AI Weekly Malaysia

petecooper posted a Tell HN apologizing for disclosing then-upcoming PHP RCEs tied to CVE-2026-109618 and CVE-2026-109619 without knowing an embargo existed; he says his contact and her contact both told him there was no embargo. The post drew 542 points and 212 comments and disrupted the coordinated disclosure schedule, adding workload. He says his intent was to alert others following the 4-weekly PHP release cycle who compile PHP from source.

Tom's Hardware's headline states that Google TPUs running AI workloads are now deployed in Meta's data centers, framed as the first time TPUs have been sold to external customers and as a challenge to Nvidia's market dominance. The article body as retrieved contains only site navigation, membership prompts, and newsletter sign-up boilerplate — no pricing, capacity, contract terms, deployment timeline, or named sources.

A couple was arrested after a PC hidden behind a fridge in a Japanese hotel room sent 480,000 phishing emails by leeching the hotel's Wi-Fi, with the report citing 2.4 million intended victims. The operation relied on physical concealment and free guest connectivity rather than a novel software exploit. Tom's Hardware gives incident details but no technical indicators or defensive guidance.

A Hacker News thread with 333 points and 120 comments is circulating around CVE-2026-111943, titled 'Compromised Intermediate Certificate Authority', pointing at the NVD entry. The excerpt available here is title-only: it does not name the affected certificate authority, the relying parties, the trust stores or platforms impacted, the disclosure timeline, or any remediation. Nothing beyond the CVE identifier, the title, the NVD source, and the 2026-10-22 timestamp can be confirmed from this text.

The Hacker News headline reports that LiteLLM suspects a GitHub token leak surfaced through AI gateway logs, and that this is connected to a malicious package release. The supplied article text is truncated to navigation and the headline, so no affected versions, CVE, timeline, attacker details, or remediation steps are available. Treat this as a flag to verify, not a briefing.

Sammy Hajhamid published ns2jb, a software-only, tethered jailbreak for the Switch 2 on firmware 23.0.1, using a WebKit n-day loaded via a custom Wi-Fi captive portal to get native code execution as sysmodules. The rig uses JetKVMs for controller input and HDMI capture, plus a Bluetooth light switch to press the power button after crashes. The author says the jailbreak took about two weeks of substantial effort, while a Mario Kart World character mod was 'entirely vibecoded in a day.'

IBM Research published a Granite Timeseries Ensemble recipe on Hugging Face that combines four Granite time-series models behind one interface and returns point plus quantile forecasts, with no retraining and no fitted ensemble weights. You use it via `pip install "granite-tsfm>=0.3.11"` and `QuantileEnsembleForecaster.from_pretrained("ibm-granite/granite-timeseries-ensemble-r1")`, with the demo running context_length 1024 and prediction_length 24 on the ETTh1 dataset. Two variants are offered: a default Probabilistic Ensemble using uniform probability pooling, and an adaptive IQR Ensemble; the recipe stores only the ensemble configuration, so the four member checkpoints are downloaded at runtime on first run.

The Hacker News headline reports a Brotli decoder bug in Node.js that could allow remote code execution across all supported versions. The supplied page text contains only navigation and the headline — no CVE ID, affected release lines, proof-of-concept, or fixed version is included.

AINews reports two core PHP memory-corruption bugs, CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell, tied to PHP's out-of-memory and fatal-error handling rather than a plugin or app auth layer. Researchers demonstrated pre-auth RCE against WordPress, Drupal and Joomla plus remote memory disclosure against any PHP application, with discovery by Ryan Austin at Calif via OpenAI's Patch the Planet using GPT-5.6 Sol and separately by Wiz using Gemini 4 Argon, GPT-5.6 Sol and Wiz Atlas. The excerpt says a two-month coordinated response followed and that severity versus Log4Shell/Heartbleed is still debated.

