AI Weekly Malaysia

Malaysia’s National Security Council (MKN) said on 22 Oct 2026 that civil servants using Waze for official duties will face disciplinary action, while Google Maps stays allowed because Waze Mobile Ltd is under Israeli jurisdiction and Google Maps is under US law. The public is not under a blanket ban, but MKN is encouraging Malaysians to uninstall Waze, citing granular location telemetry; Waze has rejected the security-risk claims.

CNBC's Morning Squawk newsletter for Oct 22, 2026 reports early trading volume "overwhelmingly to the downside," with futures declining, chip stocks under pressure again, Asia closing deep in the red and Europe broadly lower. Tesla's better-than-expected Q3 results failed to hold the stock up in premarket trading, with lower average car sales prices and a battery supply crunch weighing on revenue, and Musk warning the group is "not going to move the needle" on its Robotaxi fleet this quarter. Meta posted a sales beat and initially rallied after hours, then turned negative in premarket; the item also notes Meta offered Zuckerberg a new class of stock to stay in California for 8 years. The excerpt cuts off mid-sentence.

Tom's Hardware reports that the Atari VCS software store will close in February 2027, ending the retro console's storefront. An OS update is planned that removes the device's reliance on Atari servers and opens the platform up to homebrew development. The supplied excerpt contains only site navigation and subscription boilerplate, so no further concrete details (pricing, refunds, exact update date, hardware support window) are available in the text.

Ars Technica published a report dated 2026-10-22 with the headline claim that 333 Tor exit nodes were hijacked to intercept SSH traffic and retrieve plaintext email. The article body as supplied contains only Condé Nast consent and cookie-preference boilerplate, so no specifics — which operators, which time window, how the interception worked, or what researchers found — are available in the text. Only the headline facts (333 nodes, SSH interception, plaintext email exposure) can be stated with confidence.

Tom's Hardware reports that EA is closing BioWare, the studio behind Mass Effect and Dragon Age, after more than 30 years of operation, and that early development of the next Mass Effect game has been killed. The item as supplied is essentially the headline plus page navigation boilerplate: it contains no stated reason for the closure, no headcount, no timeline, and no sourcing beyond the outlet itself.

Oppo launched the Find X10 and Find X10 Pro Max in Malaysia at RM4,599 (12GB+256GB), RM4,999 (12GB+512GB) and RM6,999 for the Pro Max (16GB+512GB). Both run MediaTek Dimensity 9600-series chips with an 8,000mAh battery and ColorOS 17; the Pro Max is described as the first phone with three 200MP rear cameras, and an optional Hasselblad Teleconverter kit gives 10x optical zoom. Pre-orders run to 29 October 2026, with Pro Max pre-orders bundled with a Bambu Lab A1 Mini 3D printer worth RM1,249 and the base model getting a free storage upgrade to 512GB.

The Hacker News reports that Railway — a developer platform used to deploy apps and databases — says an intruder may have accessed customer secrets and is telling users to rotate credentials. The published item carries only a headline and timestamp (22 Oct 2026); the body text did not come through, so there are no details on the intrusion window, how access occurred, how many customers or projects were affected, or which secret types (env vars, deploy keys, database URLs) were exposed.

The supplied text contains only Ars Technica's Condé Nast consent-management boilerplate (cookie toggles, state-level opt-out lists, and a privacy email/phone line) — none of the article body about the UN's 1.5° C warming report survived extraction. The title claims the UN now accepts that 1.5° C will be exceeded and offers a 'now what' framing, but there are no figures, dates, report names, or policy details in the text to summarize.

Tom's Hardware reports that 17 Russian trawlers have been logged mapping undersea cables connecting the US and Europe, with over 500 incidents of Russian vessels loitering over critical communications cables recorded in under five years. The supplied page text is almost entirely subscription/navigation boilerplate, so no methodology, sourcing, vessel names, cable names, or dates beyond the headline claim are available to evaluate.

The LTO Program — HPE, IBM, and Quantum — has extended its tape roadmap from current LTO-10 cartridges at 40TB uncompressed to a planned LTO-14 at 365TB native capacity. Tom's Hardware notes the 25-year-old format would reach roughly a 400x capacity increase without changing form factor, and that the consortium has deliberately slowed capacity growth to prioritise reliability, cost per terabyte, and backup/recovery times.

Tom's Hardware flags a Best Buy discount of $950 (33%) on the Alienware 16X Aurora, an Arrow Lake gaming laptop with an OLED display and RTX 5070 graphics. The piece is a deal post — it contains no benchmark numbers, no spec table beyond the CPU/GPU/panel callouts, and no independent testing.

At Nvidia’s GTC conference in Berlin, Jensen Huang told CNBC that demand for neoclouds is “off the charts,” but the missing piece is working capital to fuel growth. He said capital demand exceeds availability and that power is a major constraint, especially in Europe where electricity prices are higher. Huang said allocating scarce energy to companies like Nebius and Mistral is crucial for their growth.

The Hacker News reports a flaw in OpenCode where malicious MCP servers can execute code during the sign-in flow, affecting Windows and WSL. The write-up is dated 22 Oct 2026 and is scoped to those two platforms. The supplied excerpt contains no CVE ID, affected version range, or patch status, so the specific trigger and fix are not verifiable from this text.

