AI Weekly Malaysia

Let's Encrypt says it is adding two more remote perspectives to domain validation, bringing validation to seven total requests: one from its primary datacenter and six from remote vantage points. The change is driven by CA/Browser Forum Baseline Requirement 3.2.2.9, which from 2026-12-15 requires CAs to use at least five remote Network Perspectives for Multi-Perspective Issuance Corroboration, spanning at least two distinct Regional Internet Registry service regions, or refuse to issue. The stated goal is better visibility and protection against BGP attacks during validation.

Why: If your certificate issuance relies on HTTP-01 challenges behind geo/IP allowlists, split-horizon DNS, or region-locked CDN/WAF rules, validation requests will now arrive from more places and a blocked perspective can fail issuance. Before the 2026-12-15 requirement bites, test that your challenge path is reachable from multiple regions rather than only your usual datacenter, and check any firewall rule that whitelists Let's Encrypt validation IPs.

The Hacker News headline (published 20 Oct 2026) states that attackers used autonomous AI agents to breach company websites, with a stated target scope of over 1,200 sites. The captured page text is only the site's navigation and boilerplate — the article body, the affected platforms, the attack method, and any attribution or timeline are all missing from the excerpt. There is no vendor, tool, CVE, or named researcher detail available in what was provided.

Why: Nothing actionable can be extracted yet: we don't know which software was hit, how the agents got in, or whether the 1,200 figure means compromised sites or merely scanned ones. If you maintain client WordPress/CMS sites or run agents with browser and tool access, treat this as a prompt to open the original article and check the affected stack list before changing anything — do not rewrite agent permissions off a headline alone.

Tom's Hardware's headline reports that a hacker described in the title as Chinese used AI agents to break into more than 100 company websites, naming Deere and SharkNinja among the sites hit, via an open-source AI-powered "problem-solving platform" demo. The fetched article body contained only navigation, membership prompts, and newsletter boilerplate — no vulnerability class, CVE, timeline, victim confirmation, or technical method. Treat the specifics as headline-only until the full report is readable.

Why: There is not enough in this text to tell you to patch, reconfigure, or block anything specific: no CVE, no affected software version, no attack vector, no dates. What you can decide today is narrower — if your own product ships an autonomous agent with browser or request-making ability, this is a reminder that the same open-source 'problem-solving' tooling you wire up can be pointed outward, so scope credentials and log outbound agent actions. Anything beyond that would be guessing.