Coros launched the Pace 4 Pro in Malaysia at RM1,999, sold via the official Coros Malaysia Shopee store plus TikTok Shop, Lazada and Pangu Running Stores, in black or white. It steps up from the standard Pace 4 with a 1.47-inch 466x466 AMOLED touchscreen (sapphire glass, titanium bezel, 3500 nits peak), 43g weight, 11.8mm thickness, double the RAM for faster map rendering, and a mic/speaker used for 'Voice Pins' audio notes auto-tagged with GPS coordinates and synced to the Coros app. Battery is rated 60 hours continuous GPS (45 with Always On Display) and 21 days as a smartwatch (7 with AOD), with heart rate, altitude, temperature, SpO2 and ECG sensors.

Malaysia's LLM and developer Prosignal Consortium Sdn. Bhd. (PCSB) temporarily disabled TuJu's turn-by-turn navigation for emergency maintenance after a traffic surge overwhelmed its servers, days after the government banned civil servants from using Waze on duty. CCTV streams and basic info features still work, but LLM gave no restart date and SoyaCincau's hands-on testing found erratic guidance, missed highway exits, no lane guidance, no real-time traffic, no Android Auto/Apple CarPlay, and cases of raw HTML appearing on screen. LLM apologised and conceded system capacity and server stability were underprepared, and said navigation accuracy, route precision and UX need major overhauls.

The Hacker News reports newly disclosed QPACK flaws that can crash HTTP/3 servers and trigger memory amplification of up to 4,000-fold. The supplied excerpt is truncated after the headline and site boilerplate: it contains no CVE identifiers, no named affected server implementations or versions, no patch guidance, and no researcher attribution. Beyond the headline claim, nothing in this text can be verified or acted on.

The Hacker News reports that an exploitation attempt against 'PHP2Shell' occurred four days before the vulnerabilities were publicly disclosed, indicating pre-disclosure attack activity. The supplied excerpt contains only the headline and site navigation, so no CVE identifiers, affected PHP versions, exploit mechanics, or attacker details are available. Publication date on the item is 22 October 2026.

OpenAI's Head of Forward Deployed Engineering Colin Jarvis explains the FDE team, founded in early 2025 to close the 'deployment gap' between what models can do and what customers can reliably use. He cites John Deere's See & Spray precision weed-control system, which uses cameras and ML to cut chemical use by up to 70%, and says FDEs helped deploy OpenAI APIs for natural-language farmer support, setup guidance, and equipment-performance recommendations. Jarvis says success means making the FDE role unnecessary for a class of problems by raising the floor for the next customer.

ManpowerGroup's Q4 2026 survey puts Singapore's Net Employment Outlook at +13%—32% of employers plan to add headcount from October to December while 19% expect cuts—the lowest reading since the pandemic and below the 29% global average. Trade & Logistics leads hiring at 22% (down 4 percentage points), Finance & Insurance is the most improved at 20%, and UOB plans to bring in 1,000 graduates over the next 12 months. Blackbox Research also found 21% of Singapore respondents now cite jobs as an important issue, up from 13% in July last year, against roughly 40,000 PMET vacancies.

EA has confirmed it is shutting down BioWare after 31 years, with roughly 400 layoffs globally, about 50 of them at the Edmonton headquarters. The next Mass Effect has been cancelled outright, following Anthem's failed live-service bet in 2019 and Dragon Age: The Veilguard's near-decade development cycle and underwhelming commercial numbers. The reported Amazon MGM live-action Mass Effect series is said to still be moving forward.

The Hacker News headline states that a China-linked threat group used something called "ARTEX AI Agents" as part of a supply chain attack involving ConnectWise, published 22 October 2026. The article body did not come through in the captured text — only the title and page chrome — so there are no affected product versions, IOCs, victim counts, timelines, or attribution details to report. Treat everything beyond the headline as unverified until the original piece is read in full.

The 11th e-Conomy SEA report projects Southeast Asia’s digital economy at US$368 billion GMV in 2026, up 17% YoY, and over US$1 trillion by 2035. It says generative AI adoption has reached 243 million people, or 58% of the working population, but regional token usage is only about 10% of US levels, with consumers accounting for roughly 60% of tokens. Enterprise workloads are strongest in mature markets, driving 45%–60% of usage in Singapore and Malaysia, while demand for AI agents is projected to surge up to 60-fold by 2030.

