AI Weekly Malaysia

MultiverseComputingCAI introduces Quantization-Aware Healing (QAH), applied to a GPT-OSS 120B model compressed to 60B parameters and quantized to MXFP4. The resulting 4-bit model beats its own bfloat16 original on 7 of 9 benchmarks, inverting the usual tradeoff where quantization degrades reasoning, math, and code generation. The paper critiques standard quantization-aware training (QAT) as costly and unstable, positioning QAD (quantization-aware distillation) as an alternative that avoids re-running expensive post-training pipelines.

Security researchers have documented the first in-the-wild use of FTP server welcome banners as dead drop resolvers to deliver two new RATs called E4del and PINHOLE. E4del is a Node.js-based RAT hidden inside a digitally signed Electron app masquerading as Discord, delivered via a multi-stage chain involving Spanish-language voucher lures, LNK files, WebDAV, and PowerShell.

Microsoft's August 11, 2026 .NET Framework cumulative update broke WPF printing and PDF/XPS generation, causing a System.IO.FileFormatException when content uses certain fonts including Calibri. The bug affects Windows 10, 11, and Windows Server 2012 through 2025. Microsoft's workaround—enabling Switch.MS.Internal.TtfDelta.DisableCmapAndSbitOverflowProtection in app config—disables security protections introduced in the same update, forcing a tradeoff between printing functionality and security.

OpenAI banned a cluster of ChatGPT accounts originating in Russia that were used in a covert influence campaign, discovered after investigating AI-generated social media posts that led to a broader operation. The campaign used a website with misattributed academic work and a 'sovereignty' index favoring Russia, with operators using VPNs to bypass OpenAI's Russia access restrictions. This follows a February incident where OpenAI shut accounts linked to Rybar, a pro-Russia media company described by the UK as partially coordinated by the Russian Presidential Administration.

Seagate's 8TB Barracuda HDD is $30 off at Best Buy, hitting its lowest price since April. The article is a retail deal alert with no technical analysis or broader market context.

This opinion piece argues that 'Frontier AI' models like Anthropic's Mythos can identify zero-day flaws and chain complex exploits, forcing vulnerability management programs to overhaul themselves. It advocates moving beyond CVSS, EPSS, and CISA KEV scores toward a CTEM-style (Continuous Threat and Exposure Management) program, and calls for vulnerability and patch management teams to stop operating in silos.

An AI coder using GPT-5.6 Sol designed a custom CPU within Turing Complete's sandbox environment and successfully ran Doom on it, with the game viewport overlaid on a live pulsing schematic of the CPU. The article itself is mostly navigation boilerplate with no further technical detail beyond the headline.

Tom's Hardware reviews the Asus ROG Strix B850-F Gaming Wifi Neo motherboard, a B850 refresh board priced at nearly $320. It is feature-packed but the price encroaches on X870 territory, making it a questionable value proposition.

A resurfaced 1995 press release shows 1GB of RAM cost $64,000 then, roughly $140,000 adjusted for inflation. The article argues PCs were 'brutally expensive' back then and suggests prices are heading back in that direction.

Tom's Hardware highlights a deal on the MSI Codex R2 pre-built gaming PC, now priced below $1,500 after a $500 discount. The system includes an Nvidia GeForce RTX 5070, a 20-core Intel CPU, 16GB DDR5 RAM, and a 1TB SSD, positioned as a 1440p-ready machine.

Xiaomi Malaysia is launching the Poco F9 Pro and Poco F9 Ultra on 1 September 2026 at 8:00 PM, positioned as affordable flagships expected to be global versions of China's Redmi K100 series. Specs include Snapdragon 8 Elite Gen 5 processors, 185Hz AMOLED displays, 200MP cameras, 9,070mAh batteries, and Bose-tuned audio. Freebies include a Poco Pad C1 for the Ultra and a Xiaomi Smart Band 10 for the Pro.

CISA added CVE-2026-21962, a CVSS 10.0 improper access control flaw in Oracle's HTTP Server and WebLogic Server Proxy Plug-in (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0) on Windows VMs, to its Known Exploited Vulnerability catalog with a three-day patching deadline. Oracle patched the bug in January 2026, but CISA only catalogued it seven months later despite honeypot evidence from CloudSEK showing active exploitation within days of disclosure.

