AI Weekly Malaysia

Alby Hub, a self-hosted Bitcoin Lightning wallet, disclosed a critical flaw affecting versions v1.7.0 through v1.18.5 that could let attackers take over internet-exposed instances and send funds. The fix shipped in v1.19.0 (August 29, 2025); current release is v1.24.0. At least one user was affected, though Alby did not confirm any financial loss.

Ookla named U Mobile Malaysia's Best Mobile Network and Fastest 5G Network for H1 2026, with a median 5G download speed of 348.73Mbps and a Speedtest Connectivity Score of 80.34. However, the test period (Jan–Jun 2026) predates U Mobile's full exit from DNB on 30 June 2026, meaning these results reflect DNB-shared infrastructure, not U Mobile's standalone ULTRA5G network. Ipoh topped fastest cities at 184.85Mbps median mobile download, while Putrajaya led regions at 224.46Mbps.

Virgin Media is shutting down its email service and giving customers 45 days to either migrate to Junara (an Atmail-owned provider, first year free then paid), download their data, or close their account. This affects all addresses including ntlworld, blueyonder, virgin.net, and virginmedia.com domains.

A researcher has reverse-engineered the source code of Stuxnet—the malware that targeted Iranian nuclear facilities and was the first software known to cause physical damage—and published it on GitHub. The article itself is mostly site boilerplate with little additional technical detail beyond the headline.

Xiaomi has unveiled the Xiaomi 18 Fold in China, targeting the premium foldable smartphone market against Samsung's Galaxy Z Fold 8 and ahead of an anticipated Apple foldable. The device features a Leica-branded triple-camera setup, an advanced folding mechanism, and is powered by Xiaomi's XRING chip.

Big Tech is reportedly considering Patagonia as a site for mega AI data centers, attracted by its 17,300 glaciers, naturally cold climate, and cheap energy. The major blocker is scarce fiber connectivity, which would need significant investment to resolve.

Huawei released the Watch D3, a third-generation wearable with an inflatable wrist cuff for 24-hour ambulatory blood pressure monitoring, CE-certified under EU MDR. It weighs 40g and is 11.3mm thick—slimmer than the D2 but still chunky—and uses a built-in pump and airbag strap rather than optical estimation.

Malaysia's Parliament is holding a free open day on 12-13 September 2026 (9am-5pm) to mark its 67th anniversary, with no registration required. Visitors get walk-in access to Parliament buildings, with a free shuttle (Laluan T851) connecting KL Sentral, Taman Botani Perdana, and Parliament. Smart casual dress code is strictly enforced.

A post titled 'Claude, change the "Add to Cart" button to blue' from opusfived.dev went viral on Hacker News with 1176 points and 447 comments, suggesting it struck a nerve about using AI coding assistants for mundane UI tasks. The article itself could not be retrieved, so the specific argument or demonstration is unknown.

NSA, CISA, and FBI jointly accuse DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI of industrial-scale distillation attacks extracting billions of tokens from Claude, GPT, Gemini, and Grok since late 2024. The advisory details specific tactics including chain-of-thought reasoning extraction, automated failover during blocking attempts, and bulk premium subscriptions shared across developer teams to cut costs.

A departing Anthropic safety researcher stated there is more than a 10% chance AI could kill all humans within 10 years and accused AI companies of 'gambling with our lives.' The article body was not provided beyond the headline and site navigation boilerplate, so no further technical detail, context, or rebuttal is available.

Google announced a €13 billion ($15.1 billion) AI infrastructure investment in Finland, its largest single investment in Europe, citing Finland's available land and power. The deal includes a 22-year power purchase agreement extension with Finnish energy company Fortum, whose stock jumped 9% on the news.

Google patched 230 Chrome vulnerabilities including CVE-2026-87491, an actively exploited out-of-bounds write in the V8 engine allowing arbitrary code execution inside the sandbox via a crafted HTML page, fixed in Chrome 153.0.8010.36. This is the seventh actively exploited Chrome zero-day patched in 2026. Notably, one of the other patched bugs (CVE-2026-87639, a use-after-free in WebPackaging) was credited to OpenAI Codex Security, suggesting AI-assisted vulnerability discovery.

