AI Weekly Malaysia

Denmark's national person register (CPR) disclosed a serious security incident in which unauthorized parties abused a Danish company's legitimate query access to pull names, addresses and CPR numbers for roughly 8.8 million registered citizens. Names and addresses of people with name-and-address protection were not included in the unauthorized access. CPR has cut off the company's access, reported the case to the Danish Data Protection Agency (Datatilsynet), and police are investigating alongside relevant authorities.

CVE-2026-61500 (CVSS 9.3) affects Rejetto HFS 3.0.0 through 3.2.0: the server derived its session-cookie signing key from JavaScript's non-cryptographic Math.random() and leaked outputs of the same V8 PRNG to unauthenticated clients during the SRP login handshake, letting an attacker reconstruct the generator state, recover the signing key, forge an admin cookie, and reach remote code execution through the server_code configuration feature. A patch shipped in July 2026 as version 3.2.1, but a public Python PoC by Alejandro Ramos (aramosf) landed in late September, and VulnCheck's Patrick Garrity says exploitation attempts were detected on October 1, 2026 — one day after Horizon3.ai published more detail. Horizon3.ai researcher Zach Hanley stated that Anthropic's Mythos model was used to discover the flaw.

MDEC senior vice president Fadzli Abdul Wahit used a keynote at UKM’s 2nd International Conference on Global Business & Digital Economy 2026 to call for Malaysia to move from digital participation to leadership, commercialising innovation and building homegrown companies that can compete globally. He cited the Thirteenth Malaysia Plan’s aspiration to be an inclusive AI Nation by 2030 and a regional digital hub, plus MD2030’s target for the digital economy to contribute 30% of GDP by 2030. The speech also pushed stronger university-industry collaboration to translate research into commercial solutions, but announced no new grants, programmes, deadlines, or eligibility criteria.

Bloomberg reports (2026-10-05) that Qualcomm has licensed patents covering Huawei's "LogicFolding" chip technology. The text supplied here is only Bloomberg's site navigation and paywall boilerplate — no article body — so the license's scope, terms, royalty structure, and which products it covers are all unknown from this item. The Hacker News thread drew 165 points and 103 comments.

Standard Chartered spent the past year fixing its data and infrastructure foundations after early AI use cases hit limits, and is now connecting data across roughly 150 previously disconnected systems. Group CIO Alvaro Garrido briefed reporters in Kuala Lumpur on 22 September, with the bank running a private cloud at 500,000 virtual CPUs and 99% data centre virtualisation in key Asian hubs. Group chief data officer Shebani Baweja said scaling AI depends on trusted data, proportionate governance and internal skills, and warned that AI will amplify data-quality problems rather than fix them.

At Proton's September sales announcement, Deputy CEO Ir. Abdul Rashid Musa confirmed the company will launch at least two more models before the end of 2026, saying the pace of model introductions and infrastructure investment will not slow. The article's guesses are the rumoured Saga Cross (codename AMA02) — the next model on Proton's Advanced Modular Architecture after Saga MC3, an A-segment compact crossover aimed at the Perodua Ativa and Honda WR-V space, with a supplier claiming October production start and rumours of ICE and hybrid options — and possibly an electrified sedan for the e.MAS brand, speculated to be a rebadged Geely Galaxy A7 EV. Proton has not named the two cars, and no prices, specs, or software details are given.

An Ookla report on mobile voice call setup times found that Yes 5G's VoNR implementation in Malaysia performs strongly, while U Mobile's 5G voice takes longer to set up a call, even though both are the only Malaysian telcos running 5G SA and VoNR commercially to mass consumers. Ookla treats roughly two seconds from tapping call to first ringback tone as the gold standard, and fallback to EPS or CSFB can push setup past four seconds. The report also cites South Korea and Singapore, where newer 5G voice setups don't always beat existing VoLTE.

