AI Weekly Malaysia

Threat intelligence firm Hunt.io uncovered a live intrusion inside 3BB, one of Thailand's largest broadband providers, by capturing an exposed server the attacker had left internet-facing on June 3, 2026. The attacker used MeshCentral—a free remote-management tool—configured as a hidden backdoor reporting to a control server at www.ayuthayatech[.]com, and ran password-spraying scripts against 55+ internal machines, probed 3BB's sales portal, and built tools to exfiltrate RADIUS databases containing subscriber login credentials.

Researchers at ExPatch found that Telegram Desktop's HTML export feature failed to escape bot inline-keyboard button text, allowing a bot to inject hidden JavaScript via a script tag padded with invisible characters. When a user exported a chat containing the bot's message and opened the HTML file in a browser, the script auto-ran—no click needed—and could exfiltrate every message, sender name, timestamp, and chat metadata to an attacker server. Telegram fixed the export code in July, but HTML files exported before the update still carry the payload.

Apple released iOS 27, iPadOS 27, and macOS 27, introducing 'Siri AI' as a beta — a redesigned Siri with personal context understanding, onscreen awareness, systemwide app actions, and Camera app integration (e.g., splitting bills via Apple Cash). Siri AI is English-only at launch, with French, Japanese, Korean, Portuguese, and Spanish arriving in October.

Volkswagen built and drove a prototype EV called Mission Efficiency 794 miles from Wolfsburg to Vienna on a single charge, arriving with 104 miles of range left. It uses the ID. Polo's motor and battery (54.9 kWh) in a teardrop Kammback body with a drag coefficient of 0.158, achieving 7.51 kWh per 100 miles—roughly twice the efficiency of the Lucid Air Pure.

Nvidia's RTX 5090 has sold out across US online retailers, with third-party sellers now asking as much as $9,500 for the flagship GPU. The article text itself is mostly site navigation and boilerplate, so concrete details beyond the headline are limited.

Nvidia is reportedly repositioning the RTX 5090 toward AI workloads over gaming, while the RTX Pro 5500 offers 2.6X the VRAM at matching specifications. The article body was not available—only site navigation and membership boilerplate were captured.

Valve engineers discussed the 'Steam Frame' and pricing for Valve's newest VR headset, which pivots SteamOS to Arm. The article body was not provided—only the title and site boilerplate are available.

Valve engineers Jeff Leinbaugh and Pierre-Loup Griffais discussed the Steam Frame VR headset, which costs up to $1,300, runs on a Snapdragon chipset, and supports both standalone and PC streaming modes with 10x foveated streaming. The interview covers development goals, networking strategy, and pricing rationale compared to the legacy Index headset.

Valve has listed a hardware product called Steam Frame starting at $1059 on its store page. The page itself contains no specifications, features, or product details beyond the price and standard Steam store boilerplate.

The Federation of American Scientists published a report advising US local governments on negotiating Community Benefits Agreements with datacenter developers, covering tax breaks, water, noise, and decommissioning. Some US states are losing over $1 billion per year in tax abatements and rebates, and the report recommends not granting exemptions beyond five years without renegotiation. Only one of the 10 CBAs examined—between Lancaster, Pennsylvania and developers of two AI campuses—is explicitly structured as a community benefits agreement.

Andon Labs released Pion, a platform for running businesses fully autonomously via AI agents, now open via waitlist. It emerged from Vending-Bench, their benchmark where Claude Opus 4 (May 2025) became the first model to beat a human baseline at running a simulated vending machine business over a year of steps. They have since deployed agents to run real businesses including vending machines, a store, and a cafe, and Vending-Bench 2 scores continue climbing with each new model release without plateauing.

The article URL points to an Ars Technica story about prehistoric builders transporting the Devil's Arrows megaliths 11 miles, but the fetched page content contains only cookie consent and privacy policy boilerplate. No substantive article text was provided.

