AI Weekly Malaysia

PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, let attackers access or modify data on PHP servers without a password, and the PHP Foundation released patches on Wednesday after giving major hosts early access. Banks, retailers, gaming sites, hospitals, and some government agencies took servers offline to patch, while researchers warn many systems remain unpatched and vulnerable.

Why: If you run PHP, WordPress, or a PHP-based SaaS/website, this is a patch-now incident: confirm your host applied the PHP Foundation fix or take the service offline until you can. Founders should also check third-party vendors and agencies that host their sites, because the article says major institutions pulled services offline and many systems remain exposed.

Richard Feldman benchmarked roc-deflate — a DEFLATE compression package written by Niclas Ahden in Roc, a functional language still weeks away from its 0.1.0 release — against C's libdeflate across 144 benchmarks on the Silesia corpus. Roc came out a median 8.9% slower on an AMD Ryzen 9 3900X and 2.6% slower on a 2021 M1 MacBook Pro, with identical outputs, and only on non-streaming APIs since roc-deflate has no streaming support yet. The piece is framed against Lean 4's lean-zip, which beat Rust's miniz_oxide (15% faster at its fastest setting, 8.8% smaller output) but still lost badly to libdeflate.

Why: The concrete decision this informs: if you were planning to drop into C or Rust for a scalar, non-SIMD hot path, a single-digit-percent median gap (2.6% on M1) no longer justifies a rewrite — but libdeflate's edge comes from architecture-specific SIMD that the author says can't be expressed in Lean, so vectorization-heavy workloads still belong in C. Note the caveats before quoting the number: non-streaming APIs only, one optimizer, a pre-0.1.0 language, and a benchmark run on the author's own machines.

Philip O'Toole recounts twelve years of rqlite, the project he open-sourced in September 2014 after taking SQLite and putting a Raft log in front of it so every write replicates across a cluster. The first version used the goraft library (the same one InfluxDB and etcd used), replaced in early 2016 with Hashicorp's Raft implementation, which rqlite still uses; the defining choice was making it a CP system where writes go through the leader, a majority must acknowledge, and a partitioned minority refuses writes. He also credits earlier work — Expensify's Paxos-based Bedrock, released 2016, and the Erlang ActorDB — and notes Canonical's dqlite, built so LXD and later MicroK8s could have an embedded replicated store without running etcd, after a call with Mark Shuttleworth about whether rqlite could fit.

Why: If you reach for SQLite in a multi-node setup, this is the design trade-off laid out plainly: rqlite will refuse writes from a partitioned minority rather than accept them, so you get consistency at the cost of write availability during partitions — decide that before you pick it over an eventually-consistent store. It also maps the field you're choosing from: rqlite (Go, Hashicorp Raft), dqlite (C, its own Raft, built for LXD/MicroK8s without etcd), plus Bedrock and ActorDB, in a category O'Toole counts at roughly a dozen projects, some venture-funded and two acquired.

Wiz Research used AI models from OpenAI and Google to surface critical security vulnerabilities in PHP, the language the article says underpins roughly 70% of websites, and the PHP Foundation shipped updates in response. No active attacks have been confirmed, but many sites went offline preemptively to patch. The report gives no CVE identifiers, affected PHP versions, or exploitation details.

Why: If you run WordPress, Laravel, or any PHP-backed site or API, this is a same-week patch task, not a wait-and-see: update PHP and your CMS, then confirm the version actually changed on the host. The bigger signal for builders is that AI-assisted code review just found critical bugs in software used by most of the web — expect faster disclosure cadence and plan a patch window you can execute in hours, since sites in this story chose downtime over exposure.

Microsoft and Hugging Face describe ThinkingBox, a system that grades an agent by comparing the final database state against the expected outcome, across 507 tasks in ThinkingBox-Bench. They reused those 1/0 executable checks as GRPO reward signals on a separate training pool, filtered by 'offline policy-relative difficulty' — estimating each task's success probability with the base policy once, then keeping the pool fixed. After 50 GRPO steps on Qwen3.8-27B, average success across 10,140 attempts rose from 51.70% to 60.78%, and tasks passing all 20 attempts rose from 38 to 107; ThinkingBox-Training is now on GitHub.