Citrix patched CVE-2026-88779, a CVSS 8.7 memory overflow in NetScaler ADC and NetScaler Gateway that has been exploited in targeted zero-day attacks and can cause denial-of-service when the appliance is configured as a SAML service provider or identity provider. Patches are in NetScaler ADC/Gateway 14.1-73.41+, 13.1-64.28+, 14.1-FIPS 14.1-73.41+, and 13.1-FIPS/13.1-NDcPP 13.1-37.282+. Citrix says it has not identified impact on customer data integrity, but repeated triggering may leave the service unavailable.

iQoo has confirmed the iQoo 16 will launch in Malaysia in November 2026, claiming it would be the country's first Snapdragon 8 Elite Gen 6 phone, with Xiaomi also confirming its Xiaomi 18 Pro series on the same chip. The phone pairs a 6.85-inch 3168x1440 Samsung Everest panel at 165Hz (up to 2,800 nits) with up to 16GB LPDDR5X Ultra Pro RAM, up to 1TB UFS 4.1 storage, an 8,400mAh battery with 100W wired / 40W wireless charging, IP68/IP69, Android 17, and four storage/RAM configurations in three colours. No Malaysian pricing or exact launch date has been announced.

Razer announced the Huntsman V3 Pro Mini 8KHz, a 60% compact keyboard priced at RM789, available to order on the Razer Malaysia website with no Lazada or Shopee listing announced yet. It uses Analog Optical Switches Gen-2 with a 0.1–4.0 mm adjustable actuation range and Rapid Trigger, an 8000 Hz HyperPolling rate that Razer says tested at 0.48 ms latency and is 26% faster than the nearest competitor, plus 6 onboard profiles and browser-based Synapse Web control without installing software.

A Florida woman, Carli Michelle Heller of Bonita Springs, used Claude as a diary and allegedly wrote on Sept. 26 that she planned to 'shoot up' the Sheriff's office. Claude's safety systems flagged the entry, a human reviewer deemed it a credible threat and reported it to law enforcement, and she now faces a second-degree felony charge under Florida Statute 836.10. Anthropic says it may share user information in limited emergencies if it believes disclosure is necessary to prevent death or serious physical injury.

The item is an Ars Technica science story titled 'New forensic evidence supports Egyptian retainer sacrifice,' published 2026-10-05, but the captured text contains only the site's cookie-consent and privacy-center boilerplate — no article body, no findings, no names, no numbers. Nothing about the alleged forensic evidence, the study, or the researchers is present in the text provided.

A 27- or 28-year-old employee of the Irkutsk anti-plague institute, identified in reports as Daria Sh., died Thursday after reportedly breaking a test tube containing live bacteria while collecting samples; she was hospitalised Tuesday in Shelekhov with severe pneumonia and placed on a ventilator. Regional officials placed at least 197 contacts under medical observation — more than 100 of them in hospital wards — and quarantined the Shelekhov district hospital, while Irkutsk authorities cancelled public events and opened a criminal investigation into possible health-safety violations. Buryatia head Alexei Tsydenov and Irkutsk Governor Igor Kobzev both issued public statements, and media reports describe the suspected infection as pneumonic plague, though Tsydenov's statement did not specify the form.

Malay Mail reports that US President Donald Trump announced a "Super Intelligence Force" to oversee and coordinate the US government's artificial intelligence efforts, with Jay Clayton named alongside other prominent leaders to head the initiative. The stated aim is maintaining US global leadership in AI, framed as supremacy over China. The excerpt is truncated and supplies no mandate, budget, staffing, or timeline; the only other dated detail is a September 29, 2026 meeting with technology executives that the photo caption says included Nvidia CEO Jensen Huang and SpaceX CEO Elon Musk.

At the Bahrain GP in Malaysia, a software bug in the 2026 F1 cars' power unit controller wet-weather mode left multiple cars stuck in idle mode during the formation laps at a wet Sepang circuit. The FIA rapidly coded and delivered a patch to all 11 teams during the red-flag stoppage. Lando Norris called the glitches "horrible" and "totally unacceptable" and said they were further proof F1 should move away from hybrids.

Lowyat.NET reports that MyEG and Zetrix AI have been ordered to immediately settle RM314 million in arrears, with the order tied to a service suspension. The excerpt supplied contains only the headline, publication date (5 October 2026), and site navigation — it does not state which services are suspended, who issued the order, or the deadline involved.

See how Cresta built Conductor, an agent that builds other agents, on the Claude Agent SDK, and how the team evaluates it with every new Claude model.