Tupai, the edtech brand of AI Teacher Sdn Bhd, is offering two months of free access to its Premium Family Duo plan until 31 Oct 2026 via code TUPAIFOR2, redeemable at parent.tupai.ai or the Tupai Parent app on Google Play. The offer is timed before SPM written exams start on 23 Nov and follows the 19 Sept launch of Tupai 2.0 and a parent companion app. Tupai 2.0 covers KSSR Maths for Primary 4–6, KSSM Maths for Form 1–5, and Cambridge IGCSE in English and Bahasa Malaysia, with an SPM module using trial and past-year papers; the article cites 21.7% of SPM 2025 candidates failing Maths and Malaysia's 2025 PISA maths score at 397.

Simon Edwardsson fine-tuned a 360M-parameter model (based on Qwen2.5-Coder-0.5B) to act as a terminal with no shell or filesystem behind it: each keypress goes in and the model predicts the resulting screen change. Training data came from real terminal sessions recorded from programs running inside Docker, and the model predicts a character grid rather than an appended token stream — screen size is an input, so sessions can start mid-vim or mid-snake. The two biggest technical wins he cites are teaching the model to repair its own mistakes and decoding screen rows in parallel; the 208 MB demo runs in-browser via WebGPU and the typo 'pythoon' is the intended tell that it isn't a real shell.

Google, Temasek and Bain's e-Conomy SEA report says generative AI adoption in Southeast Asia reached about 243 million users in under three years — 58% of the working population — with adoption occurring four times faster than [text truncated]. The report also says only a small fraction of the region's population pays for personal AI subscriptions, while Bain partner Florian Hoppe told CNBC that businesses are generating AI commercial value through applications ranging from e-commerce to digital advertising.

Malay Mail reports that critical PHP vulnerabilities affecting roughly 70% of the world's websites caused government agencies and companies globally to take sites offline on October 22. The flaws were discovered by security firms Wiz and Calif using advanced AI models, and exploit details leaked online a day before the planned fix release, prompting the rush to shut sites down. The excerpt stops before naming affected PHP versions or CVE IDs.

Tesla said it will start selling its two-seat Cybercab, which has no steering wheel or traditional controls, to customers by the end of the year, while federal regulators investigate whether the vehicle meets safety standards. Tesla engineering VP Lars Moravy said Cybercabs produced today are destined for Tesla's own robotaxi fleet and that sales will start small. CEO Elon Musk also said unsupervised Full Self-Driving would reach customers in Q2 next year, described in the article as another delay for Tesla owners.

Anthropic's "Claude Models on Google Cloud (Anthropic managed)" is now generally available, giving Google Cloud customers the full Claude Platform through existing Google Cloud IAM credentials, a single Google Cloud invoice, and drawdown against existing Google Cloud commitments. Anthropic says new features and betas ship on this route the same day they go live on the native Claude Platform — the list includes Claude Managed Agents (beta), code execution, computer use, agent skills, advisor strategy (beta), Files API and citations. Availability is limited to US and Global endpoints, and the Google-managed offering remains a separate option where Google is the data processor.

Anthropic's Applied AI team says that across comparisons in several enterprise deployments, a single agent loop with progressively disclosed context and tools frequently beat both one-prompt-for-everything designs and subagent designs on quality, and often at lower cost and latency per task. One cited company had a dozen specialist subagents inside its customer-facing agent, which made a consistent on-brand experience hard to maintain and added latency that hurt UX; the team says many designs (intent classifier, fixed multi-step pipeline, user-segment buckets, orchestrator) were doing work the model no longer needs, and that one clear system prompt, 4-5 thin data tools and firm output guardrails cover most use cases. They shipped a migration kit with a guided workflow to identify patterns and a demo you can run on a mock system first, and still recommend subagents for context bloat, parallel tasks needing disposable fresh context, or conflicting instructions and tool-selection trouble.