AI Weekly Malaysia

DuckDB 2.0.0 LTS, codenamed "Cinnamon Teal", is out with close to 20,000 commits since 1.5 and is supported until at least October 2027. Headline features include a polished Quack client-server protocol with a new CONNECT statement for attaching and switching to a remote database in one command, asynchronous I/O, a first-class VARIANT type, agent mode, triggers, and an extensible SQL parser. It is explicitly a feature release with breaking changes and a migration guide, and only the CLI and Python clients are available immediately — Go, R, Java and some extensions can lag by a few days.

Why: If you pin DuckDB anywhere, the support calendar just shifted: 1.4 runs to late November 2026, 1.5 was extended to March 2027 (now effectively LTS too), and 2.0 runs to at least October 2027 — so decide which line you standardise on before the November 2026 cutoff. Because 2.0 carries breaking changes and the Go/R/Java bindings ship days later, upgrading production pipelines this week risks a version mismatch between your Python/CLI tooling and your service bindings; read the migration notes first. The new CONNECT statement and Quack protocol also mean you can now attach a remote DuckDB over its native protocol, which changes whether you need a separate warehouse for small multi-service setups.

On Friday 2 October at 09:35, 333 compromised Tor exit relays — roughly 10% of Tor's ~3000 exit relays — began a coordinated campaign to intercept SSH connections on port 22 and harvest unencrypted mail traffic. The servers had been breached two months earlier in August with an Ebury 1.8.3 payload (an OpenSSH backdoor and Linux credential stealer), and SSH sessions were silently redirected to one of 12 interception servers, which stole passwords, watched commands, and reinfected the connecting server. The author reported it to the Tor Project's network health team that evening; relays were marked BadExit on Sunday 4 October, and by Monday 5 October the attackers' restarted relays could only serve as middle relays before all infected servers were shut down.

Why: The concrete lesson is that the SSH "REMOTE HOST IDENTIFICATION HAS CHANGED" prompt is not a formality — in this campaign, accepting it handed over your password and pushed Ebury onto your own box. If any of your tooling or CI connects over Tor, or if you have StrictHostKeyChecking disabled or set to accept-new in scripts, you would have sailed straight through this without seeing the warning at all. Decide now how your team handles a changed host key: verify the fingerprint out-of-band (the intercepted ED25519 key here was SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E) rather than clicking yes.

The Hacker News reports that Rank Math PRO, a widely installed WordPress SEO plugin, was "hijacked to deliver a self-restoring backdoor." The supplied text is only the headline plus site boilerplate — it cuts off before any affected version numbers, distribution mechanism (update server vs. nulled/bundled copy), indicators of compromise, or vendor response. Treat the specifics as unconfirmed until the full article or Rank Math's own advisory is read.

Why: If you run client or company sites on WordPress with Rank Math PRO, the descriptor "self-restoring" implies the backdoor likely re-establishes itself, so the usual fix — delete the plugin folder, reinstall from wordpress.org, done — is probably not sufficient remediation. Until the article gives affected versions and IOCs, the practical move is to pull a file-integrity baseline of wp-content/plugins/rank-math and compare against a known-clean copy, and to check whether the site pulls plugin updates from anywhere other than the official channel. Do not treat this as actionable for your stack beyond that until version details exist.