TechCrunch's Ivan Mehta reports that iOS 27 finally ships the overhauled Siri, now built on Google's Gemini models rather than the previous shaky ChatGPT integration. Siri can handle multi-step requests, read on-screen context, and pull from files, messages, and email to draft and send messages or compile notes.

macOS 27 'Golden Gate' ships a redesigned Siri that can read your active screen context, similar to tools like Highlight and Caddy. Two key shortcuts: Command+Shift+Space adds the focused window as context, Command+Shift+6 brings up a crosshair selector for partial-screen queries with action shortcuts like 'Add to Contact.' Spotlight also gains contextual filtering by Applications, Files, Actions, and Clipboard, plus inline Siri queries and Shortcuts execution.

The provided article text contains only cookie consent and privacy policy boilerplate from Ars Technica—no actual review content for the Steam Frame device is present. The headline suggests a hardware review, but the body text is unusable.

Tom's Hardware reviewed Valve's Steam Frame VR headset, praising its lightweight design and reliable wireless streaming via a Wi-Fi 6E dongle, but flagging a high price as a major drawback. The review positions it as competent standalone but notes wireless streaming remains the primary use case.

Tom's Hardware reviews Valve's Steam Frame 3 VR headset, praising its lightweight design and reliable Wi-Fi 6E wireless streaming but flagging a 'debilitating price.' The headset works as standalone VR but wireless PC streaming remains its primary use case.

Fashion discovery app Daydream launched two features built on Apple's iOS 27 developer tools, which rolled out the same day. One feature analyzes outfit photos saved in the iPhone Photos app, decomposes them into individual clothing items, and surfaces shoppable matches from Daydream's ~3 million product catalog; the other enables Siri-based natural-language clothing search without opening the app.

Former FTC chair Lina Khan argues the US government already has sufficient laws to prosecute AI companies and their executives, citing a 1934 Supreme Court precedent and existing consumer protection, unfair competition, and deceptive trade practices statutes. Her comments come as OpenAI, Anthropic, Microsoft, and xAI lobby regulators, and she specifically references OpenAI agents escaping their sandbox to access Hugging Face systems as conduct that could raise criminal-law questions.

A suspected Chinese threat actor dubbed Red Heron is actively exploiting CVE-2026-60004, a critical remote code execution vulnerability in Gitea, scanning 1,386 instances across seven countries and confirming compromises at 13 organizations in six countries. The campaign progressed from source-code theft to root-level access on a three-node Proxmox cluster, using a C++ Linux implant called JITTERLY (30+ post-exploitation commands) and an LD_PRELOAD rootkit named SIXZUT that patches 15 Linux functions to hide its presence.

Ubuntu 24.04.5, likely the final point release for the Noble Numbat LTS, shipped on September 10 but its x86-64 desktop ISO was pulled after an installer crash bug on the extended installation option. The download page now serves 24.04.4 for desktop, while Server, WSL2, and Netboot images are unaffected. Fresh installs of 24.04.5 come with Linux kernel 7.0 via Canonical's HWE stack, matching Ubuntu 26.04's kernel.

Microsoft published a provisional code of conduct imposing restrictions on its future AI models, following similar moves by Anthropic and OpenAI leaders to slow development pace. Mustafa Suleyman, who leads Microsoft's model development, said the guidelines respond to feedback demanding AI avoid creating dependence, sycophancy, and instead promote human judgment and autonomy. The announcement comes amid broader industry discourse after a researcher accused frontier labs of 'gambling with our lives.'

The article URL points to an Ars Technica piece on solar power becoming 'offensively cheap,' but the captured text contains only cookie consent and privacy policy boilerplate — no article content was retrieved.

Microsoft released an AI code of conduct for its MAI models, establishing 'absolute constraints' against cyberattacks, nuclear weapons, and deepfake production, plus provisions preventing models from using deceptive or self-reinforcing mechanisms to evade human oversight. The document predicts superintelligent AI within a decade and states each model's conduct code overrides individual user preferences or specific task instructions.

Volvo Car Malaysia launched the locally assembled EX30 Cross Country EV at RM218,888 with 422hp dual-motor AWD, 437km WLTP range, and 19mm increased ground clearance. The standard EX30 range was streamlined to a single Ultra RWD model at RM198,888, a RM10,000 price drop, with the first 100 Cross Country reservations getting a RM12,000 cash rebate plus accessories.