AI Weekly Malaysia

Polars 2.0 shipped on 6 Oct 2026, with the release post by Ritchie Vink covering initial out-of-core (spill-to-disk) support, a new Map dtype, stricter dtype handling and explicitness, and SQL promoted to a first-class interface. The post reports first-party TPC-H/TPC-DS benchmarks on a c7a.4xlarge (16 vCPU, 32 GB) and a c7a.metal (192 vCPU, 384 GB) against DuckDB 1.5.6, DuckDB 2.0 alpha (2.0.0.dev2610011535) and DataFusion 54.0.0, best-of-5 runs with a 60-second timeout, claiming Polars is fastest on all but one benchmark. DataFusion timed out on TPC-DS q72 (and once on q67) and ran out of memory on TPC-H q18 on the smaller machine, and those queries are excluded from the comparison for all engines. The Hacker News thread drew 416 points and 96 comments.

Why: If you have a pandas or DuckDB job that dies on a laptop with 16 GB of RAM, Polars 2.0's spill-to-disk support is the specific new thing worth testing this week, and SQL as a first-class interface means you can reuse existing SQL rather than rewriting in the expression API. Read the benchmark numbers with care before switching: they are first-party, and the queries where DataFusion failed (q72, q67, q18) were dropped from the sums and geometric means for every engine, so the headline win excludes the cases that were hardest for a competitor. The reported constant overhead when scaling to 192 threads is also the number to watch if you run Polars on large multi-core cloud instances rather than a laptop.

Microsoft Threat Intelligence describes a ClickFix variant where compromised websites pre-fetch a VBScript payload into the victim's browser cache disguised as a PNG, so the command a user is tricked into pasting into the Windows Run dialog just executes content already on disk. This sidesteps the ~260-character truncation limit of the Run dialog that normally breaks long ClickFix one-liners. The staged VBScript enumerates files starting with "f_" in the Firefox profile folder (e.g. %LOCALAPPDATA%\Mozilla\Firefox\Profiles), copies the byte-length-matching cache entry to %LOCALAPPDATA%\Temp\t.vbs, runs it via wscript.exe, harvests host data over WMI, pulls v.ps1 from cocojambo[.]us[.]com/alfa, then cab.dat, loads .NET assemblies in memory and injects into timeout.exe, with a second in-memory stage from capsysnet[.]vg to target browser and device credentials.

Why: The attacker no longer needs a long paste, so the old heuristic of "the Run box cuts it off at ~260 chars" no longer protects anyone. If you or teammates copy-paste install or 'fix this error' commands from web pages, treat that as the primary infection path: the new IOCs to hunt are wscript.exe launched against %LOCALAPPDATA%\Temp\t.vbs and cache entries whose byte length matches a VBScript, plus outbound calls to cocojambo[.]us and capsysnet[.]vg. There is no Malaysian or Southeast Asian angle in this text; it applies to Windows users anywhere.