AI Weekly Malaysia

Researchers at UMass Amherst demonstrated a 'Zombie Card' attack that rewrites the expiration date a POS terminal reads from an expired Visa contactless card over NFC, reviving it for in-store purchases without breaking the card's cryptography. The attack requires physical possession or sustained NFC proximity plus a MitM relay, and only succeeded at one of three tested US banks; another declined all attempts and a third used a different EMV kernel where the modification failed. Disclosed to Visa in May 2025, no CVE, no exploitation, and no published mitigation exist as of August 2026.

Why: If you build or integrate contactless payment flows in Southeast Asia, this highlights that Visa's Kernel 3 does not enforce consistency between the terminal-facing Application Expiration Date (tag 5F24) and the issuer-facing Track 2 expiry (tag 57), meaning your issuer-side authorization logic must independently re-check expiry rather than trusting terminal-validated data. Builders should not assume EMV contactless specs close this gap.

Zimperium zLabs reports ToxicPanda 2.0 (aka TgToxic) has expanded from targeting 16 banking apps to 349 financial institutions across 16 countries, with 167 remote commands and PIN harvesting via fake overlays. The malware abuses Android accessibility services to enable Wireless Debugging through ADB for privilege escalation, overwrites lock screen PINs, and exempts itself from battery optimization to persist in the background.

Why: If you build or ship Android fintech or banking apps in Southeast Asia, your users are now in the expanded targeting scope of a malware that can harvest credentials and escalate to shell-level access via accessibility services. Review whether your app detects accessibility-service abuse or warns users, since the attack chain relies on users granting accessibility permissions and Device Administrator privileges.

Pine64 has halted all Linux hardware manufacturing — including SBCs, tablets, and phones — through at least mid-2027 due to memory component shortages. The freeze affects the entire open-source maker hardware lineup with no indicated workaround or alternative supplier.

Why: If you rely on Pine64 SBCs or devices for prototypes, edge deployments, or homelab infrastructure, you need to source alternatives now — existing stock will deplete and no new units will appear for roughly a year. Consider pivoting to Raspberry Pi, Orange Pi, or x86 mini PCs for projects that were targeting Pine64 form factors.

Tan Chong Ekspres Auto Servis (TCEAS) launched a mini-program inside TNG eWallet, letting users book and pay for car servicing across 40+ centres nationwide. Launch Rahmah bundles start at RM109 (semi-synthetic) and RM129 (fully synthetic), covering engine oil, filter, inspection, and labour with a 6-month warranty.

Why: TNG eWallet continues to expand its mini-program ecosystem beyond payments into service booking and fulfilment. Founders and developers building for Malaysian consumer platforms should note that TNG eWallet is now a viable distribution channel for appointment-based services, not just top-ups and retail payments.

Socket Threat Research identified 40 malicious Firefox extensions impersonating Web3 wallets like OKX, Rabby Wallet, and TronLink to steal recovery phrases, private keys, and clipboard data. The campaign, active since March 2026, used Supabase projects as remote switches and Cloudflare Workers for exfiltration, with some extensions initially published as innocuous sports-score utilities before being repurposed into wallet-stealing malware under the same Firefox ID.

Why: If you build or ship browser extensions, the repurposing tactic here—publishing a benign utility first, then updating it to malicious functionality under the same extension ID—is a supply-chain pattern worth auditing in your own extension review processes. For anyone in Web3, avoid installing wallet extensions from Firefox's marketplace without verifying publisher identity against official sources, since 40 confirmed malicious add-ons passed through the official store.

Microsoft will stop selling the license-included Azure VMware Solution (AVS) on October 31, 2026, and existing AVS environments will stop working after August 30, 2027. Customers must acquire Broadcom's Cloud Foundation (VCF) licenses directly and move to a BYOL arrangement, as Broadcom now requires all hyperscale partners to stop selling VMware licenses. This closes one of the last ways to run VMware without buying the full VCF bundle.

Why: If your org runs VMware workloads on Azure via the license-included AVS, you have a hard deadline of August 30, 2027 and must start negotiating VCF licenses with Broadcom now—Microsoft explicitly warns current rigs won't work after that date. For Malaysian SMBs or enterprises that relied on AVS as a cheaper VMware path, this forces a migration decision: buy full VCF, move to an alternative hypervisor (Proxmox, Hyper-V, etc.), or refactor to cloud-native. The October 31, 2026 sales cutoff means no new license-included AVS deployments after that date.

