AI Weekly Malaysia

An analysis piece argues the real shift is not novel AI attacks but that AI makes a failed intrusion cheap to retry: a dead-end privilege escalation now gets explained, scripted, and re-tested in minutes instead of hours of manual permission checks and debugging. It cites Google Threat Intelligence Group's arc from early-2025 state actors using generative AI for translation, scripting and troubleshooting, to late-2025 malware samples that called a model mid-execution, plus Anthropic disclosing it shut down an extortion operation that leaned on AI from reconnaissance through ransom demands, and a May 2026 GTIG finding that a two-factor bypass in an open-source administration tool was assessed with high confidence to have AI-supported discovery and exploit development.

Asus confirmed a data breach at its eShop online store in which customer contact details and order information were exposed, while stating payment data was not compromised. Asus is warning affected customers about targeted phishing scams. The article text supplied is largely page navigation and subscription boilerplate, so it contains no figures on how many customers were affected, when the breach happened, or how attackers got in.

Vendors rolling out AI have an "incentive to deny as many claims as possible."

"The customer got comfortable with a high reliability and a low price."

New Jersey has fined a Microsoft-linked AI data center what Tom's Hardware calls a record amount over 62 unpermitted power generators and issued a 45-day shutdown deadline for the site. The same site, tied to a $33 billion deal, also built an illegal 1.5-million-gallon fuel tank, and the report notes community complaints about noise pollution. The article body is largely site boilerplate, so specific dollar figures for the fine and the operator's response are not available in the text provided.

Article URL: https://github.com/InfinityLoop1308/PipePipe Comments URL: https://news.ycombinator.com/item?id=49842764

Tom's Hardware's headline flags an HP Omen 35L prebuilt gaming PC with an RTX 5070 Ti, a 20-core Intel CPU, 32GB DDR5 RAM, and a 1TB SSD listed at under $1,900. The article body available here is only membership prompts, newsletter sign-up boilerplate, and site navigation — there is no retailer name, no expiry date, no benchmark data, and no comparison pricing. The only concrete facts are the specs and the sub-$1,900 price in the headline.

JomCharge has switched on a 120kW DC charger with two CCS2 nozzles at the McDonald's Eco Majestic Drive Thru in Semenyih, priced at RM1.40 per kWh and activatable through the JomCharge, ChargEV and Gentari Go apps. An opening promo cuts the rate 50% to RM0.70 per kWh on 26–27 September only, and JomCharge Elite/Platinum members can stack their up-to-25% membership discount on top of the promo.

Bitget says suspected North Korean threat actors moved $351.6 million out of its hot and warm wallets, detected at 18:31 UTC on September 24, 2026, and it has suspended withdrawals while Mandiant and SlowMist investigate. CEO Gracy Chen said the attacker compromised a critical backend system inside the exchange's wallet infrastructure, used it to spoof transaction data, and triggered the authorization process to move funds; affected assets include ETH, XRP, BNB, AVAX, USDT and USDC across Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base. The write-up notes the method is 'highly consistent' with known North Korean patterns, and follows SentinelOne attributing the TraderTraitor group to an attack on an India-based IT services company, a group also linked to the $1.5B Bybit theft and $292M KelpDAO LayerZero bridge loss.

Tom's Hardware reports that Nvidia's DLSS 5 pushes power draw to 647W, with the 16-pin power connector reportedly running hotter than the GPU die itself, described as straining thermal and power limits. The excerpt provided is almost entirely subscription and newsletter boilerplate: it contains no test methodology, no measured connector temperature in degrees, no board partner or SKU named, and no date for when DLSS 5 ships or which GPUs support it.

Article URL: https://economist.com/europe/2026/09/24/the-mafia-may-be-keeping-fentanyl-out-of-italy Comments URL: https://news.ycombinator.com/item?id=49842487

The Canadian Centre for Cyber Security says CVE-2026-48842, a pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin (CVSS 8.1), is being actively exploited in the wild. It affects 1.6.x before 1.6.16 and 1.7.x before 1.7.1, caused by a preg_replace() backslash escape bypass that lets unauthenticated attackers inject SQL and potentially expose mail credentials and stored messages. Roundcube shipped fixes back in May 2026 (1.6.16 and 1.7.1); Shadowserver counted over 523,000 internet-exposed Roundcube instances but only 10 flagged as vulnerable hosts as of September 23, 2026.

Google is testing an experimental orbital AI data center whose first satellite carries just four TPUs powered by 1,000W of solar, according to the article's headline and subtitle. Overheating limits compute runs to roughly 15 minutes at a time, though the orbital server is expected to handle tasks for about one year. The full article body was not accessible in the supplied text — it is navigation, subscription, and newsletter boilerplate — so no additional technical, cost, or launch-schedule details are available here.

Article URL: https://www.inkandswitch.com/ Comments URL: https://news.ycombinator.com/item?id=49842270

Samsung launched the Galaxy A08 in Malaysia on 25 September 2026 at RM899, in Dark Blue, Silver and Green. It pairs a 6,000mAh battery, 6.7-inch HD+ PLS LCD, 6GB LPDDR5X RAM, 128GB storage (microSD to 2TB) and a 50MP main + 2MP depth + 8MP front camera with a 4G-only MediaTek Helio G99+ and 8.0mm body, plus IP64. The headline software promise is six major Android OS updates and six years of security patches, with Knox Vault (EAL5+) and bundled access to Google Circle to Search, Gemini and Perplexity.