Why: If your agents touch a stateful backend, your existing DB assertions are already a reward function — no LLM judge needed. The actionable part is the filtering rule: drop tasks the base model always solves or never solves, because both teach nothing. They measured base-model success once per task and froze the pool for the whole run, which is cheap enough to try on your own test suite before committing to a training run.

NVIDIA's OpenShell repo is an Apache-2.0 "safe, private runtime for fleets of autonomous AI agents" that lets you declare per-agent policy for files, packages, APIs, credentials and network access, and enforces it by instrumenting the kernel rather than trusting the agent's prompt. The project sits on a Rust core (crates/, Cargo.toml) with a Python SDK, providers, and e2ee directories, and carries 18.1k stars, 1.8k forks and 1,852 commits. It is on a 0.1.x line that ships a stable release cadence, new isolation primitives, an expanded extension surface and new APIs, with a dedicated 0.1.0 upgrade guide, and the Hacker News thread drew 387 points and 190 comments.

Why: If you are letting an agent run shell commands, pip install, or hold API keys, the choice you actually have to make is where the boundary lives: prompt instructions (unenforceable), a container (coarse), or kernel-level policy per agent (what OpenShell claims). Because it is Apache-2.0 and self-hosted, teams that cannot ship customer data or credentials to a hosted sandbox can run the enforcement layer inside their own infrastructure. Treat it as pre-1.0: 0.1.x explicitly changed isolation primitives and APIs, so pin a version and read the 0.1.0 upgrade guide before wiring it into anything that touches production credentials.

Microsoft says China state-aligned hackers breached ConnectWise's cloud backup service, stole application credentials used for customer data links, and accessed Microsoft-hosted email and files at around 2,250 organizations. The attackers used AI agents, including the open-source ARTEX framework, to attempt nearly 3,000 sign-ins per minute, and the same tooling was used in a recent compromise of South Korea's financial systems. ConnectWise has paused access to its cloud backup system and says it is investigating and restoring the service.

Why: If your team relies on ConnectWise Cloud Backup or similar MSP/backup integrations, treat linked app credentials as exposed: rotate or revoke them, enforce MFA and conditional access, and review sign-in logs for abnormal volume. For anyone building or deploying AI agents, this is a concrete case of agent-driven authentication abuse at roughly 3,000 attempts per minute, so rate limits, anomaly detection, and credential scoping are not optional.

Railway confirmed a cyberattack may have exposed encrypted environment variables and, for some customers, their decrypted contents, prompting it to tell all users to revoke and rotate API and cloud keys. The company paused customer deployments during the investigation and said initial analysis points to a subset of users, but it did not disclose how many were affected or the root cause. Railway said the breach was likely part of a broader campaign targeting platforms used to compromise AI inference providers.

Why: If you deploy on Railway, treat every secret in its environment variables as potentially exposed: rotate cloud, database, and API keys now, check provider logs for unfamiliar use, and verify whether paused deployments broke scheduled jobs or webhooks. For builders hosting agents or inference services, the stated AI-inference targeting makes token scoping and short-lived credentials a concrete design decision, not a hypothetical.

The 11th e-Conomy SEA report projects Southeast Asia’s digital economy at US$368 billion GMV in 2026, up 17% YoY, and over US$1 trillion by 2035. It says generative AI adoption has reached 243 million people, or 58% of the working population, but regional token usage is only about 10% of US levels, with consumers accounting for roughly 60% of tokens. Enterprise workloads are strongest in mature markets, driving 45%–60% of usage in Singapore and Malaysia, while demand for AI agents is projected to surge up to 60-fold by 2030.

Why: For builders targeting SEA, the report points to enterprise and agentic AI workflows as the under-penetrated opportunity: consumer AI reach is already broad, but token depth is only ~10% of US levels, and Malaysia/Singapore enterprise usage is already 45%–60%. If you are choosing what to build next, prioritize B2B agentic task delegation and e-commerce AI comparison/conversion features rather than assuming broad consumer adoption equals deep usage.