Waymo has opened its next-generation robotaxi, the Ojai, to all riders in Los Angeles, Phoenix, and San Francisco, with roughly 300 units currently in its commercial fleet. The Ojai is a Zeekr minivan built on Geely's SEA-M platform, equipped with Waymo's sixth-generation modular self-driving system and Google's Gemini AI as an in-car rider assistant. Waymo plans to expand the Ojai to Denver, Las Vegas, and San Diego later this year.

Why: The Ojai runs on a Chinese EV platform (Zeekr/Geely SEA-M) paired with Gemini AI as an in-car assistant — a concrete example of LLM-powered agents embedded in consumer hardware at scale. Builders working on AI agents or automotive/ride-hailing tech can study how Waymo integrates Gemini for rider interaction and how modular sensor stacks are designed to port across vehicle types. No direct Malaysia impact, but the Zeekr/Geely supply chain connection is relevant if Chinese EV platforms expand into Southeast Asian mobility markets.

Travis Kalanick, now raising mega-rounds for his robotics company Atoms ($1.7B led by Andreessen Horowitz), told David Senra's podcast that only 10% of VCs 'do no harm' and just 1% are genuinely helpful, advising founders not to take Benchmark's money due to his 2017 ouster. He framed the founder-VC relationship as a chess master dealing with a chess enthusiast who drops in occasionally.

Why: For founders evaluating term sheets, Kalanick's framing reinforces a concrete heuristic: treat VC money as capital with strings attached, and diligence the specific partner—not the fund—for operational depth. Malaysian founders raising from regional or global VCs should pressure-test whether a partner can actually contribute beyond capital, since Kalanick's '1% helpful' claim suggests most won't.

Google has tapped Marvell to develop custom silicon for its TPU ecosystem—including AI inference accelerators, storage controllers, NICs, and memory interface controllers—alongside its existing Broadcom partnership. Marvell offered Google a warrant for ~59 million shares (~$12.2B) to cement the deal, giving Google leverage to pit Broadcom and Marvell against each other on price and performance.

Why: For builders running workloads on Google Cloud TPUs, this signals Google is actively diversifying its silicon supply chain, which could eventually affect TPU pricing, availability, and roadmap cadence. SaaS founders heavily dependent on Google Cloud AI infrastructure should note that multi-vendor competition tends to drive down costs over time, but no immediate action is required—this is a multi-year chip-design collaboration, not a product launch.

A developer found a locked Cricut Maker in e-waste and bypassed its deactivation by intercepting USB CDC communication between the cutter and computer using Wireshark, then building an RP2040-based USB proxy (running TinyUSB Arduino examples, overclocked to 240MHz) that rewrites the serial number in transit. The serial number packets had no checksumming or crypto, making the proxy straightforward. Replacement rollers were cheap and readily available, restoring full functionality.

Why: If you ship connected hardware that phones home for activation, this shows how trivially a USB man-in-the-middle can defeat server-side lockout when the device protocol lacks signing or checksums. Founders and engineers building IoT or cloud-locked devices should treat this as a concrete lesson: any device-level identity sent over USB without cryptographic integrity can be spoofed with a $1 microcontroller.

Apple introduced simplified EU App Store business terms on August 18, consolidating developers onto a single fee structure: 26% for Apple In-App Purchase (15% for qualifying devs/subscriptions after year one), 20% for alternative payment processors (10% qualifying), 15% for web link-outs (10% qualifying), and a 5% 'Core Technology Commission' for apps distributed via alternative marketplaces or the web. Epic Games called the fees 'junk' and said the plan fails to open the mobile ecosystem as required by the DMA, while consumer group BEUC cautioned that 'the devil is in the detail.'

Why: If you ship apps to EU users, these are the new commission tiers you need to model into your pricing — but the rates remain high enough that alternative distribution may not save much money, and the legal fight isn't over. For Malaysian builders not targeting the EU, this is a signal of where App Store economics may eventually shift globally if other regulators follow the DMA precedent, but there is nothing to change today.

Samsung is reportedly raising advanced foundry prices by up to 15%, with its 4nm process lines filled by AI-driven demand. Chinese customers are reportedly accepting the largest price increases.

Why: If you ship hardware-dependent products or rely on chips fabricated at Samsung's foundry, budget for rising component costs in upcoming procurement cycles. The 4nm capacity constraint signals that AI demand is crowding out other fabrication customers, which could lengthen lead times for non-AI silicon orders.

China's 'Eastern Data, Western Computing' policy is relocating large AI data center complexes to rural provinces like Guizhou to exploit surplus energy, with Huawei and Tencent building infrastructure there. The article itself is mostly boilerplate; the substantive detail is limited to the headline.

