AI Weekly Malaysia

GitLab issued an out-of-schedule critical patch on August 17, 2026 for CVE-2026-19478 (CVSS 9.4), which lets unauthenticated attackers remotely modify or delete public projects and user data via a GraphQL directive on self-managed CE/EE installations. Affected versions span 18.2 through 19.2; fixes are in 19.2.4, 19.1.6, 19.0.8, and 18.11.11, but versions 18.2–18.10 receive no patch. A second high-severity CSRF flaw (CVE-2026-19650, CVSS 7.1) in the GraphQL multiplex handler is also fixed in the same release.

Responsible Statecraft reports that Israel created a fake think tank, likely as a deliberate attempt to manipulate AI chatbot outputs by seeding the web with sources that models like ChatGPT would treat as credible. The article details this as an emerging form of influence operation targeting LLM retrieval and citation behavior rather than human readers directly.

The article text is entirely cookie consent and privacy policy boilerplate from Ars Technica. No actual article content about the solar eclipse in Spain was provided.

Apple sent a new wave of mercenary spyware threat notifications on Friday to customers in 110 countries, and investigators at Access Now report a 30-40% spike in help requests compared to previous batches, calling it unprecedented. iVerify also confirmed an influx of notifications, and many users publicly reported receiving alerts over the weekend.

The article text was not captured — only Ars Technica's cookie consent boilerplate is present, with no substantive content about Flock, Wisconsin cities, or the shared camera network.

Stripe has reportedly finalized a deal to acquire OpenRouter, the most popular AI model gateway, for at least $7 billion — a 5x jump from OpenRouter's $1.3B post-money valuation just three months prior. Stripe CEO Patrick Collison has called metered pricing 'the native business model of the AI era,' and acquiring OpenRouter would give Stripe visibility into both money flow and token flow, positioning it as a tollbooth for AI consumption.

CNBC reports Nvidia shares closed around $225 for two consecutive sessions, recovering to mid-May levels after a difficult 2026. The article cites three reasons: reduced fears around Nvidia's customer financing, a new financing initiative for AI buildouts, and strong revenue growth at OpenAI and Anthropic suggesting sustained compute spend. Nvidia reports fiscal 2027 Q2 earnings on Aug 26.

The US Supreme Court rejected Verizon's attempt to reclaim a $47 million FCC fine. The article body was not captured—only the title and site cookie/privacy consent boilerplate are available.

Rick Manelius coins 'AI;DR' (AI; Didn't Read) as a social convention for ignoring unedited AI-generated text, arguing that if a sender won't review AI output, the reader shouldn't have to consume it. A commenter adds the concept of 'borrowed competence' — AI producing expert-looking output whose sender may not understand the underlying assumptions or execution difficulty.

Dharma-AI built a constraint-aware GPU allocator and benchmarked it against a FIFO scheduler across seven scenarios on identical hardware. GPU utilization rose by up to 33 percentage points and priority-weighted output rose by up to 105%, purely by changing the order of allocation decisions. The core problem is that batch-like workloads (training, batch inference, quantization) need contiguous uninterrupted GPU blocks while real-time inference is elastic and demand-driven, creating incompatible allocation shapes competing for the same GPUs in the same timestep.

Spotify launched Playlist Notes, letting users add text context to individual tracks, podcast episodes, and audiobooks in playlists they own or collaborate on. Editor Notes and Editor Profiles are also rolling out on major editorial playlists like Today's Top Hits and RapCaviar, but only in the U.S., Canada, U.K., Ireland, Australia, and New Zealand; user-created notes are available in 100+ markets on iOS and Android.

A CNBC reporter drove hundreds of miles comparing Tesla FSD (Supervised) and Rivian's new Autonomy+ system, concluding Rivian has surpassed legacy competitors like GM but still trails Tesla. Rivian's in-vehicle AI assistant launched May 12, 2026, and the company expects to deliver point-to-point driving later in 2026, positioning itself as a safety-guardrail alternative to Tesla's approach.

AI video generation startup Higgsfield raised a $400M Series B at a $5.4B valuation, up from $1.3B just eight months ago. The company reports $700M in annualized revenue, 30M users across 200 countries, and relationships with 390 of the Fortune 500, with enterprise video AI workflows as its fastest-growing segment.