Malay Mail reports that critical PHP vulnerabilities affecting roughly 70% of the world's websites caused government agencies and companies globally to take sites offline on October 22. The flaws were discovered by security firms Wiz and Calif using advanced AI models, and exploit details leaked online a day before the planned fix release, prompting the rush to shut sites down. The excerpt stops before naming affected PHP versions or CVE IDs.

Why: If you run PHP, the pre-patch leak is the urgent part: exploit details were public before the official fix, so checking your PHP version and vendor advisory should happen before your normal maintenance window, not after. The article does not name affected versions, so you cannot map this to your stack from this text alone.

mitmproxy commit 1692344 (PR #8500, authored by mhils) adds a boolean `--emudhra` option, default False, that signs TLS certificates with what the changelog calls a "compromised eMudhra intermediate CA key." A companion change (PR #8499) updates the `certifi` dependency to remove eMudhra CAs from precompiled binaries. The commit touches 6 files (+139/-9), including tlsconfig.py and the generated web options, and drew 352 points and 94 comments on Hacker News.

Why: Two concrete actions: first, any Python service or container image using `certifi`'s bundled roots will stop trusting eMudhra-chained certs after the bump, so check whether your pinned certifi version and base images need a refresh before something breaks in production. Second, `--emudhra` gives you a ready-made way to test whether your own HTTP clients, SDKs, or agent tooling still accept a cert chained to the compromised intermediate — run it against your stack rather than assuming your trust store is clean.

The PHP project shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 Oct 2026 to fix two critical unauthenticated RCEs: CVE-2026-109618 (memory corruption when a request hits memory_limit at the wrong moment, demonstrable on Apache with mod_php before any application code runs, and reachable on PHP-FPM through app-level paths) and CVE-2026-109619 (a fatal error leaving stale state so a later request on the same worker reuses freed memory). The Foundation traces the OOM bug partly to its first external audit in years, funded by the Sovereign Tech Agency and run through OSTIF by Quarkslab, and notes a 2024 exploit theory that was never pursued because other issues took priority. The post's real ask is funding and organisational support from companies that depend on PHP, not just patching.

Why: If you run PHP — WordPress, Laravel, Magento, or an agency-maintained site — check the actual PHP version your host serves, not what your composer.json says: on shared or managed hosting the patch only lands when the provider updates it, and CVE-2026-109618 needs no application bug to trigger on mod_php. Builders who assumed a 2024-era theory was harmless now have a confirmed RCE from exactly that class of bug.

Scott Helme reports that eight eMudhra intermediate CA private keys were single-byte P-384 values (4, 56, 115, etc.), recoverable from public certificates in under a second; the intermediates were created in April 2025 — six TLS issuing CAs across DV/OV/EV and two code-signing CAs — and cross-signed by Sectigo's AAA root in May 2025. After a researcher reported the compromise on Saturday 17 October, Chrome blocked them via CRLSet that evening and Firefox via OneCRL hours later; Mozilla publicly announced on Tuesday 20 October and shipped an NSS update removing the eMudhra root, with Chrome Root Store v43 to follow.

Why: If your TLS or code-signing chain includes one of these April-2025 eMudhra intermediates or a Sectigo AAA cross-sign, replace it before the Chrome Root Store v43 and Firefox NSS removals propagate; bundled trust stores or pins that still include eMudhra will keep trusting a root browsers are dropping, while public clients will start failing those chains.

OpenAI says it led a two-month coalition of maintainers, researchers, and security providers to fix critical vulnerabilities in PHP, with Calif finding a critical flaw using GPT-5.6 Sol under its "Patch the Planet" initiative and Wiz independently discovering and reporting both vulnerabilities. PHP's maintainers led the fixes and release, with Wiz, Cloudflare, and others contributing research and pre-disclosure protections; OpenAI is publishing a PHP version checker and plans a Codex skill to help operators identify vulnerable PHP versions. OpenAI also committed $1 billion in subsidized Daybreak access for "Frontline Defenders" and warned it expects similar AI-found vulnerabilities to increase sharply in coming months.