Why: For builders in Malaysia and Southeast Asia, this signals that China's AI compute capacity is being geographically redistributed to lower-cost energy regions, which could eventually affect regional cloud pricing and availability for Huawei Cloud and Tencent Cloud services. If you rely on either provider or compete against them, factor this rural-buildout trend into your 12-24 month infrastructure cost planning rather than assuming current capacity distribution holds.

Calendly is launching a meeting note-taker that joins, records, transcribes, summarizes, and drafts follow-up emails, plus a planned AI assistant named Callie that leverages its scheduling stack to set up meetings and surface context from prior meetings. CEO Tope Awotona positions the product around post-meeting workflow automation for sales and marketing users, differentiating from crowded competitors like Granola, Fireflies, Read AI, Otter, and Fathom. Calendly also claims a privacy edge by notifying participants of recording, as Otter and Granola face privacy allegations.

Why: If you already use Calendly for scheduling, this could consolidate two tools into one and reduce integration friction—but the note-taker market is saturated and this is a launch announcement, not a proven differentiator. Founders evaluating meeting AI should weigh whether Calendly's scheduling-data integration (availability, prior meeting context) is worth more than standalone tools' maturity. Privacy-conscious teams should note the Otter/Granola allegations and ask any note-taker vendor how recording consent is handled.

Check Point Research uncovered a cybercrime operation dubbed StopAndProtect that has compromised nearly 2,000 WordPress sites—most running outdated WordPress versions and plugins—to serve as malware hosting, C2 servers, and exfiltrated-data storage. The campaign uses ClickFix social engineering (fake CAPTCHA prompts) to trigger PowerShell execution, deploying a toolkit including ransomware, credential stealers, SMB/USB worms, and screen lockers, though data theft is more common than ransomware deployment.

Why: If you or your clients run WordPress, patch core and plugins immediately—compromised sites here were running versions from 2021 with ~40 known vulnerabilities. For builders using WordPress as a marketing or docs site alongside a SaaS product, this is a reminder that neglected WordPress instances become attack infrastructure that can harm your visitors and reputation.

A first-person account of how sondehub.org started as a joke URL redirect to Habhub in 2018, then evolved into a full radiosonde tracking service as Habhub's infrastructure struggled under volume. The project moved from proxying data through AWS to building backwards-compatible APIs, running its own predictor, and exposing open data via S3 — attracting government information requests along the way.

Why: The article is cut off before reaching its 'geopolitical warfare' payoff, so the practical takeaway is incomplete. What's visible is a useful case study in how a toy AWS experiment became load-bearing community infrastructure: if you run a side project that proxies or aggregates data others depend on, plan early for the transition from redirect-to-someone-else to running your own APIs and backend, because upstream rate limits and server strain will force it.

Taiwan's AI server export boom drove 11% GDP growth and a $903B export surge, financing a $7.4B universal dividend that pays every resident $314. President Lai Ching-te framed the payout as ensuring the AI windfall 'can be shared by all.'

Why: Taiwan is capturing enormous economic value from AI hardware manufacturing — a model Malaysian policymakers and builders can compare against Malaysia's own data center push. If Malaysia's infrastructure play generates similar export surpluses, the question is whether that value reaches the broader population or stays with foreign hyperscalers.

Relativity Networks raised $22M in SAFE note funding plus a $40M follow-on order from an unnamed hyperscaler to deploy hollow-core fiber in data centers. Hollow-core fiber transmits light through a vacuum chamber instead of glass, cutting per-kilometer latency from ~5 microseconds to ~3.5 microseconds—a 30% speedup that matters as AI compute spreads across multi-campus deployments spanning hundreds of acres.

Why: For builders running distributed AI training or inference across multiple data center campuses, hollow-core fiber could become a meaningful latency-reduction lever as GPU clusters physically separate. No action needed now—it's early-stage hardware—but worth tracking if you architect multi-region AI infrastructure or evaluate colocation partners, since hyperscalers are already placing orders.

The White House has removed data centers, batteries, and augmented reality from its list of critical and emerging technologies, while adding post-quantum cryptography, integrated photonics, and high entropy alloys. The article text itself is mostly site navigation and membership boilerplate, so detailed policy rationale is not available from this source.

