AI Weekly Malaysia

The UK government has launched G-Cloud 15, a consolidated public sector cloud procurement framework valued at an estimated £14B over four years (~£3B annually), with roughly 90% of awarded supplier places going to SMEs. The framework merges three previous agreements into one marketplace and introduces a modernized classification system to help smaller firms without dedicated bid teams appear in relevant buyer searches, though AWS and Azure still hold ~80% of the UK cloud infrastructure market.

Attackers are actively exploiting CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw in Broadcom VMware vCenter, with 361 victim IPs across 47 countries as of August 2026. Patches were released by Broadcom in late July 2026, and exploitation began within days of disclosure, using reverse_ssh via cron jobs for persistent remote access. QUIRSO attributes the campaign to a suspected APT actor.

Two undersea cables were damaged off the coast of Perth, Australia, following suspicious vessel activity. A company CEO noted the faults occurred 'straight after each other and in close proximity,' suggesting possible deliberate sabotage rather than accidental anchor drags.

Norway's $2.34 trillion sovereign wealth fund reported a record $182 billion half-year profit, driven largely by Asian tech stock rallies, and disclosed for the first time a 0.05% SpaceX stake worth ~$1.2 billion. Its larger holdings include 1.3% of Nvidia ($61.8B) and 1.2% of Apple ($52.7B).

Two malicious LiteLLM releases (versions 1.82.7 and 1.82.8) were live on PyPI for ~40 minutes on March 24, 2026, containing credential-stealing code that harvested cloud keys, SSH keys, Kubernetes tokens, and database passwords. CloudSEK obtained ~434,000 captured files mapping potential exposure to 2,500+ organizations (including NVIDIA, Cisco, Deloitte, Volkswagen), and published a public lookup tool. The FBI warned in a July advisory that stolen credentials may be weaponized long after the initial compromise.

Toolstation replaced aging custom Linux PoS terminals across 550+ UK branches with ASUS NUCs running ChromeOS Flex, citing slow performance, inability to patch security vulnerabilities, and high support overhead. The sponsored case study describes the refresh as part of a broader estate update covering contact centers, warehouses, and distribution hubs.

SAP patched a maximum-severity flaw (CVE-2026-58231, CVSS 10.0) in Commerce Cloud's Data Hub Adapter allowing unauthenticated remote code execution via a default authentication client and insufficient input validation. SAP's August 2026 update also fixed three other critical vulnerabilities in Manufacturing Integration and Intelligence and Application Server ABAP for NetWeaver.

A new paper demonstrates a method to extract encrypted reasoning traces from frontier AI model APIs (Claude, GPT, Gemini) by replaying signed thinking blocks into weaker models from the same provider and prompting them to transcribe. The authors scanned ~7,000 public Claude Code/Codex sessions and found 62 unique API keys, 33 email addresses, 33 passwords, and other sensitive data—64 of which appeared exclusively inside reasoning blocks, not visible session output.

A researcher going by 'Chaotic Eclipse' has published a proof-of-concept called ShieldBreak that claims to fully bypass Microsoft's patch for CVE-2026-50656 (RoguePlanet), a race condition in the Microsoft Defender Malware Protection Engine (mpengine.dll) that can grant SYSTEM-level privileges. The PoC reportedly has a 100% success rate on Windows 11 25H2 and Windows Server 2025, with Windows 10 also vulnerable but untested. Microsoft says it is investigating the patch bypass claim.

LinkedIn CringeBot 3000 is a satirical web tool that generates parody LinkedIn 'thought leadership' posts from any topic, offering style presets like 'The Hot Take,' 'The Vulnerability Post,' and 'Proud to Announce.' It's essentially an LLM wrapper with curated prompt templates designed to mock common LinkedIn posting tropes.

Mark Pesce gave an AI agent SSH access to a 15-year-old device running ancient Arch Linux with a browser too old for modern encryption. Over three hours the agent failed to compile modern cURL, then found a fast math library that solved the CPU's lack of floating-point support, and got the device chatting via Telegram. He then used agents to revive a 12-year-old iMac Pro on Ubuntu, a 10-year-old VR PC, and an underpowered Surface Go, arguing that agents have made the cost of testing ideas nearly zero.

Malaysia's Ministry of Digital launched an upgraded Rakyat Digital portal consolidating government digital learning initiatives under a single account, with a programme starting 31 August 2026 giving 100,000 Malaysian youths aged 18-30 three months of free access to leading generative AI applications after completing selected learning modules. The first cohort of 25,000 begins 16 September 2026, with three more cohorts to follow.