Why: If you run anything on PHP — WordPress sites, Laravel apps, legacy internal tools — the actionable item here is checking your PHP version now rather than waiting for a CVE writeup, since the post names no versions or CVE IDs and points you at PHP's own release guidance plus OpenAI's version checker. The second decision: OpenAI says findings like this will "increase sharply," so a one-off scramble is the wrong response — build a repeatable way to inventory runtime versions across your fleet, because the next disclosure may land before your hosting provider patches.

On October 19, 2026 at about 17:00 UTC, Cloudflare learned that private keys for eight eMudhra intermediate certificates were compromised; because the keys are weak, an attacker could forge certificates for any domain and impersonate servers. Cloudflare says it has not found active exploitation on its services and has shipped fixes for Cloudflare One/WARP, the 1.1.1.1 app, and cloudflared, but customers still need to update origin servers and custom trust stores.

Why: If you run Cloudflare Tunnel/cloudflared or Cloudflare One/WARP, upgrade to the listed versions (cloudflared 2026.10.2; Windows/macOS/Linux 2026.8.2115.0; Android/iOS app-specific versions) and check origin servers with bundled or custom trust stores. Zero Trust Gateway users with an up-to-date client are automatically protected, but that does not cover your own trust configurations.

The PHP security team posted a pre-disclosure notice for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 (Critical), with a coordinated release set for Wednesday 21 October 2026 at 14:00 UTC. The announcement, posted by Jakub Zelenka to php.announce, gives no affected versions, no vulnerability class, and no exploit details, and states the team may ship earlier if details leak or active exploitation is detected. The Hacker News thread drew 811 points and 322 comments, largely speculation in the absence of technical detail.

Why: 14:00 UTC is 10:00 PM Malaysian time, so the patch lands overnight for local teams — decide now who is on call to apply it, and whether you can even control the PHP version. If you run Laravel, WordPress, or Drupal on shared or managed hosting, the upgrade is gated on your host's PHP build, not your composer.json, so message them today rather than discovering it tomorrow. Note that nothing about severity is knowable beyond the 9.2 rating: there are no affected version ranges yet, so don't guess at exposure or rewrite code before the advisory lands.

China's MOFCOM issued a policy proposal (not yet law) requiring pre-approval for frontier AI models and some other technologies before international sharing, with open-source tech slated for automatic approval; separately, DHS ordered that DeepSeek as a company and its models as a platform be excluded from federal civilian procurement, with unresolved questions about fine-tunes and models trained on DeepSeek outputs (e.g. Nvidia Nemotron). DeepSeek also published its internal inference stack, DeepInfer, which the authors say is likely more efficient than vLLM/SGLang for its models, with estimates of up to 90% gross margin on token sales and an expectation that inference providers will adopt it and push DeepSeek model prices down.

Why: If DeepInfer gets adopted by inference providers, DeepSeek API/token pricing likely falls — so teams currently routing agent workloads to pricier models have a concrete reason to re-benchmark cost per task rather than re-architect. The DHS order only bars DeepSeek from federal civilian procurement, so commercial use is not banned, but anyone building on DeepSeek fine-tunes or on models trained on DeepSeek outputs (e.g. Nemotron-style recipes) now has an open provenance question to track before pitching US public-sector customers.

DeepSeek open-sourced DeepInfer, the inference framework it says powers its large-scale production services, under Apache-2.0. The release supports exactly one model (DeepSeek-V4.1-Flash) and offers offline inference only, bundling FlashMLA, DeepGEMM, DeepEP, TileKernels, DeepSelect and custom TileLang kernels, plus DSpark/confidence-scheduled speculative decoding (DEEPINFER_ENABLE_MTP_VARLEN=1, DEEPINFER_USE_NEXTN_DECODE default 5), SWA bounded replay (DEEPINFER_YOCO_PREFILL_TRUNCATION_MODE=compact, DEEPINFER_YOCO_PREFILL_KEEP_TOKENS=140), zero-overhead async batch scheduling on by default, batch-invariant inference and deterministic sampling. The repo shows 5.4k stars, 405 forks and only 3 commits, and the HN thread drew 1,962 points and 760 comments.