Wiz researchers found a GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository, where the jira_issue.yml workflow inserted attacker-controlled issue titles and bodies directly into a shell run block, exposing internal Jira credentials (JIRA_API_TOKEN for qa@snowflake.net). The workflow's guard checked github.event.pull_request.user.login on an issue event, which evaluated to an empty string and failed to block the exploit. Wiz's Red Agent system autonomously exploited the injection after an initial syntax error, obtaining an out-of-band callback and the Jira token with read access to engineering, security compliance, and bug bounty projects. Snowflake fixed it the same day it was reported (June 23, 2026) by passing values as environment variables to jq instead of inline expansion.

Petlibro is accused of 'gaslighting' users over a smart pet feeder outage, per an Ars Technica report. The provided article text contains only cookie consent boilerplate, not the actual report details, so specifics about the outage, user impact, or Petlibro's response cannot be extracted.

Reddit is testing a new 'video Reddit' experience starting Monday, letting users 'play' select English-language posts as narrated audio or video instead of reading them, available on iOS and Android. CEO Steve Huffman framed it as Reddit reclaiming a content format already popular on TikTok and Reels, where creators narrate Reddit stories with text-to-speech. The test is limited to select communities and does not replace original text posts or comments.

Sonic Fire Tech raised a $15M round led by the O.H.I.O. Fund with Khosla Ventures participating, bringing total funding to $18.5M including a prior $3.5M seed. The Ohio-based startup uses infrasonic waves at ~20 Hz pumped through PVC ceiling pipes to suppress fires in seconds without water or chemical residue, and plans to pursue National Fire Protection Association approval, which typically takes about three years.

Siemens and Reinhausen are jointly developing a modular solid-state transformer (SST) that converts medium-voltage AC (up to 36 kV) directly into 800 VDC for high-density AI datacenter racks, reducing intermediate conversion stages. No commercial availability date was given. Nvidia separately plans its own 800 VDC power rack for the second half of 2026, citing that racks drawing 1 MW or more will require this shift.

A CVSS 9.8 unauthenticated remote code execution flaw (CVE-2026-15748) in the Forminator Forms WordPress plugin affects all versions through 1.56.1, across 600,000+ active installations. Exploitation requires a form containing both a File Upload and Select field; the handle_file_upload() function's extension blocklist is bypassed via pipe-alternative MIME type keys, and custom storage roots may lack the .htaccess PHP-execution guard present in the default upload directory. The fix shipped in version 1.56.2 on July 31, 2026.

The article title claims a hidden AirTag revealed Amazon is destroying rare books to train AI, but the provided article text contains only cookie consent boilerplate from Ars Technica—no substantive content is available to verify the claim or extract details.

YouTube will count a view as soon as a video starts playing or a user enters a live broadcast, effective August 24, replacing the previous ~30-second threshold. The old metric is preserved as 'Engaged views' in YouTube Analytics. The change aligns YouTube with TikTok and Instagram, and comes alongside higher monetization thresholds for new creators starting next year: 8,000 qualified watch hours or 20 million Shorts views in 90 days, up from 1,000 subscribers plus 4,000 watch hours or 10 million Shorts views.

Kaspersky reports new modules in the Cavern C2 framework, used by Iranian-linked group Cavern Manticore against Israeli entities. The toolkit now uses DNS A-record responses to switch between direct HTTPS and a Google Apps Script relay, and a module called HOLLOWGRAPH abuses Microsoft 365 calendar events via the Graph API as a covert two-way C2 channel, dating events to 2050 to avoid detection.

Qwen3.8 27B, an open-weights model from Alibaba released August 2026, scores 52 on the Artificial Analysis Intelligence Index v4.1.1, ranking #1 out of 135 models in its class (small open-weights, 4B–40B). It supports text and image input, has a 256k context window, is a reasoning model, and is licensed Apache 2.0 — but is notably verbose, generating 160M output tokens versus a class median of 43M.

Geekom admitted to shipping AMD mini PCs with malware-laced network drivers and has since removed the malicious package, issuing guidance for affected users. The incident is a supply chain compromise where the malware was embedded in official driver software shipped with the hardware.

A developer shares a multi-month update after migrating from Gmail to Fastmail, finding the switch successful. Key tactic: using subdomain addressing (e.g., newsletters@sub.domain.com) so Fastmail auto-files emails into matching folders without manual rules, which proved better than Gmail's auto-sorting. They also note Fastmail supports up to ~100 domains per account, and that freshly registered custom domains may get greylisted by recipient email providers.