AI Weekly Malaysia

Microsoft says China state-aligned hackers breached ConnectWise's cloud backup service, stole application credentials used for customer data links, and accessed Microsoft-hosted email and files at around 2,250 organizations. The attackers used AI agents, including the open-source ARTEX framework, to attempt nearly 3,000 sign-ins per minute, and the same tooling was used in a recent compromise of South Korea's financial systems. ConnectWise has paused access to its cloud backup system and says it is investigating and restoring the service.

The supplied page body contains no article content — only Ars Technica's privacy-center and cookie-consent boilerplate. The only substantive information is the headline and URL slug, which state that a US-backed vaccine trial on babies was formally canceled after international outcry. No trial name, sponsor, location, dates, participant numbers, or stated reasons appear in the text.

CNBC reports two critical PHP vulnerabilities collectively called “PHP2Shell” that could let attackers remotely execute malicious code on affected servers. Governments issued urgent warnings, and Google, OpenAI and Amazon were involved in finding flaws and protecting systems. Amazon detected exploitation attempts before public disclosure but said it is unclear how attackers obtained information about the flaws.

CNBC reports that two PHP vulnerabilities dubbed 'PHP2Shell' led European government websites to be taken offline on Wednesday and prompted the U.S. NSA to tell millions of organizations to patch immediately or take servers offline. The article does not include CVE IDs, affected PHP versions, or patch links, but says AI-augmented attackers can now exploit flaws in hours rather than weeks or months.

A $470,000 shipment of Nvidia RTX 5090 GPUs stolen at a Brazil airport has appeared for sale online, with units identified by serial numbers. Police identified three employees who helped steal the equipment, according to Tom's Hardware.

The Hacker News headline reports that Meta has been ordered to pay $25 billion after a court found 43 million privacy violations. Beyond the headline, the supplied page content is almost entirely site navigation and boilerplate — it does not include the jurisdiction, the specific law broken, which user data or consent mechanism was at issue, or the court's reasoning.

Ai2 released OlmoEarth v1.3, a satellite embedding model that turns a year of Sentinel-1 radar plus Sentinel-2 and Landsat multispectral time series into one 128-dimensional vector per 10-meter pixel, with a 64-dimensional version also usable. Ai2 precomputed annual embeddings for the entire planet and published them on Source Cooperative, alongside a no-sign-in browser Embeddings Explorer for exploring and customizing maps. Across 27 evaluations on six continents against AlphaEarth Foundations and Tessera v2, the 128-dim embeddings ranked highest on 20 of 27 evals and the 64-dim version on 18 of 27; the release also introduces PLANTEUR, a tropical crop-type benchmark.

ModelCompare asked 12 AI models from ten labs in three countries for their most controversial opinion of humans, three times each; 29 of 35 answers converged on the same take: humans prioritize belonging/group loyalty over truth. Seven of the 12 models gave that answer every time, while the Hacker News thread drew 400 points and 411 comments.

Uber is expanding ChatGPT Work — OpenAI's enterprise AI agent introduced in July — from a 1,000-employee pilot to its entire ~30,000-person global workforce. About 80% of early adopters were non-engineers in finance, operations, and product, using it for operations data analysis, localizing training materials across markets and languages, and building personal dashboards. Uber also ran "AI pods" — 30 AI engineers embedded with teams for two weeks to automate parts of their jobs — and declined to disclose rollout spend, saying it will track usage and workflows before judging outcomes.

TechCrunch's recap of its 2026 Startup Battlefield 200: 200 startups were picked from 'thousands' of applications and pitched over three days, with Intero Biosystems winning the $100,000 equity-free prize and the Disrupt Cup, and Apate named runner-up. The piece is mostly a list of showcase-stage honorees — Lola Vision Systems (sensor fusion/real-time inference), Krokos Bio (saffron), Rein Security (security layer for custom enterprise agents), Lumai (optical compute for inference), Uhura Bionics (bionic larynx), Maka (AI kids' shows) and Legali AI (AI legal companion) — with no funding amounts, pricing, benchmarks or technical detail beyond one-line descriptions.

The fetched page contains only Ars Technica's cookie-consent and privacy boilerplate — no article body about the Virtual Boy emulator, its color-rendering approach, hardware requirements, release date, or price. The title indicates an emulator that reimagines Nintendo's Virtual Boy with a full-color display, published 2026-10-22, but none of the technical or practical details are present in the supplied text. There is nothing here to summarize beyond the headline.

ChargEV has activated 60kW DC chargers with two CCS2 nozzles at Lexus Subang Jaya in Selangor and Toyota Autocity Ayer Keroh in Melaka, priced at RM1.30 per kWh and accessible via ChargEV, JomCharge, and Gentari Go. UMWT plans 42 public EV charging points across 21 locations in phases during H1 2027, with 38 points at 19 locations run by ChargEV and 4 points at 2 locations run by JomCharge; seven sites are completed so far. A 20% first-three-days promo uses code LXSUB26 until 11pm on 23 October for Lexus Subang Jaya and TYTAK26 until 11pm on 24 October for Toyota Ayer Keroh.

Tesla said on its Q3 2026 earnings call that it will expand its Cybercab robotaxi service from Austin to Dallas next month, with more cities by the end of 2026, and will begin selling Cybercabs to fleet operators before year-end. CFO Vaibhav Taneja framed the ambition as owning 'transportation of any kind on Earth,' while the company gave no revenue figures for the robotaxi business; Elon Musk said it won't be visible in overall financials until Q2 2027 and could be 'a big deal by Q3 or Q4 of next year.' Tesla already runs Model Y robotaxis in small fleets in Dallas, Houston, Miami, Orlando, and Tampa, against Waymo's 4,000-plus vehicles across more than a dozen US cities.