Why: If you are self-hosting DeepSeek-V4.1-Flash, this is the vendor's own kernel stack rather than a reimplementation, so it is the baseline to benchmark against your vLLM/SGLang setup before migrating. The catch is scoped: one model, offline batch inference only, 3 commits, no serving/API layer — so treat it as a tuning reference and a benchmark target, not a drop-in production server, and check whether the 140-token SWA replay suffix and 5-token default draft length fit your prompt-length distribution. There is no Malaysian or SEA-specific angle in this release; local relevance is limited to cost of self-hosted inference capacity.

The Hugging Face PyTorch team detailed what lands in PyTorch 2.15's MPS backend for Apple Silicon: FP8 (float8_e4m3fn) storage and scaled matmul, a native grouped matmul with a dedicated MoE decoding path, specialized matrix-vector kernels for single-row linear layers, and a softmax over the vocabulary that is about 8x faster. Measured on an M3 Ultra with torch.compile, Qwen3.6-35B-A3B goes from 9.4 to 61.3 tokens/s and LFM2.5-8B-A1B from 23.6 to 123.6 tokens/s versus 2.14, while Wan2.2's tiled VAE video decode drops from a 270 GiB peak to 8 GiB. The release also exposes public MPS streams, adds complex LU and triangular solves plus faster small-matrix inverses and QR on GPU, and raises requirements to macOS 15+ and Python 3.11+; 2.16 is slated to move attention fully onto Metal.

Why: If you run local models on a Mac (transformers, diffusers, ComfyUI), the upgrade gate is the decision: PyTorch 2.15 needs macOS 15+ and Python 3.11+, so anyone on macOS 14 or Python 3.10 stays on 2.14 and gets none of the 5-6.5x MoE decode gain. For those who can upgrade, the Wan2.2 VAE number (270 GiB to 8 GiB peak) is the concrete one: video decode that previously needed a datacenter GPU now fits in unified memory, which changes whether local video generation is viable for you at all.

Josephine Pfeiffer documented getting Arch Linux ARM running on an ASUS ProArt P16 H7607BA-SE033W (128 GB RAM, 6,144 CUDA cores, 2 TB SSD, 3840×2400 120 Hz) despite Windows-only official support. The build required a patched hid-asus for the keyboard, a custom audio machine driver, ACPI overrides derived from the laptop's own tables, and an extension to upstream Archinstall 4.5; after all that, Arch keeps pace with Windows in 7-Zip and reports the same 116.0 GiB memory pool to both the OS and CUDA. The repo ships build scripts, hash-pinned inputs, and hardware packages signed with the author's Arch Linux Package Maintainer key, with instructions to dump your own ACPI tables and extract speaker firmware locally.

Why: If you were weighing this class of machine for local open-weight model work, the write-up confirms the Windows-only driver situation is surmountable without losing the 116.0 GiB unified pool CUDA sees — that number, not the OS, is the reason to buy it. But the cost is real: a patched hid-asus, a bespoke audio driver, per-machine ACPI overrides, and firmware H7607BA.300 assumed. Decide whether you're willing to dump your own ACPI tables and rebuild against a specific firmware revision before spending on the hardware; there is no official support path if a BIOS update breaks it.

OpenCode said attackers breached an older system overnight and affected 1.4% of OpenCode Console users, where some users store API keys for AI providers. Developers reported spend alerts and unauthorized charges in the hundreds of dollars, with a few above $1,000; Anthropic and Google blocked exposed keys, OpenAI refunded API credits, and OpenCode says refunds are underway. The company called it a "large-scale distillation attack," while skeptics said the distillation use is unproven.

