@nigelaw

¯\_(ツ)_/¯

Joined October 2010
  • Tweets42
  • Following181
  • Followers963
8Media
This week has been a circus, waking up three days in a row then accessing my server to make sure I'm not screwed. I'm not an cyber security expert but I maintain servers that host my projects and I need to keep them secure. Bad actors have automated pipeline scanning for security patches to determine what vulnerabilities they are trying to fix. Once they find out, they deploy AI to exploit the vulnerabilities at scale because the maintainers may have released a security patch but the users may not have done the update, especially on forgotten servers. If you have a server, you might want to look into these immediately.
18
Nigel Aw retweeted
OpenAI
@OpenAIOct 21
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors. Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact. This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare. openai.com/index/coordinated…

Patch the Planet: global response coordination as agents uncover critical vulnerabilities

Patch the Planet connects security researchers, maintainers, and incident responders to help address critical vulnerabilities across open source.

openai.com
Readers added context they thought people might want to know
‪OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.‬ ‪x.com/lcfr_hax/statu…‬
587
2,818
1,472
14,165
5,523,366
Nigel Aw retweeted
NSA Cyber
@NSACyberOct 21
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
1,218
10,181
2,644
66,657
11,169,376
On 13 Oct 2026, I discovered a Malaysian government website was hijacked by a gambling network. As of 19 Oct 2026, it has not been fully fixed yet. I detail my investigation here:  nigelaw.com/blog/dbp-gamblin… Hopefully this will be taken seriously as a security breach rather than a website patch.

Investigating the hijack of a Malaysian government site by a gambling network

Hidden gambling links and redirections were found on Dewan Bahasa dan Pustaka’s website.

nigelaw.com
1
7
4
8
1,365
For media friends, if you need to do reporting for #Belanjawan2027 while waiting for the embargoed speech, there's a live transcription here 👇 nigelaw.com/parlimen/

Dewan Rakyat Live Transcriber

This tool provides near-live AI transcription of the Dewan Rakyat session to help with note-taking. This project started as a personal tool but am sharing it to help journalists and officers who need...

nigelaw.com
Nigel Aw
@nigelawOct 6
TLDR: I built a tool that live transcribes the Dewan Rakyat session. Check it out at: nigelaw.com/parlimen/ 👈 Each transcribed text links to the exact timestamp of when it was said on YouTube (for easy verification).
98
(5/6) I built a basic version last year for personal use. Now that I have more time, I've been refining and trialling it with a few journo friends including @zikri and @HarizMohdWrites over the last few months. I understand there are newsrooms trying to do similar things or journalists/officers subscribing to various transcription services out of their own pockets. It's better to have an open transcript so everyone can use it for free. So, I'm making this tool public.
1
2
53
(6/6) The transcription is not perfect. AI makes mistakes. That's what the timestamped YouTube links are for - to verify. I know AI in journalism is a touchy subject, and it is not helped by the slop put out by content farms. That is a topic for another day. But I will say this: Similar to how I verified my mangled transcript by scrubbing through the audio years ago, it's still the same: We must verify. The difference is now you don't need to abuse your keyboard or scrub through hours of audio because this tool sends you to exactly where something was said.
1
27
(3/6) Then there's Question Time. If an MP who was supposed to ask a question pontengs, their question is skipped. But for the minister/deputy minister, a few absent MPs mean the question they have to answer, which perhaps was number 10, suddenly becomes number 6. That means abandoning any briefing/meeting for the Dewan. If they are late, it's an embarrassing no-show, but there are no consequences for the MPs who ponteng.
1
19
(4/6) This tool addresses the pain points. It tracks what the current question number is based on cues. It transcribes and finds the exact timestamp when something was said on YouTube. This tool is intended for urgent note-taking. For other purposes, refer to the Hansard the next day. The transcript is removed at midnight.
1
17
TLDR: I built a tool that live transcribes the Dewan Rakyat session. Check it out at: nigelaw.com/parlimen/ 👈 Each transcribed text links to the exact timestamp of when it was said on YouTube (for easy verification).
4
3
1
6
285
more replies
(2/6) Later, being a parliamentary officer brought new perspectives. Government officers take notes to prepare for their ministry's winding-up speech, especially if the debate is on the same day. The process is pretty manual.
1
15
(1/6) When I was a journalist in Parliament, stories had to go out while the debate was still ongoing. The Hansard only comes out the next day. So you transcribe on the spot and hope you got it right, or scrub through hours of audio recordings (no live stream then).
1
54
nst.com.my/news/nation/2023/…

'I'm going to hunt all the corrupt people' - Sultan Ibrahim | New Straits Times

KUALA LUMPUR: Sultan of Johor Sultan Ibrahim Sultan Iskandar vows to eradicate corruption in Malaysia as one of his key priorities when he is installed as the 17th Yang di-Pertuan Agong in January.