Tom's Hardware flags a Newegg bundle pairing the AMD Ryzen 7 9800X3D with a Gigabyte X870E AM5 motherboard, 32GB of DDR5 and a free 240mm AIO cooler, listed as $238 off and landing just over $1,000. The pitch is a starting point for a 4K gaming build rather than a complete machine — no GPU, storage or PSU is mentioned in the deal description.

Tom's Hardware reports an OpenAI claim that its ChatGPT 'Sol' model (referred to in the URL as GPT-5.6) helped researchers turn a two-year-old PHP bug that had stumped human developers into working exploits in about two weeks, with the headline framing the flaws as potentially affecting 70% of websites. The article body available here is almost entirely site navigation and subscription boilerplate — no CVE identifiers, PHP versions, affected frameworks, vendor responses, or patch guidance are included. Treat the 70% figure and the two-week exploit timeline as OpenAI's own characterization relayed by a headline, not as verified technical detail.

petecooper posted a Tell HN apologizing for disclosing then-upcoming PHP RCEs tied to CVE-2026-109618 and CVE-2026-109619 without knowing an embargo existed; he says his contact and her contact both told him there was no embargo. The post drew 542 points and 212 comments and disrupted the coordinated disclosure schedule, adding workload. He says his intent was to alert others following the 4-weekly PHP release cycle who compile PHP from source.

Tom's Hardware's headline states that Google TPUs running AI workloads are now deployed in Meta's data centers, framed as the first time TPUs have been sold to external customers and as a challenge to Nvidia's market dominance. The article body as retrieved contains only site navigation, membership prompts, and newsletter sign-up boilerplate — no pricing, capacity, contract terms, deployment timeline, or named sources.

A couple was arrested after a PC hidden behind a fridge in a Japanese hotel room sent 480,000 phishing emails by leeching the hotel's Wi-Fi, with the report citing 2.4 million intended victims. The operation relied on physical concealment and free guest connectivity rather than a novel software exploit. Tom's Hardware gives incident details but no technical indicators or defensive guidance.

A Hacker News thread with 333 points and 120 comments is circulating around CVE-2026-111943, titled 'Compromised Intermediate Certificate Authority', pointing at the NVD entry. The excerpt available here is title-only: it does not name the affected certificate authority, the relying parties, the trust stores or platforms impacted, the disclosure timeline, or any remediation. Nothing beyond the CVE identifier, the title, the NVD source, and the 2026-10-22 timestamp can be confirmed from this text.

The Hacker News headline reports that LiteLLM suspects a GitHub token leak surfaced through AI gateway logs, and that this is connected to a malicious package release. The supplied article text is truncated to navigation and the headline, so no affected versions, CVE, timeline, attacker details, or remediation steps are available. Treat this as a flag to verify, not a briefing.

Sammy Hajhamid published ns2jb, a software-only, tethered jailbreak for the Switch 2 on firmware 23.0.1, using a WebKit n-day loaded via a custom Wi-Fi captive portal to get native code execution as sysmodules. The rig uses JetKVMs for controller input and HDMI capture, plus a Bluetooth light switch to press the power button after crashes. The author says the jailbreak took about two weeks of substantial effort, while a Mario Kart World character mod was 'entirely vibecoded in a day.'

IBM Research published a Granite Timeseries Ensemble recipe on Hugging Face that combines four Granite time-series models behind one interface and returns point plus quantile forecasts, with no retraining and no fitted ensemble weights. You use it via `pip install "granite-tsfm>=0.3.11"` and `QuantileEnsembleForecaster.from_pretrained("ibm-granite/granite-timeseries-ensemble-r1")`, with the demo running context_length 1024 and prediction_length 24 on the ETTh1 dataset. Two variants are offered: a default Probabilistic Ensemble using uniform probability pooling, and an adaptive IQR Ensemble; the recipe stores only the ensemble configuration, so the four member checkpoints are downloaded at runtime on first run.

The Hacker News headline reports a Brotli decoder bug in Node.js that could allow remote code execution across all supported versions. The supplied page text contains only navigation and the headline — no CVE ID, affected release lines, proof-of-concept, or fixed version is included.

AINews reports two core PHP memory-corruption bugs, CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell, tied to PHP's out-of-memory and fatal-error handling rather than a plugin or app auth layer. Researchers demonstrated pre-auth RCE against WordPress, Drupal and Joomla plus remote memory disclosure against any PHP application, with discovery by Ryan Austin at Calif via OpenAI's Patch the Planet using GPT-5.6 Sol and separately by Wiz using Gemini 4 Argon, GPT-5.6 Sol and Wiz Atlas. The excerpt says a two-month coordinated response followed and that severity versus Log4Shell/Heartbleed is still debated.

Coros launched the Pace 4 Pro in Malaysia at RM1,999, sold via the official Coros Malaysia Shopee store plus TikTok Shop, Lazada and Pangu Running Stores, in black or white. It steps up from the standard Pace 4 with a 1.47-inch 466x466 AMOLED touchscreen (sapphire glass, titanium bezel, 3500 nits peak), 43g weight, 11.8mm thickness, double the RAM for faster map rendering, and a mic/speaker used for 'Voice Pins' audio notes auto-tagged with GPS coordinates and synced to the Coros app. Battery is rated 60 hours continuous GPS (45 with Always On Display) and 21 days as a smartwatch (7 with AOD), with heart rate, altitude, temperature, SpO2 and ECG sensors.