AI Weekly Malaysia

eMudhra's board decided to voluntarily withdraw from the global SSL/TLS certificate business after an incident; it says affected CAs were revoked within 14 hours, no end-entity certificates were issued from the affected CA, and its infrastructure was not compromised. Global SSL/TLS is about 1% of eMudhra's global revenue, and the company cites rising data-sovereignty/compliance complexity and cost plus free SSL/TLS from large entities. eMudhra says G1 RSA roots will continue through transition, affected customers can get free replacement certificates via partners, revocation/status services will run until certificates expire or are replaced, and it will file a full root-cause report.

Why: If you or a client holds an eMudhra-issued global SSL/TLS certificate, start discovery now: eMudhra says replacements will be free via partners, but you still need to find certs chaining to its G1 RSA roots and schedule cutover before expiry. If you do not use eMudhra certs, this is a CA vendor-risk signal rather than an immediate code change.

Techdirt's Mike Masnick writes that the No Kings Instagram account was suspended for about an hour during a get-out-the-early-vote protest push, with admin access locked out for a few more hours; Reuters reported Meta apologized. The article uses the incident to argue that movements and builders should not rely on rented social platforms for critical distribution. The Hacker News thread drew 449 points and 411 comments.

Why: If your startup or community uses Instagram/Meta as a primary announcement channel, this is a concrete reminder that admins can lose access for hours even when a suspension is later reversed. Decide now which critical updates need an owned channel and whether you have backup admin/export procedures.

The Hacker News reports (21 Oct 2026) that the U.S. government has ordered DeepSeek removed from federal civilian systems and banned new purchases of the model. The supplied excerpt is truncated at the headline and lede, so the article body — which agency issued the order, the compliance deadline, the scope of "civilian systems," and any stated rationale — is not available in the text provided.

Why: The concrete takeaway available here is narrow but real: a national government has now treated a specific LLM vendor as a procurement risk, not just a security-review item. If you build agents or client apps on DeepSeek-hosted models, the decision to make now is whether model choice is a config flag or a hardcoded dependency — because the only thing this text establishes is that a buyer with compliance requirements can drop a provider outright. Anything beyond that (deadlines, penalties, which agencies, whether contractors are covered) is not in the excerpt and shouldn't be assumed.

Automattic has begun layoffs over at least the past week, hitting communications, social, WordPress.com, and the VIP enterprise business, with insiders expecting more cuts. The cuts follow a failed September board attempt to oust CEO Matt Mullenweg that led to complete board turnover and departures of the CFO, interim CFO, and Chief Legal Officer; interim CFO Jeremy Klaperman left earlier this month and comms director Megan Fox said her role was eliminated. TechCrunch also reports Mullenweg shared a departed exec’s spouse health information and COBRA details in internal Slack, shocking employees.

Why: If you run client sites on WordPress.com or enterprise WordPress VIP, the cuts explicitly hit those units while finance and legal leadership is unsettled—ask your account contact what changes for support, renewals, or escalation before committing new work. WooCommerce merchants get no stated product change here, so treat this as a vendor-risk signal, not a reason to migrate by itself.

A circular dated 20 October 2026, signed by Chief Secretary to the Government Tan Sri Shamsul Azri Abu Bakar, bars all Malaysian civil servants from using Waze with immediate effect, following National Cybersecurity Committee (JKSN) Meeting No. 3/2026 chaired by Prime Minister Datuk Seri Anwar Ibrahim. The stated rationale is concern over Waze's ties to Israel; the article notes Waze has been a Google subsidiary since its 2013 acquisition. Ministry secretaries-general and department heads must cascade the directive for full compliance, and queries are routed to NACSA under the National Security Council in the Prime Minister's Department.

Why: If you ship anything to public-sector users that opens or embeds Waze links — navigation deep links in field-service, delivery, or e-reporting tools — treat that integration as blocked for civil-service workflows and plan a fallback. Before assuming the same applies to Google Maps or other Google services, get it in writing from NACSA, since the circular as reported names only Waze even though Waze is Google-owned.

Tom's Hardware reports that an IRGC spokesman described undersea data cables in the Strait of Hormuz as 'legitimate new targets,' warning that a future 'third phase' of conflict with the US could involve severing global data links. The supplied page text contains only the headline claim plus site navigation and subscription boilerplate — no cable names, no capacity figures, no dates, no official response, and no technical detail on how such an attack would be carried out.

Why: There is nothing actionable here yet: no named cable system, no affected route, no timeline, and no operator or government statement to react to. Southeast Asian traffic largely transits the Malacca Strait and South China Sea routes rather than Hormuz, so the concrete step is not 're-architect now' but to check which of your cloud or transit providers actually publishes Hormuz/Red Sea routing dependencies — and note that this item alone gives you no basis to change anything.

The supplied page contains only Ars Technica's cookie-consent boilerplate — no article body, no named sources, no dates, no figures. The headline alleges that Musk, not Trump, ordered Starlink throttling that affected Ukraine, but nothing in the extracted text substantiates the claim, the mechanism, the timing, or the response. There is no verifiable detail here to summarise beyond the headline itself.

Why: Nothing actionable can be drawn from this text — it is a consent dialog, not reporting. If you want to discuss satellite connectivity as a single-vendor dependency risk for field operations, wait for the actual article or a primary document; do not repeat the headline's allegation on air as if it were established, because the excerpt gives you no sourcing to stand on.