nst.com.my
131
Nigel Aw retweeted
Thevesh
@TheveshSep 6
Very happy to share that Lukis.ElectionData.MY has been updated with SPR's proposed map (1141 DMs, 99 DUNs, 31 Parlimens). It has never been easier for Malaysians to come up with alternative maps and make representations to SPR. The boundary data, electorate counts, and demographics are preloaded into Lukis, so you literally need ZERO data skills to draw your own alternate map. All you need is the proper local knowledge to examine what SPR has proposed, and move the DMs around to form alternative constituencies. My goal with Lukis is very simple - lower the barrier to entry (for scrutinising and countering SPR's proposal) as close to zero has possible. If anyone has any feedback/feature requests, just lmk! xitter.cf/Thevesh/status/2095451…
Screenshot of the Lukis BETA website: an interactive tool to draw custom electoral maps for Malaysia. Left column has the title “Lukis” with a pink BETA badge, the tagline “Draw your own electoral map for Malaysia,” and instructions to start from current boundaries, group DMs into DUN seats then DUNs into Parliament seats while watching malapportionment and demographic indicators update live. Footer note: “Electorate as at end-2025. Powered by open data from ElectionData.MY.” Right side is a grid of white cards, each with a state/territory flag. Cards shown: Sarawak (1st Display) Proposed — 31 Parlimens · 99 DUNs Sarawak — 31 Parlimens · 82 DUNs Perlis — 3 Parlimens · 15 DUNs Kedah — 15 · 36 Kelantan — 14 · 45 Terengganu — 8 · 32 Pulau Pinang — 13 · 40 Perak — 24 · 59 Pahang — 14 · 42 Selangor — 22 · 56 Kuala Lumpur — 11 Parlimens Putrajaya — 1 Parlimen Negeri Sembilan — 8 · 36 Melaka — 6 · 28 Johor — 26 · 56 Labuan — 1 Parlimen Sabah — 25 Parlimens · 73 DUNs

ALT Screenshot of the Lukis BETA website: an interactive tool to draw custom electoral maps for Malaysia. Left column has the title “Lukis” with a pink BETA badge, the tagline “Draw your own electoral map for Malaysia,” and instructions to start from current boundaries, group DMs into DUN seats then DUNs into Parliament seats while watching malapportionment and demographic indicators update live. Footer note: “Electorate as at end-2025. Powered by open data from ElectionData.MY.” Right side is a grid of white cards, each with a state/territory flag. Cards shown: Sarawak (1st Display) Proposed — 31 Parlimens · 99 DUNs Sarawak — 31 Parlimens · 82 DUNs Perlis — 3 Parlimens · 15 DUNs Kedah — 15 · 36 Kelantan — 14 · 45 Terengganu — 8 · 32 Pulau Pinang — 13 · 40 Perak — 24 · 59 Pahang — 14 · 42 Selangor — 22 · 56 Kuala Lumpur — 11 Parlimens Putrajaya — 1 Parlimen Negeri Sembilan — 8 · 36 Melaka — 6 · 28 Johor — 26 · 56 Labuan — 1 Parlimen Sabah — 25 Parlimens · 73 DUNs

Screenshot of Lukis BETA map editor for “Sarawak (1st Display)”. Left sidebar: Reset/Export buttons; note that work stays in the browser. Controls for shading granularity (DUN selected), tooltip granularity (DUN), shading mode (Malapportionment selected), labels (seat code/name/voter count), and “show all labels” off. Summary stats: average electorate 20,582; largest-to-smallest ratio 3.33× (red); range 0.50× to 1.68× of average. Centre: choropleth map of Sarawak shaded by DUN malapportionment. Top legend: red triangle >1.25× avg, blue square within tolerance, yellow diamond <0.75× avg. Map uses pale blue, peach and a few pink districts; nearby labels include Brunei, Borneo and national parks. Right panel: DUN tab active. Instructions to pick a listed DUN then click the map to add/remove it. Buttons: Unassign all DMs, Renumber (Geo Algo). Demographic stats off. Scrollable DUN list with size vs average, DM count and voters — e.g. N.01 Serayan 0.82× (20 DMs, 16,878 voters).

ALT Screenshot of Lukis BETA map editor for “Sarawak (1st Display)”. Left sidebar: Reset/Export buttons; note that work stays in the browser. Controls for shading granularity (DUN selected), tooltip granularity (DUN), shading mode (Malapportionment selected), labels (seat code/name/voter count), and “show all labels” off. Summary stats: average electorate 20,582; largest-to-smallest ratio 3.33× (red); range 0.50× to 1.68× of average. Centre: choropleth map of Sarawak shaded by DUN malapportionment. Top legend: red triangle >1.25× avg, blue square within tolerance, yellow diamond <0.75× avg. Map uses pale blue, peach and a few pink districts; nearby labels include Brunei, Borneo and national parks. Right panel: DUN tab active. Instructions to pick a listed DUN then click the map to add/remove it. Buttons: Unassign all DMs, Renumber (Geo Algo). Demographic stats off. Scrollable DUN list with size vs average, DM count and voters — e.g. N.01 Serayan 0.82× (20 DMs, 16,878 voters).