Why: If you use OpenCode Console—or any AI coding agent that stores provider API keys for you—rotate those keys now and set hard spend limits with OpenAI, Anthropic, and Google. The reported charges reached hundreds to over $1,000 per account before providers and OpenCode responded, so storing long-lived provider keys in a third-party console is a concrete risk to decide on, not a hypothetical one.

An Ask HN thread (245 points, 388 comments) by user rzk asks how engineers handle shipping AI-written code they don't fully understand, quoting a LinkedIn post from someone who describes themselves as an engineer at Meta saying their code now feels like a black box and that reviewing every line 'is going to take forever.' The replies split sharply: one commenter with roughly 20 years of experience says they prompt AI and don't review the code at all, comparing it to not understanding how their car or residence was built, while others argue about how much understanding is actually required before shipping.

Why: The thread gives you no consensus to copy, so you have to pick a review threshold yourself — and the specific pressure point is the quoted claim that line-by-line review doesn't scale. Decide per-repo which files must be understood before merge (auth, payments, data migrations, anything touching production state) versus which you'll accept at the high-level-only level, and write that down before the next AI-assisted PR lands, because the commenters who skipped review entirely and the ones reviewing everything are both operating without a stated rule.

Jared Siegel argues that anyone building with LLMs should run their own proxy rather than relying on a paid frontend's analytics panel, which he calls unusable for engineering decisions. He lists five concrete reasons: one endpoint across multiple providers and models, logs of which key called which model with which client and at what time plus status, virtual API keys so your main key isn't scattered across work, agents and harnesses, infrastructure you control, and the ability to switch model or provider without re-plumbing everything. He also notes he has modified his own proxy for custom MCP server endpoints and better insight, and that pinpointing a cache miss during a coding session takes him about 20 seconds by hand because the proxy exposes an API.

Why: If you are pasting one provider key into multiple agents, harnesses and side projects, you currently cannot answer 'which of these burned the tokens' or 'which one started failing' — request-level logs behind virtual keys answer that. Decide now whether your next agent project routes through a self-hosted proxy you can modify, because retrofitting visibility after the key is spread across five tools is the expensive version.

DeepSeek shipped two raw JSON endpoints under its existing API key auth: POST /v1/tools/search (in-house search engine, returns structured results) and POST /v1/tools/fetch (single page returned as Markdown). Search takes count 1–50 (default 10), an optional need_content flag that inlines page content in the same call, an ori_question field for query rewriting, an IP-based localization field, and supports site:/ -site: operators. Pricing listed in the title is $0.75 per 1,000 successful requests; the HN thread drew 223 points and 104 comments.

Why: At $0.75 per 1,000 successful requests that's roughly $0.00075 per search — worth pricing against whatever you currently pay Tavily, Exa, or Brave inside an agent loop. Setting need_content=true collapses search+fetch into one request, so you drop a round trip and a second billable call per agent step; the localization field lets you pass an IP to bias results toward Malaysian sources instead of getting US-default rankings. Check the 'successful requests' definition before you budget, since failed or empty searches may bill differently.

Pele is a new zero-dependency open source library that renders Mermaid syntax directly to SVG, themeable through CSS custom properties (--pele-bg, --pele-fg, --pele-line, etc.) so colour changes apply without re-rendering. Its README claims 230 kB gzip versus Mermaid.js's 1.6 MB, render times of 0.05–0.3 ms versus 6–82 ms, and support for every diagram type in Mermaid 12.1.0; it was built for Obsidian to render diagrams quickly and match themes. The Hacker News thread drew 266 points and 26 comments.

Why: If you render Mermaid in a docs site, note-taking plugin, or any client-side editor, the claimed size difference (230 kB vs 1.6 MB gzip) and per-diagram render cost (sub-millisecond vs 6–82 ms) decide whether diagrams can redraw on every keystroke instead of being debounced or server-rendered — and CSS-variable theming means dark/light switching costs no re-render. Treat the numbers as the author's own claims, not independent measurement: benchmark Pele against your actual diagram corpus before swapping out Mermaid.js, especially for the less common diagram types.