AI Weekly Malaysia

Beacon, a CRM provider serving 1,500+ charities, says an AWS access key likely exposed in public JavaScript build artifacts is the leading suspect in a July 27 breach. The attacker copied the entire customer database—including attachments—and probably downloaded it in readable form within 1 hour 27 minutes, despite data being encrypted at rest, because the compromised key allowed decryption. Beacon's logs cannot identify which specific records were exfiltrated.

Why: If you ship JavaScript bundles to browsers, scan your build artifacts for embedded cloud credentials before deployment—this incident shows that encryption at rest is meaningless when the access key that can decrypt it is sitting in a public JS file. Founders running SaaS on AWS should verify that IAM keys are never bundled into frontend assets and that CI/CD pipelines include secret-detection steps.

Tailscale traced a series of outages starting August 2025 to a 16-year-old bug in SQLite's write-ahead log checkpointing process. After a six-month investigation, SQLite maintainers had to build a new VFS activity logging tool (funded by Tailscale) just to reproduce the issue, which resisted all initial debugging attempts. Tailscale has used SQLite as its primary database since 2022, and the corruption first surfaced during their routine snapshot-to-S3 backup pipeline.

Why: If you ship SQLite in production with WAL mode and periodic snapshot backups, this postmortem is a direct warning that WAL checkpoint corruption can surface silently and be extremely hard to reproduce. Database learners and builders should read the Tailscale write-up before assuming SQLite's WAL is bulletproof in backup-heavy workloads, and consider whether their own backup pipeline could hit the same edge case now that the bug is documented.

Tailscale experienced 19 separate SQLite database corruption incidents over six months, traced to a 16-year-old WAL-reset bug deep in SQLite. Their architecture uses one SQLite database per shard with a single Go writer, and their backup pipeline snapshots the full DB file to S3 every few minutes—corruption was first detected when a downstream data pipeline reading those S3 backups reported an error.

Why: If you run SQLite in production and take file-level backups or snapshots (especially with WAL mode), you should run PRAGMA integrity_check against your backups routinely—Tailscale's corruption was invisible to the live writer and only surfaced from the backup consumer. Anyone shipping SQLite-backed services should review whether their backup method correctly handles WAL state.

A 16-year-old SQLite write-ahead log (WAL) checkpointing bug caused recurring database corruption in Tailscale's tailnet infrastructure starting August 2025, taking six months to diagnose. Tailscale funded SQLite maintainers to build a new virtual file system logging tool to reproduce the issue, which engineer Alex Chan described as resisting all initial debugging attempts including checks on POSIX locks, memory management, and thread safety.

Why: If you ship SQLite as a primary database under continuous backup snapshots, this postmortem is a concrete lesson in how deep storage-layer bugs can masquerade as application-level corruption for months. The debugging methodology—systematically ruling out POSIX lock, memory, and threading theories before isolating checkpointing—is worth studying before you hit a similar wall. The fact that SQLite maintainers themselves had to write new tooling to reproduce it should reset expectations about how 'reliable and well-known' doesn't mean 'bug-free' for critical infrastructure.

Nathan Lambert's post-training textbook 'Reinforcement Learning from Human Feedback: Aligning and Post-training LLMs' is now published by Manning and freely available online, accompanied by a 12-hour video course, slides, a codebase with exercises, and model comparison examples. It covers topics like rejection sampling, outcome reward models, and character training at a foundational level, targeting readers with a CS background rather than beginners. The print edition is 50% off until August 19 with code PBLambert.

Why: If you're an AI/ML learner or developer moving from model usage to model fine-tuning, the free online book plus 12-hour course gives you a structured path into RLHF and post-training techniques that are otherwise thinly documented. The 50% discount code expires Aug 19, so decide before then if you want the print version.

Kristen Lowe, former Director of Operations at Hinge and incoming Director of Founder & Editorial Communications at Scribe, argues that founder-led communication is now one of the lowest-cost, highest-leverage tools for startups. She frames the problem: AI tools make it trivial to start a company but also flood channels like X and LinkedIn with 'soulless AI slop,' making it harder to stand out. Her core thesis is that founders don't need to be vulnerable or contrarian—they need to answer 'Why did I start this company?' and build their comms strategy around that origin story, organized around three founder archetypes.