Switzerland's Federal Chancellery plans to offer a browser-based FOSS workplace suite (openDesk from Germany's ZenDIS) to 3,000 of its 47,000 federal employees by end of 2027, costing CHF 9 million in its first phase. This follows a 172-user proof-of-concept (BOSS) that explicitly scoped the suite as NOT a Microsoft 365 replacement, NOT 1:1 functional, and NOT fully M365-compatible — managing expectations that perfect fidelity is impossible. For context, the Swiss federal government has spent CHF 1.1 billion on Microsoft licenses.

OpenAI claims a system of ~10,000 concurrent coordinating agents, powered by an internal AI model, produced a solution to the Navier-Stokes Millennium Prize problem in 88 hours. The agents were subdivided into groups with intra-group communication, cached internet access, and code execution. NYU mathematics professor Tristan Buckmaster has raised questions about the work.

cPanel patched CVE-2026-67401, an SQL injection flaw in the EmailTrack module that lets any authenticated hosting account with mail privileges create arbitrary files and escalate to root access on the entire server. Every supported cPanel/WHM version is affected; fixed builds are 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, and WP Squared 11.138.1.9. The advisory does not provide a mitigation for servers that cannot upgrade immediately.

Bloomberg's Mark Gurman reports Apple's foldable iPhone will be called iPhone Duo, not iPhone Ultra, with a base 256GB model at USD 2,000 (~RM8,136) and a 2TB variant at USD 3,000 (~RM12,204). The device features an A20 Pro chip, Apple C2 modem, magnetic hinge, and notably supports Apple Pencil—countering Samsung's decision to drop S Pen support from its foldable lineup.

Sophos published analysis on September 7, 2026 revealing that malware targeting F5 BIG-IP APM appliances injects a PHP web shell directly into Apache's memory at runtime, modifying three specific scripts (apm_css.php3, full_wt.php3, webtop_popup_css.php3) only in-memory so disk-based file integrity checks return clean. The malware is linked to CVE-2025-53521, which F5 initially rated as denial-of-service in October 2025 but reclassified as a 9.8 CVSS remote code execution flaw on March 27, 2026 after discovering active exploitation; CISA added it to its Known Exploited Vulnerabilities catalog the same day.

Security researcher Chaotic Eclipse released a proof-of-concept for 'ShieldCrash,' a patch bypass for Microsoft Defender vulnerability CVE-2026-69414 (CVSS 7.8, dubbed ShieldBreak). The PoC demonstrates arbitrary file read as SYSTEM on fully patched Windows desktops; the fix ships in Malware Protection Engine version 1.1.26080.3, which updates automatically and requires no customer action.

Microsoft's Edge team reports that AI-assisted coding has caused extension submission volumes to surge, overwhelming their manual review pipeline and increasing turnaround times—especially as staff cuts have reduced reviewer headcount. Their response is automating repeatable validation checks to flag policy violations and security issues, letting human reviewers focus on complex cases.

The GrapheneOS project account posted on Mastodon that copyright does more harm than good and should be abolished. The provided text contains only the post title and fragments of replies, with no substantive argument or evidence included.

SAP patched CVE-2026-44756 (CVSS 10.0), a memory corruption flaw in SAP Extended Passport (EPP) kernel processing dubbed OVERPASS, enabling unauthenticated remote code execution with SAP admin privileges. The flaw is reachable via web, SAP GUI, and RFC layers without credentials, allowing attackers to read the SAP secure store, recover database credentials, and move laterally across SAP systems.

Apple is expected to unveil the iPhone 18 Pro, iPhone 18 Pro Max, and its first foldable iPhone ('Ultra') at a keynote on 10th September. Accessory makers dbrand and Spigen have already published case designs, giving an early look at the physical form factors.

Federico Felici and Jonas Buchli, who previously worked at Google DeepMind, founded Lausanne-based Fusionality in 2026 to build control systems for fusion reactors. They raised a $3.7 million pre-seed from Founderful and Playfair, targeting the 80% of control system functionality that fusion companies currently build from scratch.

The Philippines government released its AI+ Infrastructure Masterplan (PAIIM), targeting $34.4 billion in investment to grow national datacenter capacity from 50MW to 1.5GW by 2033, housing ~152,000 GPUs. The plan explicitly positions the country against Singapore and Thailand as a regional AI hub but omits Malaysia, despite the article noting Johor already has nearly 4GW of datacenter projects in place.