Cisco has confirmed active exploitation of CVE-2026-20349 (CVSS 8.6), a high-severity denial-of-service vulnerability in Secure Firewall ASA and FTD Software. An unauthenticated remote attacker can send a crafted HTTP request to the Remote Access SSL VPN service on affected devices, causing them to reload. The flaw stems from insufficient error checking when processing HTTP requests and affects devices with IKEv2 Remote Access VPN, SSL-VPN, or Zero Trust Network Access enabled across ASA versions 9.16 through 9.24 and FTD versions 7.0 through 7.6.

OpenAI published two reports—an Enterprise Signals dashboard and a working paper—claiming enterprises are shifting from using ChatGPT for Q&A to executing agentic workflows, with 'frontier firms' adopting plugins, skills, and agents more broadly. Early-career employees reportedly use AI more than senior staff.

Koray Kavukcuoglu, previously DeepMind's CTO and Google's chief AI architect, is replacing cofounder Demis Hassabis as SVP of DeepMind, reporting directly to Sundar Pichai. He inherits oversight of Gemini model development, frontier AI research, and the Gemini app and developer teams, with Google having not released a frontier model since early 2026 while OpenAI and Anthropic have advanced.

China blocked Meta's December 2025 acquisition of Manus AI, the Chinese agentic AI startup that claimed a $100M run rate and had moved its HQ to Singapore. Manus will resume independent operations and will delete all user data generated since December 29, 2025 on August 24, 2026 — users must download before then to restore it afterward.

llama.cpp launched an official website at llama.app with a one-line install script, package manager support (Brew, Winget), and a local coding agent workflow via the pi-llama plugin that auto-discovers your served model with no API keys or config. The site lists supported hardware ranging from Apple Silicon to H100 clusters and highlights models like Qwen 3.6, Gemma 4, GPT-OSS, and Gemma 3.

India's Yulu, a Bengaluru-based electric two-wheeler subscription startup, raised $93M in Series C funding ($63M equity led by GEF Capital, $30M debt) at a ~$170M post-money valuation. The startup rents e-bikes weekly to gig delivery drivers, powers 750,000+ deliveries daily with a 50,000-vehicle fleet, and plans to scale to 200,000 bikes over two years, with 95% of revenue from gig-worker rentals.

Malaysia is positioning itself as a regional green investment destination ahead of COP31 in Antalya, Türkiye. Key milestones include the third NDC submitted in October 2025 with an economy-wide absolute emissions target (peak by ~2030, reduce 15-30 million tonnes CO₂e by 2035), the National Carbon Market Policy launched earlier this year, and Budget 2026 signalling carbon pricing for selected sectors. The National Climate Change Bill (RUUPIN) and Climate Change Authority Bill are in final preparation for Parliament.

A sponsored article by Holistic Enterprise argues Singapore SMEs should treat business loans as proactive growth tools rather than reactive lifelines. It frames the core cash flow problem as a timing mismatch—60-day client payment terms versus upfront supplier demands—and suggests arranging credit facilities before they're needed to negotiate better terms.

Malaysia's MyGOV AI chatbot relaunched in early August 2026 with agentic AI capabilities, nearly a year after the original was shut down for factual errors (e.g., calling Communications Minister Fahmi Fadzil a former Johor Menteri Besar). The new version can retrieve personal government records—JPJ and PDRM summons, passport expiry, travel restrictions, and unclaimed monies—after requesting IC number permission, though the title indicates it still gets some answers wrong.

Reserve Bank of India governor Sanjay Malhotra urged banks to use AI to approve loans for underbanked groups like gig workers and first-time borrowers by analyzing alternative data such as GST filings, utility payments, and digital footprints. He also advocated for AI voice interfaces in local languages to improve financial inclusion and early warning systems for default risk.

Google CEO Sundar Pichai announced Gemini has surpassed one billion monthly users, making it Google's fastest-growing product and the 14th to reach that milestone. The announcement coincides with a significant reorganization of Google's AI division, with Demis Hassabis stepping back and other researchers departing, while competitors have released more advanced models.

The CFTC invoked emergency authority to order prediction-market platform Kalshi to continue operating in New York, citing market stability concerns. The press release is a regulatory action by a US commodities regulator over a specific US-based trading venue.

A fake Wi-Fi hotspot attack was reportedly carried out on a Delta flight, with attendees of the DEF CON hacking conference suspected to be involved. The article text itself was not captured—only the headline and cookie consent boilerplate are available.