Why: If you're a founder shipping fast with AI tools, your differentiation is no longer the product itself—anyone can build one. Lowe's framework says your edge is a credible, honest origin story communicated consistently across LinkedIn, Substack, X, and keynotes. The actionable takeaway: stop trying to be entertaining or contrarian and instead nail a clear answer to why you started, then use that as your content backbone. The article is paywalled, so the full three-archetype framework isn't available from the excerpt alone.

The UK's criminal records office (ACRO) was reprimanded by the ICO after attackers maintained persistent access to its Kentico CMS v12.0.0 for over seven months (Aug 2022–Mar 2023), potentially exposing data on ~11,000 people. The root cause was running an unpatched CMS from September 2019 to March 2023, compounded by a miscommunication where the managed service provider didn't learn patching was its responsibility until February 2020 and still didn't actively monitor for vulnerabilities.

Why: If you outsource infrastructure or CMS management to an MSP, get the patching responsibility in writing and verify it's actually happening—ACRO's breach was caused entirely by an unpatched CMS and unclear ownership. Founders running any CMS (WordPress, Kentico, Drupal) should check whether patching is explicitly assigned in their vendor contracts and whether someone is actually applying hotfixes, not just assuming the MSP handles it.

Picus Labs' Blue Report 2026 analyzed 338M+ attack simulations across production environments in H1 2026, finding perimeter prevention rose from 62% to 69% while post-compromise interior prevention was only 37%. Reconnaissance was stopped just 10% of the time and credential theft ~22%, while noisy lateral movement techniques like Sharp-ServiceExec and SMBExec were blocked ~90% of the time.

Why: If you build or operate services with an authenticated interior, assume your perimeter will hold but your internal controls will not. The data says quiet post-compromise actions—domain recon, share enumeration, reading credentials from memory and registry—are nearly unopposed once an attacker has a foothold, so prioritize internal segmentation, credential hygiene, and detection of low-noise recon over further perimeter hardening.

A woman was pulled over at gunpoint twice after Flock's automated license plate recognition software incorrectly linked her vehicle to a homicide investigation. The article describes the real-world consequences of a false positive match from an automated surveillance system, with the woman stating 'Y'all failed me' in response to the repeated stops.

Why: For anyone building automated matching or classification systems, this is a concrete case study of how false positives in production can cause serious real-world harm — not just metrics on a dashboard. If you ship systems that trigger actions on probabilistic matches (plate recognition, face matching, fraud flags), you need to design escalation paths and human-in-the-loop checkpoints that prevent a single glitch from becoming armed police encounters.

Voyager 2 engineers extended the spacecraft's mission by roughly two years by switching multiple power systems simultaneously rather than sequentially, preserving thermal heat that keeps propellant lines from freezing. The team relied on 50-year-old power documentation where margins as small as 0.2 watts mattered, and validated their thermal-power model with a brief live test on the spacecraft before committing.

Why: This is a compelling engineering postmortem about optimizing under extreme resource constraints, but it has no direct practical impact on what this audience builds, ships, or decides. The takeaway is conceptual: when facing a shutdown tradeoff between power and heat, simultaneous switching can preserve thermal margins that sequential switching loses — a useful mental model for anyone managing constrained edge or IoT systems, but not actionable for most builders here.

A Raspberry Pi-powered card tipping machine (TiPJAR hardware) in a London pub crashed, leaving a Raspbian GNU/Linux login terminal visible on the bar with the default hostname 'raspberrypi' and user 'pi'. The Register's offbeat column treats it as a humorous embedded systems bork, noting rc.local on screen and joking about the default credentials.

Why: No practical takeaway for builders beyond the familiar reminder that Raspberry Pi devices shipped into production often retain default hostnames and login users, which is a minor security hygiene issue if you deploy Pi-based kiosks or POS hardware. Otherwise this is entertainment, not actionable.

Toolstation replaced aging custom Linux PoS terminals across 550+ UK branches with ASUS NUCs running ChromeOS Flex, citing slow performance, inability to patch security vulnerabilities, and high support overhead. The sponsored case study describes the refresh as part of a broader estate update covering contact centers, warehouses, and distribution hubs.

Why: This is a sponsored vendor case study with no actionable takeaway for builders outside retail IT hardware procurement. The only concrete lesson—unpatchable legacy Linux POS hardware becomes a support and security liability—is obvious and not worth acting on unless you manage a similar retail estate.