Why: If you ship SaaS or infrastructure products into the US market, the delisting of data centers from the critical tech list could signal reduced federal prioritization or fewer export-control frictions around data center components, while the addition of post-quantum cryptography means US-facing products may face future compliance expectations around PQC readiness. Malaysian founders selling into the US should track whether this translates into procurement or grant shifts, but this source alone doesn't confirm that.

Baidu told investors that Chinese buyers are turning to domestic AI chips because Nvidia's supply into China remains blocked, with Beijing retaining a veto over foreign chip purchases. Baidu's Kunlunxin unit, which makes CUDA-compliant inferencing chips used by Huawei and ZTE in telco kit, is preparing to list. Baidu's AI cloud revenue grew 50% YoY to nearly $1.1 billion.

Why: If you build on Chinese cloud providers or use infrastructure that sources Chinese-made AI accelerators, expect inferencing hardware options to diverge further from the Nvidia/CUDA mainstream. For SEA builders not on Chinese clouds, the practical signal is that inferencing demand is driving a separate chip ecosystem—worth noting if you compare cloud GPU pricing or consider multi-cloud strategies that include Chinese providers.

Proton's EV subsidiary Pro-Net is rolling out Proton e.MAS-branded EV charging stations starting Q3 2026, partnering with ChargEV, DC Handal, and JomCharge. e.MAS EV and PHEV owners get discounted charging rates when activating and paying through the Proton e.MAS app, though specific rates are undisclosed. The app already integrates a live map of 4,700+ charging points nationwide, with charger activation and payment currently limited to the mobile app.

Why: If you're building in the Malaysian EV or mobility payments space, Proton's app-gated discount model creates a closed-loop payment ecosystem worth studying—charger activation is locked to their app, not third-party payment rails. Founders exploring EV-adjacent SaaS or charging infrastructure should note that Proton joins only Tesla and Mercedes-Benz in offering integrated charging in Malaysia, signaling a consolidation trend among automaker-controlled charging networks.

OpenLogi is an open-source, local-first alternative to Logitech Options+ written in Rust. It allows users to remap buttons, control DPI, and manage SmartShift over HID++ without requiring an account or telemetry, storing configurations in a plain TOML file. It supports macOS, Linux, and Windows.

Why: If you use a Logitech MX Master or similar device and want to ditch the heavy official software, you can replace it with OpenLogi to manage per-app profiles and button bindings locally via a simple TOML config.

Anthropic's blog interviews Slack CPO Jaime DeLanghe on building human-agent teams, arguing that workplace conversation in public channels is the context agents need to be useful. The core advice: default to public channels so agents can see decisions, ask agents to reconstruct reasoning rather than just retrieve records, and widen the surface area of accessible context across tools like Slack and Claude.

Why: If you're deploying agents in a Slack-heavy org, the practical takeaway is to shift team norms toward public-channel communication now—DMs and private threads are invisible to agents and permanently lost as training context. This is a culture change, not a tooling change, and it's worth deciding whether your team will commit to it before investing in agent integrations.

Apple replaced its EU per-install Core Technology Fee with a flat 5% commission on digital goods sold through alternative app marketplaces or the web. In-app purchase fees dropped to 26% from 30%, and alternative payment processing costs 20% (10% for qualifying programs). Apple also made it easier for developers to open alternative app stores, following a €500M EU fine and criticism that prior terms were 'malicious compliance.'

Why: If you ship iOS apps to EU users, recalculate your distribution economics now: the old per-install Core Technology Fee is gone, replaced by a flat 5% on out-of-store transactions, which changes the break-even math for web or alternative marketplace distribution. Malaysian founders with EU revenue should compare the new 26% IAP rate and 20% alternative payment rate against their current setup before the next billing cycle.

Apple's iOS 26.6.1 / macOS Tahoe patch batch includes CVE-2026-65346, an integer-overflow bug in the ImageIO framework that could allow arbitrary code execution when a device processes a malicious image. Discovered by Nik Tsytsarkin of Meta's Red Team X, the flaw affects iPhone 11 and later, supported iPads, and Macs; experts note image-parsing bugs have historically been zero-click spyware delivery vectors (e.g., FORCEDENTRY/Pegasus). The batch also includes CVE-2026-65329 in Apple's Telephony component, which could let a privileged network-position attacker bypass IPsec authentication and intercept traffic.

Why: If you or your team develop on or manage Apple devices (iPhone 11+, macOS Tahoe, Vision Pro), install the August 17 updates now—image-processing zero-click exploits have been the primary delivery mechanism for commercial spyware like Pegasus. If your org relies on IPsec-based connectivity on iOS, patching is especially urgent due to the Telephony traffic-interception flaw.