Widely influential and uncompromisingly timeless, Frank Zappa’s 1966 debut with The Mothers of Invention, Freak Out!, is one of the ground-zero, game-changing releases from the dawn of the psychedelic revolution. A crossroads marker between the pop music that came before and everything that followed, the album inspired no less than The Beatles in the creation of Sgt. Pepper’s Lonely Hearts Club Band.  

Freak Out! honored and deconstructed musical conventions in the same breath. Now 60 years old, the album has prompted Universal Music and Zappa Records to take a fresh deep dive into the archives for a wonderful 5CD/1Blu-ray Super Deluxe Edition boxed-set extravaganza.

Most notably, it marks the return of the highly sought-after, punchy original mono mix of Freak Out! Out of print since 1966 because the master tapes were lost, this new remaster was assembled from three surviving single-release tapes, along with a well-made needle drop from a pristine original pressing. They did a great job with it, and the results sound remarkably good, very similar to my original mono pressing.

Also remarkable is a newly unearthed “pre-master” stereo mix, sourced from a fan collector, dating from before the engineers added their final production touches. Arguably a generation lower in the analog food chain, this mix feels much less constrained and more widescreen, with little to no compression or EQ. Many details jump out that were previously somewhat buried, and I hear some different edits as well.

Two CDs of bonus material include a wealth of very cool demos and 1966 live concert recordings from San Francisco’s legendary Fillmore Auditorium. Featuring the Freak Out!-era Mothers in full flower and performing without a net on a bill that reportedly included Lenny Bruce, these archival-quality soundboard recordings are imperfect but fascinating, offering plenty of revelations.

The Blu-ray offers multiple ways to enjoy Freak Out! Given that the producers were working from, at best, four-channel multitrack recording sources, it is remarkable how much immersion they achieved with the surround mixes. The Dolby Atmos mix delivers a room-filling perspective that can, at times, feel less discrete and a little blurred, almost like multichannel mono.

This mix is at its best on the more experimental tracks, such as “Who Are the Brain Police?” and “Return of the Son of Monster Magnet,” where the trippy special effects and sound collages sometimes seem to explode around you. That said, I found the 5.1 Dolby TrueHD mix a bit more immersive and more discrete overall. Both versions are compelling, so I found myself switching back and forth between them. Having that choice is definitely a good thing.

The Blu-ray also includes high-resolution versions of the 1966 stereo and mono mixes, as well as the new “pre-master” mix, presented in 96kHz/24-bit and 192kHz/24-bit resolution. You could sit and listen to Freak Out! on this disc alone for more than four hours, exploring all of these different mixes.

Other goodies in the set include a foldout reproduction of the “Freak Out Hot Spots Map,” a rarity for many years that was originally available only by mail order in 1966 from an address listed on early LP pressings. Extra kudos go to the designers of the Blu-ray screensaver, which features a little car, and periodically even tanks, driving around the map while occasionally dropping tiny bombs and causing other assorted mayhem. It’s quite a production.

The 60th anniversary Freak Out! set includes a booklet with new essays and a section called “Even More Relevant Quotes,” a reference to the original Freak Out! liner-notes section titled “Relevant Quotes.” For this new edition, the producers reached out to notable fans around the world who were influenced by the music, and if you look closely, you’ll see your friendly neighborhood eCoustics freelance music writer, Mark Smotroff, included as well.

I’m humbled and honored to be in such esteemed company as a lifelong fan who has also been reporting on Zappa reissues and archival releases for many years.

I’m still exploring this set but in a nutshell, if you love this album and Zappa’s music, you definitely need to pick up a copy sooner than later. You can order the Freak Out! 60th anniversary super deluxe box set on Amazon for just $65.88. There is also a companion 5LP version of the set for those of you like vinyl available for $149.88 at Amazon.

