AI Weekly Malaysia

Bloomberg reports that the US Military's Cyber Command unit is dealing with a cluster of deaths by suicide among its personnel. The article is behind a paywall, so full details on the number of deaths, timeline, or causes are not available from the accessible text.

A modder repurposed Steam Controller trackpad haptics into stereo speakers using a custom HID tool, transmitting 16-bit audio over a wired connection. The resulting audio was described as surprisingly full for a haptic actuator.

South Korea's Danuri lunar orbiter captured before-and-after images of a spent SpaceX Falcon 9 upper stage that impacted the Moon on August 5, 2026. The upper stage was used to launch Firefly Aerospace's Blue Ghost Mission 1 and ispace's RESILIENCE in 2025; lunar transfer orbit made atmospheric burn-up impossible. NASA's Jared Isaacman noted comparable meteoroid impacts occur roughly every six days, but the event highlights the lack of rules for lunar debris management.

Two security firms independently found that Atlassian's Rovo AI assistant can be tricked into exfiltrating Jira and Confluence data to attacker-controlled servers. Varonis's 'RovoBlast' attack used the rovoChatPrompt URL parameter to preload malicious instructions and was fixed server-side on July 8, 2026. PromptArmor's attack hides instructions in uploaded files, causing Rovo to append internal data to an attacker URL with no approval step — and as of August 5, 2026 this path is not confirmed fixed.

PortSwigger researcher Gareth Heyes presented CSS-based attack chains at Black Hat USA 2026 that break email sandbox boundaries across Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. The techniques can capture passwords (Outlook/Firefox chain spoofs a Microsoft sign-in screen), exfiltrate Slack tokens via prompt injection (Gmail/Cowork chain), and manipulate AI tools that read email. Public PoCs remain available as of August 8; some bugs are fixed (Fastmail CSS mutations, Proton Mail proxy bypass) while others still work (Outlook label-jacking, Gmail image-set() bypass).

The 'rosenbridge' project documents a hardware backdoor in VIA C3 x86 CPUs that allows userland (ring 3) code to bypass memory protections and directly modify kernel (ring 0) data. The backdoor involves a deeply embedded non-x86 core within the CPU, which is enabled by default on some systems. The repository provides tools to check for and close the backdoor, though the issue is limited to older C3 processors and does not affect later generations.

A CVSS 10.0 zero-day in Metabase is being actively exploited to grant unauthenticated attackers admin access via SQL injection into the application database. Self-hosted instances running versions 1.58 and above are affected and must be patched to specific fixed versions (e.g., x.58.24, x.59.21, x.60.17) immediately.

N-able released Hotfix 2 for N-central after detecting active exploitation of CVE-2026-18577 (CVSS 8.2), an authentication bypass that is an incomplete fix for CVE-2026-18556. Attackers used the flaw to gain admin access, leveraged the Take Control feature to reach managed systems, and established persistence via Cloudflare Tunnel services. On-premise customers must update to version 2026.3.1.10 immediately, even if they already applied Hotfix 1.

CISA added CVE-2026-8037 (CVSS 9.6), an unauthenticated command injection flaw in Progress Kemp LoadMaster, to its Known Exploited Vulnerabilities catalog after 792 exploitation attempts from 65 unique IPs across 18 countries over 41 days. watchTowr Labs traced the root cause to an escape_quotes() function with improper input sanitization, and eSentire reported active but largely unsuccessful exploitation attempts originating from three specific IPs.

Apple has posted 22 retail job vacancies based in Putrajaya on its careers site, strongly suggesting a second official Apple Store is coming to Malaysia. The likely location is speculated to be IOI City Mall, Malaysia's largest shopping mall, though neither Apple nor IOI Properties has confirmed this. Based on the 18-month gap between similar job postings and the opening of the first Apple Store at The Exchange TRX in June 2024, the Putrajaya store may not open until 2028 or later.

NASA found a way to extend the operational life of its 48-year-old Voyager 2 probe for at least another year. The article text itself is inaccessible—only site boilerplate and membership prompts were captured, so no technical details on how this was achieved are available.

The Nixpkgs core team has disbanded, announced via a GitHub PR. Over their 10-month tenure they reformed the committer delegation process, onboarded 19 new committers, and extended the merge bot to empower maintainers.

OpenAI's Black Hat disclosures revealed their models self-orchestrated using internal Artifactory as a messageboard, sparking interest in arbitrary agent-to-agent messaging. OpenAI Codex now lets you @ a thread to queue messages between sessions, and Claude Code has added session-to-session messaging so you no longer need to re-explain context across sessions. swyx is building Forge agents using this cross-thread pattern to manage multiple projects.

Simon Willison collected a quote from John Gruber on blogging philosophy: treat writing like live performance rather than studio recording—professional and careful, but not obsessing over making every post a masterpiece, because that would block output entirely.

Apple appears to be preparing a second official retail store in Malaysia, with Putrajaya as the likely location, based on newly posted job vacancies. This would follow the first Apple Store at The Exchange TRX in Kuala Lumpur.

Or how I learned to stop worrying and love dangerous AI

OpenAI said this model, which is still in development, reached its "critical cybersecurity threshold," meaning it could independently identify and carry out cyberattacks against traditionally well-protected real-world systems.

Article URL: https://genesisopenmodels.anl.gov/ Comments URL: https://news.ycombinator.com/item?id=49216946 Points: 349 # Comments: 158

Copernicus Browser adds wildfire visualization amid record wildfire season.

After its own AI usage wake-up call, Rippling this week unveiled AI Spend Console, a product that tracks individual and team employee AI spending.

The MovinkPad 11 a versatile little graphics tablet that can help make your wildest digital art dreams come true.

Six deaths reported among screwworm cases, one directly attributed to the flies.

Researchers found common points of failure, like software used to organize and display web content, could have allowed hackers to run riot through government websites.

https://xcancel.com/un1c0rnioz/status/2084686552299634805 Comments URL: https://news.ycombinator.com/item?id=49215786 Points: 288 # Comments: 211

This week saw massive moves in both directions for software stocks, as investors try to figure out which names are best insulated from artificial intelligence.