This is a single-sentence quotation collected by Simon Willison on 22 October 2026, attributed to Armin Ronacher: "As fun as AI is, we built so much bad software over the last 30 years, and now the universe is punishing us for our sins." The post contains no further argument, examples, incident details, or technical specifics — just the line, a sponsor note for Teleport about monitoring AI agents in ephemeral runtimes, and site navigation links.

A project called HackiOS (by OOSEX GANG) boots Apple's open-source XNU kernel — xnu-8796.121.2, the kernel from iOS 16.5 — on Android phone hardware and runs the unmodified iOS 16.5 user space on top: launchd → backboardd → SpringBoard → apps. It targets a POCO X5 Pro 5G (Snapdragon 778G), where the UEFI is launched via `fastboot boot` and the whole system lives in RAM, so a reboot returns the phone to Android, and it also runs under QEMU aarch64 on any Linux machine. The repo contains XNU patches, an EFI loader, a UEFI port, a Linux Wi-Fi driver on a compatibility layer, and QEMU scripts; the companion repo holds init, injected libraries, and the APFS image builder. Working: lock screen, home screen, gestures, Settings/Clock/Calendar/Photos/Notes/Safari. Not working: cellular, Bluetooth, and charging under their kernel.

The supplied page contains no article body — only Ars Technica's cookie consent and privacy-center boilerplate. The title claims attackers had a four-day head start exploiting a vulnerability dubbed "PHP2Shell," published 2026-10-22, but no version numbers, affected software, CVE, patch dates, exploitation details, or victim counts appear in the text. Nothing beyond the headline can be verified from this source.

On Spotify's Q3 2026 earnings call, co-CEO Alex Norström confirmed a new Family Plan verification step: members get a QR code prompt and must scan a code displayed on the plan manager's phone within seven days to prove they live together. Missing the window blocks them from joining another Family or Duo plan for 12 months, pushing them onto a self-paid individual plan; Norström framed it as a 'routine improvement' to verification rather than a crackdown, noting Family Plan has existed for roughly 12–13 years and is a significant share of subscribers.

At TechCrunch Disrupt, three investors — Shailendra Singh (Peak XV), Jahanvi Sardana (Index Ventures) and Jenelle Teng Wade (Bessemer) — described a Series A market Singh called 'never... as dysfunctional as it is now,' with a correction possibly arriving as soon as 2027. Concrete symptoms they named: startups closing a single round at as many as three different prices at once, and rounds split into tranches, which Sardana dubbed 'tranchopalooza.' Teng Wade said capital is flowing into defense, robotics and AI infrastructure, with foundation-model companies vertically integrating but room remaining for 'neo-clouds' renting out AI compute and 'neo-labs' doing AI research; the excerpt cuts off mid-sentence on metrics.

Spotify reported Q3 results with 788 million monthly active users and nearly €5 billion (around $5.6 billion USD) in revenue. Co-CEO Gustav Söderström said agents are a tailwind because entertainment is not a chore users want summarized, and Spotify aims to be the media service agents call. Spotify says it was the first music service to integrate with Meta's Muse assistant and also integrates with ChatGPT and Claude, with good adoption inside those agents.

Helion received a three-year, $175M Department of Commerce award under the CHIPS Act to develop and manufacture advanced semiconductors and power electronics for its fusion plants. The devices currently lose 5%–10% of electricity, and CEO David Kirtley says halving that loss could double fusion output. Helion plans an automated module, packaging, and testing line in Washington State—described as the first U.S. line for this semiconductor class—while targeting its Orion plant and a 2028 Microsoft electricity deadline.

Quad9 will stop offering its free recursive DNS service to users in France on November 24, after a French court ruled in favor of beIN and required Quad9 to block DNS resolution for domain names linked to alleged sports broadcast copyright infringement. The court reduced the penalty from €580,000 to €1,000 per day, but Quad9 says compliance is technically unfeasible and conflicts with its neutral-DNS mission.

The supplied page content contains only Condé Nast/Ars Technica consent-management boilerplate (opt-out toggles, cookie categories, and a privacy email/phone number) — no trailer details, cast names, release date, or plot information are present. The only substantive item is the headline and URL, which indicate an Ars Technica culture piece about a Rings of Power season 3 trailer featuring Sauron recruiting future Ringwraiths. Nothing in the text can be summarized without inventing details.

pwn.watch is a live security incident dashboard that currently lists 42 active incidents—19 critical and 21 not fully patched—against 241 incidents in the last 12 months, with zero days without an incident and a longest quiet run of 11 days (Jan 2–Jan 12). It publishes machine-readable feeds (RSS, JSON, llms.txt) and a 'Copy brief for your AI' feature, and its example entry is an actively exploited Arista VeloCloud Orchestrator SQL injection (CVE-2026-114625, CVSS 9.9) that has been patched.

Sony Japan has marked its last standalone 4K Blu-ray player as discontinued, leaving the PlayStation 5 as the only Blu-ray player in Sony's lineup. The excerpt gives no model name, price, or replacement plan; it is a consumer hardware lineup change, not a developer or AI announcement.

Anekha Sokhal, CEO of Moshi, describes building a recommendation engine for traders that combines market data, an interface, and tailored recommendations — framed as 'Bloomberg, Claude and Netflix had a baby.' The conversation covers her path from mathematics and JPMorgan energy derivatives to founding Moshi, plus build-vs-buy decisions for models and document extraction (she cites Reducto) and the pressure on AI engineers told 'you are the team.' She also notes extending her New York stay to take customer meetings in energy and Houston before hiring.