Simon Willison re-ran a two-year-old GPT-4o experiment (originally posted by Colin Frasier on Bluesky) on local hardware, testing whether `Qwen3.8-27B-Q4_K_M.gguf` on a DGX Spark could add positive integers and return exact results only in English words. With reasoning disabled across 5,070 cases it hit 23.57% numeric accuracy, falling from 97.04% on one-to-three-digit operands to 6.44% on ten-to-thirteen-digit operands, even though format compliance was 96.17%. A paired 169-case run with medium reasoning enabled got 167/169 correct one-shot, with visible carry-by-carry traces in the report.

Vincent Bernat documents a self-hosted HTTP tunnel using only OpenSSH and nginx: `ssh -R 0:localhost:8080 server` allocates a free remote port, and an nginx regex `p(\d\d\d\d\d).ssh.luffy.cx` proxies to `127.0.0.1:$port`. It uses wildcard DNS for `*.ssh.luffy.cx`, Let’s Encrypt DNS-01 via a Route 53 zone, and `ngx_http_secure_link_module` with an MD5 hash plus expiry in the URL username; the allocated port alone has only ~14.785 bits of entropy. The Hacker News thread has 165 points and 34 comments.

Tippett Studios, the Berkeley-based animation/effects house founded by Phil Tippett, closed on the 28th of August and its props and art were sold in a two-day auction. An anonymous donor called 'TippettFan' bought a folder of CD-ROMs and other discs at the auction and uploaded 90 key, non-duplicated .ISO disc images to the Internet Archive. The free archive contains gigabytes of behind-the-scenes images and slides from RoboCop, Starship Troopers, and the original Star Wars, plus test CGI creature clips and a 2008 Phil Tippett interview.

Google paused its Open Source Software Vulnerability Rewards Program as of October 1, with a promised update in Q1 2027, citing a "significant rise in automated submissions, the vast majority of which are not valid." According to Tom's Hardware, Google engineers and open source maintainers were overwhelmed by reports that were invalid or contained hallucinations, and TechCrunch notes prior warnings from cybersecurity experts that AI slop posed a risk to bug bounty programs. Participants are pointed to Google's other bug bounty programs in the meantime.

On the TechCrunch Equity podcast, Anthony Ha, Kirsten Korosec and Sean O'Kane discussed a White House meeting where President Donald Trump hosted major AI executives, signed an executive order renaming "artificial intelligence" to "super intelligence" for official U.S. representatives, and announced a "Joint Commitment on Frontier Responsibilities" that the executives signed. The hosts called the pact "deeply non-binding" legally, with Trump describing it as "morally binding," and Korosec framed the meeting as a rebranding effort — a message that AI is scary and job-taking but "super intelligence is not." A follow-up "Super Intelligence Force" was announced that weekend.

RemoveMacAI is a small open-source tool (421 stars, 12 forks, 10 commits) that turns off Apple Intelligence on macOS 27 and deletes the AI models already downloaded to disk. Its premise is that macOS 27 dropped the single Apple Intelligence toggle and leaves models on disk even after features are switched off, so the tool disables features, removes models, and blocks re-download. It ships as a one-line curl|bash installer or Homebrew tap (brew install omlahore/tap/removemacai), with SHA-256 checksum verification, GitHub Actions build provenance attestation, a --dry-run mode, and a full revert command.

A Nebraska TV report says Google's three Nebraska data centers (Agate LLC in Lincoln, Fireball Group LLC in Papillion, Westwood Solutions LLC in Omaha) filed their 2026 annual report to the state Department of Water, Energy, and Environment with electricity and water figures marked as trade secrets under Neb. Rev. State §§ 81-1527 and 84-712.05. Highlighting and copy-pasting the redacted text boxes revealed Agate's 52.65 MW peak electrical demand and 13.299 million gallons of water use, and Fireball's 547.88 million gallons, with six reporting data centers totaling 765 million gallons last year. The same trick surfaced expected 2025 tax refunds of $55,822,472 (Agate), $39,171,573.39 (Fireball), and $22,558,881 (Westwood), plus a 288,530 sq ft gross floor area for Agate; the station filed public record requests on Sept. 30.

A browser-native recreation of the classic Visual Basic 6 IDE was posted to Hacker News and drew 162 points and 58 comments. The submission itself carries no readable article text — only the project URL (wieslawsoltes.github.io/VB6/) and the discussion thread — so no implementation details, feature list, or technical claims can be verified from the source. What is confirmed is the interest level: a mid-sized but clearly engaged HN thread.