The Dutch government is backing DAWO, an open community where government, industry and society jointly build a 'digitally autonomous workplace', organised as replaceable building blocks rather than one product: open/verifiable AI components, an operating system (DAWO-NixOS) with installation building blocks, autonomous and verifiable cloud infrastructure, and collaboration tooling for communication and documents. The site states five goals (digital autonomy, collaboration, security, innovation, verifiability) and that every part can be inspected and replaced; a public portal hosts calendar, news, blog and a forum where anyone can read but posting needs an account. The Hacker News thread drew 376 points and 165 comments. Note the page itself never mentions Microsoft — the 'alternative for Microsoft' framing comes from the submission title only, and the excerpt gives no pricing, migration timeline, or technical specs.

Article URL: https://nyaa.sh/reviews/mac-mini-m6-emulation Comments URL: https://news.ycombinator.com/item?id=49841285

iCaur Malaysia has added a rear-wheel drive CKD variant of the iCaur 03, assembled at Chery Corporate Malaysia's Shah Alam plant, priced at RM119,740 — essentially unchanged from the RM119,800 CBU RWD launched last September. It uses a 65.7 kWh LFP battery with a 426 km NEDC (est. 362 km WLTP) range, a 135 kW / 220 Nm rear motor, 80 kW DC and 6.6 kW AC charging, and 3.3 kW V2L, with a 7-year/150,000 km vehicle warranty plus a 10-year/200,000 km high-voltage battery warranty including 1-to-1 replacement if SoH falls below 60%. A Phantom Edition adds RM20,000 for an all-black colourway, body panels, sidebox and side ladder.

Latent Space used a quiet news day to announce its own restructuring: AINews is becoming 'AINews v3' by merging the Discord's job-to-be-done into the newsletter, with a possible migration to Beehiiv and a new homepage, plus a new Business/Ops Manager and Head of Editorial and sponsorships reopening. The same roundup flags Claude Opus 5.5 now leading SimpleBench at 88.4%, ranked as Anthropic's best vision model to date (better than Fable 5 and GPT-6 Sol, worse than GPT-6 Astra) at roughly 60% lower cost than Fable 5.1, and promotes Supabase Select in San Francisco on October 2.

Maxis and Malaysia's Ministry of Entrepreneur and Cooperatives Development (KUSKOP) launched Perkasa Halal, combining KUSKOP's Halal Sukses reach with Maxis eKelas Usahawan to give MSMEs digital marketing and online revenue training, plus a three-month eKU Accelerator with group coaching for high-potential participants. Announced at MITEC alongside MIHAS 2026 and officiated by minister Steven Sim Chee Keong, the programme targets 6,000 trained entrepreneurs and 450 accelerator participants by 2029, with continued support via an eKU alumni community.

Lightspeed is targeting $250M for Lightspeed India Partners V, a new early-stage AI-focused India fund, according to an investor letter seen by TechCrunch. The fund is half the size of its $500M 2022 predecessor, which has already committed 80% of its capital, and Lightspeed plans to begin investing from it within two months over a roughly 2.5-year investment period. Lightspeed is also moving its India funds onto the same fundraising cycle as its global funds, after Accel raised a $550M India fund in August as part of a coordinated $3.5B effort.

Article URL: https://robert.ocallahan.org/2026/09/goodbye-google.html Comments URL: https://news.ycombinator.com/item?id=49840314

Cloudflare fixed a flaw in Cloudflare Containers where shared thin-provisioned disks (64KB blocks) returned to a cross-account pool without being wiped, so a new container writing only 4KB into a reused block could read back the remaining ~60KB of a previous customer's data at the raw disk level. Reported September 4 by Oren Yomtov of Accomplish via Cloudflare's bug bounty, it was reproduced on 18 of 24 attempts and on 20 of 22 machines across four continents, recovering directory listings, SQLite databases, Chromium browser profiles, .env files and credential files. Cloudflare says it is fixed service-wide and customers need to do nothing; Cloudflare Sandboxes, marketed for running untrusted code including AI-agent-written code, was also affected.

CISA added two critical flaws to its Known Exploited Vulnerabilities catalog on Sept 25, 2026: CVE-2026-5430 (CVSS 9.8), a path traversal in WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway that allows unrestricted file upload leading to remote code execution, and CVE-2026-71362 (CVSS 9.1), an incorrect authorization flaw in Adobe Commerce and Magento that lets an attacker switch a customer session to another customer's account without user interaction. watchTowr reported in-the-wild exploitation attempts against its honeypots since at least Sept 13, 2026; Sansec said it detected and blocked exploitation attempts in August 2026; and Previdian logged an attempt from a single Australian IP on Sept 10, 2026. Federal Civilian Executive Branch agencies must apply fixes by Sept 27, 2026, and Adobe has not updated its advisory to confirm exploitation.

Jelawang Capital, described as Malaysia's National Fund-of-Funds and a wholly owned Khazanah Nasional Berhad subsidiary, named Howard Soh as CEO effective 1 October 2026. Soh joins from LemmaTree, where he was group chief investment officer, and the announcement cites prior roles as CEO of Sea Malaysia, director of investments at Ekuinas, and founding/leading early Malaysian operations for Lazada, Zalora and Foodpanda. Jelawang sits inside Khazanah's US$245 million (RM1 billion) Dana Impak allocation aimed at strengthening Malaysia's VC and startup ecosystem.