AI Weekly Malaysia

StreetComplete's long-running iOS tracking issue (#5421, opened Dec 20, 2023) has reached 11/11 completed tasks and is now in public beta on iOS. The port keeps the app's 100% Kotlin codebase and uses Kotlin Multiplatform with Compose Multiplatform for the UI, rather than rewriting everything in Dart as Flutter would require (the approach Every Door took). The plan explicitly includes incrementally migrating the existing Android XML layouts to Jetpack Compose and separating platform-specific code from application logic; the repo has 4.9k stars and 457 forks, and the HN thread drew 309 points and 63 comments.

Why: If you maintain a Kotlin Android app and have deferred iOS, this is a concrete worked example of the KMP path: one codebase retained, but the entire UI still has to be re-created in Compose Multiplatform — so the real cost is a UI migration, not a free second platform. The decision point it sharpens is KMP vs Flutter: StreetComplete chose KMP specifically to avoid rewriting its Kotlin logic in Dart. There is no Malaysian or SEA angle in this text; the impact is limited to teams doing cross-platform mobile work.

On September 30, Dion Blazakis, Josh Maine, and Anna Groza of Calif published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw triggered by a PDF carrying a crafted embedded TrueType font whose glyph coordinates overflow during conversion to 32-bit fixed-point. Apple patched it September 28 — iOS 26.7.1 was the only library changed, and the same fix was applied more than 20 times across eight rasterizer functions — crediting Meta Product Security and saying it may have been used in an 'extremely sophisticated attack against specific targeted individuals' on iOS versions before iOS 27; CISA added it to the Known Exploited Vulnerabilities catalog the next day with an October 2 deadline for federal agencies. The published code crashes unpatched iPhones and Macs but does not demonstrate code execution, and no workaround was described for systems that cannot update immediately.

Why: If you ship iOS or macOS apps that render untrusted PDFs or fonts, the concrete decision is: confirm your users are on iOS 26.7.1 or later, because there is no described workaround for anyone stuck on older builds. The root cause is more useful than the CVE itself — two of eight near-identical rasterizer functions handled out-of-range glyph coordinates differently (one saturated, one truncated), producing a bounding box too narrow and an undersized buffer. If you own any float-to-fixed-point or unit-conversion code, that saturate-vs-truncate split, and the fact that one fix had to be duplicated 20+ times, is a specific review target.

404 Media reports that Magnet Forensics, the company behind the GrayKey iPhone unlocking tool sold to law enforcement, claims in a leaked promotional video to have defeated Apple's iOS 'inactivity reboot' — the feature Apple quietly added around November 2024 that reboots an iPhone after 72 hours without an unlock. The claimed workaround is a new device called GrayKey Preserve plus an 'Evidence Preservation Mode' feature for existing GrayKey units, which reportedly freezes iPhones in a state that keeps them accessible to forensic extraction. The claims come from a vendor marketing video obtained by 404 Media, not independent technical verification, and the article itself sits behind a paid membership wall.

Why: For most builders this changes nothing you can act on: it is a vendor claim in a leaked promo video about a physical-access forensic tool, not a CVE, an API change, or a remote attack. The one decision worth making is whether any part of your threat model rests on 'the phone is locked, therefore the data is out of reach' — if your team issues iPhones to field staff, handles seized-device evidence, or writes privacy copy implying locked devices are safe, that assumption is now explicitly contested by the vendor's own marketing. If you store user secrets only in app-sandbox storage on iOS, this is not a reason to re-architect; the text gives no mechanism, no iOS version, no device list, and no independent test result.

Apple patched CVE-2026-86950, a bug in the graphics engine that powers the UI on iOS 26, iPadOS 26 and macOS 26, which Apple says "may have been exploited" in an "extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." Meta's product security team is credited with the discovery, and neither Apple nor Meta would say how the bug was found or how many devices were hit. Apple's own statistics put almost four in five iPhone owners still on iOS 26; devices on iOS 27, iPadOS 27 and macOS 27 (released earlier this month) are unaffected, and a separate zero-click bug, CVE-2026-86869, was fixed shortly before.

Why: If any of your own or your team's iPhones, iPads or Macs are still on iOS 26 / iPadOS 26 / macOS 26, the fix is already out and there is no reason to wait - but note Apple describes this as a targeted attack, not mass exploitation, so it is a patch-now item rather than a panic item. For anyone shipping an iOS app, the 4-in-5 figure is the practical takeaway: iOS 26 remains the majority install base, so you cannot drop support for it in your next release cycle yet. Apple and Meta did not disclose who was exploiting it or how many devices were affected, so treat any specifics you see elsewhere as unconfirmed.

Indie developer Vidit Bhargava demoed "Duo-Man" at a Bitrig hackathon — an app for the unreleased iPhone Duo foldable that mimics a classic Walkman: open the 7.6-inch inner display to pick and "insert" a cassette, then close to the 5.4-inch outer display to start playback. He recorded real Walkman button clicks and static noise for the app, and said he picked the idea by looking for physical objects with a hinge. Pre-orders for the iPhone Duo do not start until later in October.

Why: This is a novelty hackathon demo, not a shipping product, and the article gives no SDK, API, pricing, or App Store detail — so there is nothing to change in your stack today. The one concrete signal for iOS builders: if the Duo's 7.6-inch inner / 5.4-inch outer split is real, open-versus-closed becomes a genuine app state, and Duo-Man shows a designer already exploiting it before pre-orders open in late October. No Malaysian or Southeast Asian angle is stated in the text.