Thevesh
@TheveshSep 3
Two days ago, the Election Commission (SPR) began public display of their proposal for Sarawak's new electoral boundaries—99 DUN seats (increased from 82) and 31 Parliament seats (no change**). For the first time ever, SPR published the Pelan Warta together with their proposal, which basically contains the most granular operational maps used in elections (at Daerah Mengundi level). They released these in PDF format, 1 for each Parliament. While it is true that the publication of this information, even as a PDF, is a huge step up, it is really difficult to rigorously study SPR's proposal without machine-readable maps in a proper format (GeoJSON, GeoParquet, KML, whatever). Of course, some of our foremost local experts on redelineation (referring to people like Prof Wong Chin Huat, Prof Rosmadi Fauzi, Danesh Chacko, Dr Bridget Welsh, Dr OKM, etc) can glance at a PDF and instantly see the pertinent issues not obvious to others, in general, any systematic effort to dig into SPR's proposal needs a digital map, period. After spending the last 2 nights digitising the boundaries by hand (I have carpal tunnel now 😂), I'm very happy to share that machine-readable versions of SPR's proposal are now open-sourced on ElectionData.MY 🥳 Links: • DM level (1,141): electiondata.my/data-catalog… • DUN (99): electiondata.my/data-catalog… • Parliament (31): electiondata.my/data-catalog… These maps are something I consider to be fundamental democratic data infrastructure. Accordingly, they are licensed CC0, and are free for everyone to use, without restriction. I hope this helps everyone involved in the process—civil society, academics, media, and even civil servants who can't get access to the map internally—to produce better analysis, and ultimately a better map for Sarawak. To @sprgovmy, I have just one request. You've already gone 95% of the way by publishing the Pelan Warta, and you genuinely deserve huge credit for that. Now can we please just go all the way so that citizens aren't the ones having to digitise the map for everyone else? Let our efforts be focused on scrutiny and democratic representation instead! **Note: Sarawak DUN does not have any power to alter the number of Parliament seats for their own state. This requires an amendment to Article 46 of the Constitution, via a 2/3 majority in Parliament.
Screenshot of the ElectionData.MY website showing the page “2026 Subdivision of Sarawak (Voting Districts): 1st Proposal” (last updated 03 Sept 2026). A large interactive map of Sarawak on Borneo displays proposed voting-district boundaries as thin red lines over a pale pink fill, with 1,141 features. Neighbouring places labelled include Brunei, Bandar Seri Begawan, Tawau, Lahad Datu and parts of Indonesian Kalimantan. The page notes these are draft boundaries from the first public display of the 2026 delimitation exercise and are not yet gazetted. Interface elements include Map / Attributes / Variables / Methodology tabs, 36 views and 6 downloads, a Mapbox credit and a CC0 public-domain dedication.

ALT Screenshot of the ElectionData.MY website showing the page “2026 Subdivision of Sarawak (Voting Districts): 1st Proposal” (last updated 03 Sept 2026). A large interactive map of Sarawak on Borneo displays proposed voting-district boundaries as thin red lines over a pale pink fill, with 1,141 features. Neighbouring places labelled include Brunei, Bandar Seri Begawan, Tawau, Lahad Datu and parts of Indonesian Kalimantan. The page notes these are draft boundaries from the first public display of the 2026 delimitation exercise and are not yet gazetted. Interface elements include Map / Attributes / Variables / Methodology tabs, 36 views and 6 downloads, a Mapbox credit and a CC0 public-domain dedication.

3
31
1
77
9,422
Nigel Aw retweeted
Tibo
@thsottiauxAug 26
A few weeks at OpenAI feel like years at other companies in terms of how much gets done. Crazy how much you can age in a few days
1,218
224
204
11,446
1,081,918
Theme parks have to undergo periodic DOSH certification. @mykesuma shld make such certs publicly searchable online, similar to how ppl can check halal status of eateries. Any cert that must be displayed shld be searchable online in this digital age. thestar.com.my/news/nation/2…

10 hurt in roller coaster mishap at theme park

SUBANG JAYA: Ten people sustained minor injuries in an accident involving a roller coaster at a theme park here.

thestar.com.my
147
Johor enters El Niño as most water-stressed state. 4 dams at lower levels than last year and are at or near critical. Early prep needed to avoid water crisis if dry spell persists. Next vulnerable is Kedah.
1
2
140
Tabung Haji RCI report is in image format. To spare journos the pain, I converted 252 pages into OCR text. Download at: nigelaw.com/thrci Give to AI to ask Qs. Always fact check. If you find something interesting, ask for page number and compare to the official report.
4
57
5
102
12,433
Official report here: islam.gov.my/ms/pengumuman/5…

JAKIM

Portal Rasmi Jabatan Kemajuan Islam Malaysia

islam.gov.my
2
5
799
This did not age well when 2 days later, Moonshot AI released the open-weights Kimi K3 that achieved parity with US frontier labs.
The Economist
@TheEconomistJul 17
Chinese officials present open-source AI technologies as a gift to the world. In reality, openness is a logical strategy for laggards economist.com/international/…

When China’s open-source AI is a trap

America’s quest for AI dominance is scary. China is not the solution

economist.com
1
210
more replies
14
Load more