SpaceXAI plans to deploy standalone Nvidia Vera CPUs for Grok's agentic workloads, using an optimized Vera Rubin NVL72 configuration aboard a Starmind satellite in space. The article text is almost entirely website boilerplate with no substantive technical detail beyond the headline.

A developer described as a Windows veteran built a cross-platform Task Manager app for Mac, Linux, and Windows by writing a 107-page specification and feeding it to Claude Code, Anthropic's AI coding agent. The app is downloadable and represents a notable example of 'vibe coding'—generating a shipping product from a detailed spec rather than hand-writing code.

A US Court of Appeals has rejected Xinuos's appeal, effectively ending a decades-long legal dispute over IBM's and Red Hat's use of Project Monterey UNIX code. The article text itself is almost entirely boilerplate with no substantive detail beyond the headline.

Ukraine's Ministry of Defence has brought into service the Alexa Spatium, a 1.5-by-1.7-meter v-tail jet-powered drone interceptor designed to destroy Russian kamikaze drones like the Geran-3/4/5 and Shahed-131. It launches from a mobile catapult, supports multiple warhead types (high-explosive, fragmentation, shaped-charge, thermobaric), and can return for reuse if a mission is not completed. Exact speed and ceiling remain undisclosed.

AliExpress allegedly runs hidden browser code that uses the audio system to fingerprint users' PCs, even when no sound is playing. The technique allows the platform to identify and track devices through audio-context data without user awareness.

BlackBerry CEO John Giamatteo told CNBC that robotics is one of the fastest-growing segments within its QNX software division, which provides safety-critical embedded OS software already running in 275 million vehicles. QNX carries roughly a $950 million royalty backlog, and Giamatteo positioned the division to capture growth in physical AI applications beyond automotive.

Attackers are buying sponsored Google search results for "OpenAI Codex" downloads and directing Mac developers to fake Google Sites pages that mimic OpenAI branding. Instead of an installer, victims are told to paste a Terminal command that looks like an npm install but decodes a Base64 URL, fetches a shell script, and downloads a universal Mach-O infostealer to /tmp/helper while stripping macOS security flags. Cato Networks found strong similarities to the Atomic macOS Stealer (AMOS) family.

Grab Malaysia launched a Women Only Rides Beta in March 2026, officially requiring Advance Booking with a 75-minute lead time, but SoyaCincau's hands-on test found the toggle also works for on-demand rides with sub-minute driver matching in Klang Valley. The feature pairs verified female passengers with female drivers, and also allows women travelling with boys aged 12 and under.

Two unauthenticated authentication bypass vulnerabilities (CVE-2026-15981 CVSS 9.8 and CVE-2026-61979 CVSS 8.1) in the Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin allow attackers to log in as any user, including admins. The root cause is a loose boolean check on PHP's openssl_verify(), which returns -1 on error but was treated as truthy (valid). Both are fixed in plugin versions 17.0.5 and 17.0.6 respectively, and active opportunistic scanning from six IP addresses is already underway.

HMRC is inviting suppliers to bid for a contract worth up to £500M to run and modernize the UK's National Insurance and PAYE System (NPS), a legacy estate with limited modularity that collects 40% of UK Treasury revenues. The contract could last up to seven years, with a tender notice expected in September 2026 and a start date of June 2027. NPS was first introduced in 2009 under the £10B Aspire contract with Accenture, Capgemini, Fujitsu, and BT.

This is a sponsored explainer arguing that organizations should rethink their virtualization operating model—workload placement, management, security, and governance across hybrid environments—rather than simply swapping hypervisors. It warns that lift-and-shift migrations preserve the same operational problems (provisioning, ticket queues, configuration drift, integration debt) without reducing complexity.

ARIA will exclude AI-generated music from its charts effective this week, adopting IFPI principles requiring that charted recordings be substantially human-made, use properly licensed AI tools, and carry consumer-facing AI disclosure labels. The move follows an AI-assisted cover of Madonna's 'Like a Prayer' reaching Australia's top ten, and was co-developed with Sony, Universal, and Warner Music Group.

OpenAI published first benchmark results for Jalapeño, its first custom inference chip, claiming it widens the lead over previous-best TBT (time between tokens) on the InferenceX public benchmark. Written by Sarah Friar, the piece frames OpenAI's strategy as a vertically integrated stack spanning data centers, chips, frontier models, developer platform, and consumer/enterprise products, where each layer reinforces the others.