AI and Tech Summaries - AI Weekly Malaysia

Summaries

Short AI and tech summaries with source links, signal scores, and why each update matters for builders, founders, and Malaysian tech workers.

Window

Today Yesterday This week Last week This month Last month All time

Showing 1-1 of 1 results

Date	Provider	Score	Summary
01 Sep 2026, 10:07 PM	The Hacker News	5.5	13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds Researchers identified 13 malicious Composer theme packages on Packagist across five vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms) that inject JavaScript into Vietnamese movie and comic streaming sites. The injected code runs ad-fraud redirects and, on unpatched iPhones, triggers a WebKit-to-kernel exploit chain using CVE-2025-31277 and CVE-2025-43529 to install spyware that steals keychain databases, crypto wallet seeds, and other sensitive data. Why: If you ship PHP apps using Composer, audit your dependencies for any of the listed package names and verify that theme packages come from legitimate vendor namespaces. The attack shows that typosquatted or trojanized Packagist packages can turn your site into a delivery mechanism for zero-day iOS exploits—meaning your supply chain hygiene directly affects your visitors' device security, not just your own infrastructure. supply-chain-attack php-composer ios-exploits packagist crypto-theft

Date

Provider

Score

Summary

01 Sep 2026, 10:07 PM

The Hacker News

5.5

13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds

Researchers identified 13 malicious Composer theme packages on Packagist across five vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms) that inject JavaScript into Vietnamese movie and comic streaming sites. The injected code runs ad-fraud redirects and, on unpatched iPhones, triggers a WebKit-to-kernel exploit chain using CVE-2025-31277 and CVE-2025-43529 to install spyware that steals keychain databases, crypto wallet seeds, and other sensitive data.

Why: If you ship PHP apps using Composer, audit your dependencies for any of the listed package names and verify that theme packages come from legitimate vendor namespaces. The attack shows that typosquatted or trojanized Packagist packages can turn your site into a delivery mechanism for zero-day iOS exploits—meaning your supply chain hygiene directly affects your visitors' device security, not just your own infrastructure.