AI Weekly Malaysia

F5 disclosed CVE-2026-94127, a CVSS 9.8 heap-based buffer overflow in BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution when APM is configured as an OAuth authorization server on the same virtual server as an access policy. CISA added it to its Known Exploited Vulnerabilities catalog on September 22, requiring federal agencies to apply mitigations by September 25. Engineering hotfixes are available for branches 21.1, 17.5, and 17.1; systems using APM only as an OAuth client or resource server are not affected.

A Chinese threat actor (UTA0565) exploited a Chrome-Windows zero-day chain (CVE-2026-85046, CVE-2026-87491 in Chrome; CVE-2026-85880 in Windows ALPC) via fake websites to break out of Chrome's sandbox and deploy CLEANGULP malware, which provides shell, process listing, file upload/download, and BOF execution. Attacks detected September 3-4, 2026 targeted Asian government entities through phishing emails impersonating NGOs and media outlets.

A CNBC analysis finds that three headline U.S.-China trade truce commitments—soybean purchases, Boeing aircraft orders, and rare earths access—are progressing at markedly different speeds ahead of a Trump-Xi summit in Washington on Thursday. Analysts describe the truce as driven by a 'balance of vulnerability' rather than genuine cooperation, with fulfillment fastest where it costs least.

TacnIQ.ai has raised US$1.5 million (RM6 million) from lead investor In Group Holdings, the first close of a US$3 million (RM12 million) pre-seed round, to build tactile AI foundation models, hire engineers and scale deployments. The company says its platform, which lets machines interpret signals from physical contact, is already deployed with paying customers across logistics, construction, e-commerce, hospitality and healthcare, and that it has collected over 5,000 hours of tactile interaction data from controlled experiments plus commercial sites. In Group Holdings CEO Liu Song framed physical AI as a next frontier; TacnIQ.ai co-founder and CEO Aashish Mehta said the money goes to hiring engineers and turning the technology into scalable industry applications.

Meta is expected to unveil new AI products at its Connect event, with Zuckerberg pushing agentic technology, including a consumer agentic app called Muse. The company also faces privacy scrutiny around its smart glasses and broader concerns over children's safety.

The submitted link points to a Reddit r/ClaudeAI thread titled "I am done with this shit," but the fetched page returned a 403 network-security block, so the actual post body is not available. The only hard data we have is the Hacker News discussion: 253 points and 199 comments on item 49812975. There is no retrievable technical detail, version number, price, or incident description in the text provided.

A parody post claiming to implement 'Jev' in 25 lines of Python, using llama-cpp-python with a Qwen3-0.6B GGUF model to do constrained multiple-choice classification by extracting logits for specific token labels (A, B, C) and computing softmax over just those choices. The author explicitly labels it a parody and links to real open implementations: OpenJev, openjev-sglang, and OpenJev on DiffusionGemma.

A critical RCE vulnerability (CVE-2026-94545, CVSS 9.5) in Next.js's ImageResponse feature allows attackers to execute server code via crafted SVG inputs when attacker-controlled values are passed into the image. The flaw affects Next.js 16.2.0 through 16.3.5 on the Node.js runtime and was fixed in version 16.3.6 on September 22, 2026.

Singapore-based Nexstrom raised a US$12M (RM49M) seed round led by Xora Innovation, with Foothill Ventures and SEEDS participating, bringing total capital to US$15M (RM61M). The company is building the first commercial platform for growing 12-inch single-crystal 2D semiconductor wafers, targeting production-ready manufacturing tools compatible with existing foundry workflows.

CTOS Digital Bhd detected unauthorized access to a specific part of its consumer business environment, with a limited set of consumer data compromised. The company contained the incident, engaged an independent investigation team, and confirmed no other systems were affected, though a subset of credit reporting services remains temporarily unavailable during remediation.

Anthropic launched Claude Opus 5.5, the first model in the Claude 5.5 family, matching Claude Fable 5.1 performance at 40% lower cost than Opus 5, while OpenAI's GPT-6 Sol and Luna launched 50% cheaper than GPT-5.6. However, Artificial Analysis reports Opus 5.5's per-task cost is nearly identical to Opus 5 ($5.98 vs $5.86) because token usage increased ~80%, offsetting the price cut. The system card also reports multi-agent scaling up to 100 parallel agents.

ShinyHunters claims to have breached the FBI by exploiting a new Oracle PeopleSoft zero-day RCE vulnerability, defacing FBIjobs.gov and allegedly stealing data on nearly all FBI agents and job applicants. The group says it targeted the FBI in retaliation for a May 2026 PSA about their attacks on Canvas LMS. FBI confirmed it is investigating unauthorized activity on FBIjobs.gov; no CVE has been published for the claimed PeopleSoft pre-auth RCE, though ShinyHunters previously weaponized a similar flaw (CVE-2026-35273) in June 2026.

Andreessen Horowitz founders Marc Andreessen and Ben Horowitz are backing the Horowitz Andreessen Academy (HAA), a two-year private school in San Francisco positioned as a college alternative focused on innovation and entrepreneurship. Applications are set to open, though the article cuts off before detailing curriculum, cost, or admissions criteria.

