claiming he spent three years doing pretraining research at both OpenAI and Anthropic and that neither company is acting responsibly. He alleges both labs are racing toward self-improving superintelligence, that senior researchers privately express fear of civilizational risk, and that Anthropic is locked in a race dynamic despite understanding the stakes. He references a 'Hugging Face attack' as a warning shot that has made pacing agreements more viable.

Microsoft shipped a record 974 CVEs in September 2026 Patch Tuesday, including two zero-days already under exploitation—most notably CVE-2026-85880, a Windows ALPC privilege escalation allowing sandbox escape to SYSTEM. Separately, Adobe disclosed CVE-2026-75650 ('StyleSmuggler'), a max-severity unauthenticated RCE in Magento and Adobe Commerce (versions 2.4.4 through 2.4.9), actively exploited since September 4 to install backdoors connecting to C2 servers.