AI Weekly Malaysia

Tottenham Hotspur replaced VMware with HPE GreenLake (OpsRamp + Morpheus VM Essentials) on ProLiant Gen12 servers and Alletra storage, citing over 85% licensing savings. CTO Rob Pickering attributed the move to Broadcom's post-acquisition bundling and focus on VMware's 10,000-30,000 largest customers, framing virtualization as a commodity whose value drops further if not integrated into a broader AI operation stack.

Why: If you're running VMware and facing Broadcom renewal hikes, this is a concrete datapoint: Morpheus VM Essentials under HPE GreenLake is a viable replacement path, and the 85% saving figure gives you a benchmark for negotiation or migration planning. Pickering's framing—virtualization is a commodity unless tied into an AI/ops stack—suggests evaluating whether your hypervisor spend is blocking budget for AI infrastructure.

Researchers identified 13 malicious Composer theme packages on Packagist across five vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms) that inject JavaScript into Vietnamese movie and comic streaming sites. The injected code runs ad-fraud redirects and, on unpatched iPhones, triggers a WebKit-to-kernel exploit chain using CVE-2025-31277 and CVE-2025-43529 to install spyware that steals keychain databases, crypto wallet seeds, and other sensitive data.

Why: If you ship PHP apps using Composer, audit your dependencies for any of the listed package names and verify that theme packages come from legitimate vendor namespaces. The attack shows that typosquatted or trojanized Packagist packages can turn your site into a delivery mechanism for zero-day iOS exploits—meaning your supply chain hygiene directly affects your visitors' device security, not just your own infrastructure.