Malaysia's National Semiconductor Strategy (NSS), launched May 2024 with RM25 billion in fiscal support, has attracted over RM63 billion in investments within a year. The government targets 10 Malaysian companies reaching RM10 billion revenue from chip design and advanced packaging, plus 100 more approaching RM1 billion. The article profiles 8 companies including Inari Amertron, which holds RM2.14 billion in cash reserves and is pivoting from RF chip packaging for 5G phones into advanced packaging for AI server hardware.

Greek Prime Minister Kyriakos Mitsotakis visited San Francisco on a trade mission, touring Tesla and Sequoia Capital and pitching Greece as a destination for tech companies ahead of its expected upgrade to developed-market status by MSCI next year. Speaking to ~250 founders and investors, he openly admitted he doesn't have answers to many AI policy questions that world leaders are privately debating, framing the trip partly as fact-finding before heading to the UN General Assembly. He also highlighted that Greece's 10-year bond yield (~4.3%) is lower than U.S. Treasuries (~5%), though this partly reflects broader eurozone rate conditions.

A PSA posted to r/sysadmin warns that attempting to cancel a Grammarly subscription triggers messages sent to all users in the organization, described as 'unhinged.' The Reddit post is inaccessible (403), so details on the exact message content, scope, and affected plan types are unavailable.

Singapore's Ministry of Manpower data shows 12 industries lost over 10,300 jobs in H1 2026, with Food & Beverage (-3,400) and IT & Other Information Services (-1,700) hit hardest. The article notes AI has boosted local manufacturing and lifted GDP growth to 6%, but sectors like F&B, wholesale trade, and accommodation are shrinking, with F&B employment back to 2022 pandemic-era levels.

Discord is rolling out age verification starting Wednesday, using an ML model that classifies accounts as adult, teen, or unconfirmed based on behavioral signals like account tenure, device data, and activity patterns. Over 90% of users won't need biometric or ID checks; only flagged accounts will face that. The move follows a 2025 breach of a third-party verification vendor that exposed 70,000 users' government IDs and selfies.

Simon Willison and Jesse Vincent are hosting an informal 'agentic show-and-tell' evening in San Francisco on October 14th for builders working on coding agents. The session focuses on early-stage experiments, unfinished projects, and odd explorations rather than product pitches, encouraging participants to compare notes on what they're learning and what they haven't figured out yet.

Waymo announced a "transit rewards" program in the San Francisco Bay Area that pays riders $2.85 in Waymo Cash — the price of a San Francisco bus fare — when they link a Visa card and take a Waymo trip and public transit within two hours of each other. It covers all 27 Bay Area agencies that accept contactless Visa tap-to-pay, starts with employee access before a public rollout "in the coming weeks," and comes with a Caltrain partnership in which Waymo leases 40 dedicated station parking spaces for staged vehicles. Waymo says over 50% of riders in its most mature markets (San Francisco, Los Angeles, Phoenix) already use public transit; the HN thread drew 256 points and 337 comments.

OpenAI announced on September 23, 2026 that ChatGPT Ads is rolling out to seven new markets: Indonesia, Malaysia, the Philippines, Singapore, Thailand, Vietnam, and Taiwan, bringing the product to more than 60 countries after earlier APAC launches in Australia, New Zealand, Japan, South Korea, and India. Advertisers can buy through OpenAI's Ads Solutions team, agency partners (dentsu, Havas Media, Omnicom Media, Publicis Groupe, WPP), or self-service Ads Manager for eligible businesses. Ads appear only to Free and Go plan users; Plus, Pro, and Enterprise remain ad-free, and Shopee's Peggy Zhu is quoted saying the company is extending its ChatGPT Ads collaboration (previously launched in Brazil) to Southeast Asia and Taiwan.

OpenAI announced that Airbnb is expanding engineering and product team access to OpenAI frontier models including GPT-6 Astra, via OpenAI APIs and Amazon Bedrock. Airbnb claims its developers are shipping roughly 80% more features than a year ago and that Astra resolved a non-coding task in 3-4 passes versus 20+ with other models.

Anthropic launched the Claude Marketplace, consolidating 2,000+ connectors/plugins (Atlassian, Google, Microsoft, Notion, Salesforce), Claude-powered agents and products (Cursor, Harvey, Lovable, Snowflake, CrowdStrike, Legora), and consulting partners (Accenture, BCG, Deloitte) into a single directory. Teams can use committed Anthropic spend to buy marketplace products, and builders can list connectors via Model Context Protocol (MCP) and Agent Skills, or apply to list agents/products.

Anthropic's Claude Marketplace lets companies with an existing Anthropic commitment redirect part of that spend toward Snowflake and Vercel. The post highlights three customer examples: CodeRabbit expanded its Vercel plan, Power Digital grew Claude usage from ~12 engineers to 800+ people and expanded its Snowflake commitment, and ThoughtSpot uses Snowflake for its agentic analytics platform.

Anthropic announced a new life sciences research group and wet-lab, reporting that Claude autonomously discovered a novel enzyme system associated with non-coding DNA repeat arrays—reminiscent of CRISPR—using only high-level direction from scientists. The system is based on a reverse transcriptase from a jumbo phage; while the RT itself was previously known, Claude appears to be the first to identify the system's defining features, though its function remains unknown.