Our Ratings

★★★★★★★★★★ Music

★★★★★★★★★★ Sound

★★★★★★★★★★ Packaging

Where to Buy:

Mark Smotroff is a deep music enthusiast / collector who has also worked in entertainment oriented marketing communications for decades supporting the likes of DTS, Sega and many others. He reviews vinyl for Analog Planet and has written for Audiophile Review, Sound+Vision, Mix, EQ, etc. You can learn more about him at LinkedIn.

The Clop ransomware gang has moved its data leak site to a new Tor address after confirming its previous server was compromised and defaced through an unpatched Grav CMS flaw that BleepingComputer has learned is an unauthenticated path traversal vulnerability.

The Clop leak site was breached earlier this month by the ShinyHunters extortion gang, which first uploaded a small text file and later replaced the site with a full-page defacement displaying its Umbreon Pokémon logo and a link to its own data leak site.

ShinyHunters later claimed on its own data leak site that it stole source code, Grav CMS plugins, server logs, and the private keys used by Clop’s Tor onion service. The group then issued a ransom demand, threatening to leak the stolen files if Clop did not pay.

Clop has now announced a new onion address and says the old domain will remain accessible temporarily before being retired.

Clop also denied having any relationship or ongoing negotiations with ShinyHunters.

“We do not know them, we have never worked with them, and at the moment we are not in contact with them; furthermore, we have not provided them with any information, nor will we do so—either now or in the future,” Clop told BleepingComputer.

When asked whether the group had determined how ShinyHunters breached the leak site, Clop confirmed that its Grav installation had not been fully updated.

However, the Russian ransomware gang disputes ShinyHunters’ claims that valuable operational or financial data was stolen from the compromised server.

“We didn’t update the Grav plugin — though it happened eventually—but the server contained nothing but content (meaning there was absolutely no data or financial activity there, nor could there have been). Therefore, their claim is worthless—as are their words,” Clop said.

While Clop says they are not communicating with the other threat actors, they have since been quietly removed from ShinyHunters’ data leak site, which commonly happens when negotiations are taking place.

When questioned about the removal, ShinyHunters told BleepingComputer that they did not want to answer any further questions about this.

Grav confirms flaw used in attack

Grav CMS has now confirmed that the vulnerability and exploitation details shared by ShinyHunters with BleepingComputer are accurate.

ShinyHunters told BleepingComputer that the compromised Clop server was running Grav CMS 1.7.43 and claimed it exploited an unauthenticated file upload flaw in Grav’s form upload handling.

According to the threat actor, the vulnerable code used values supplied through form-related POST parameters when creating temporary upload directories without first validating them as safe filesystem path components.

The group specifically identified the __unique_form_id__ parameter and said the value was added into a temporary path like:

tmp/forms//

ShinyHunters claimed that by supplying directory traversal sequences, such as ../../../shhq, for the unique form identifier, it could cause Grav to create an upload path outside the intended tmp/forms directory.

The uploaded file could then be written elsewhere under the Grav installation.

After BleepingComputer shared the technical details with Grav, the CMS developers confirmed that the threat actor’s description was accurate.

“Yes, it’s a legitimate flaw, and the threat actor’s description is accurate,” Grav told BleepingComputer.

Grav said the flaw is tracked as CVE-2026-42608 and is a path traversal vulnerability that was privately reported and fixed in Grav 2.0 (2.0.0-beta.2) earlier this year, with the advisory published on April 27.

The fix added a sanitizeId() function that only accepts identifiers matching the allowlist:

[A-Za-z0-9,_-]{1,64}

Grav confirmed that this sanitization method is the same mitigation described by ShinyHunters to BleepingComputer.

However, while current Grav 2.x releases had already been protected, the fix had not been backported to the older Grav 1.7 branch, leaving installations such as Clop’s 1.7.43 deployment vulnerable.

“The gap was the 1.7 line,” Grav told BleepingComputer. “Grav 2.0 is the current major version, but plenty of sites are still on 1.7, and that fix hadn’t been backported there yet.”

After BleepingComputer shared the exploitation details with Grav, the developers backported the fix to the 1.7 branch and released Grav 1.7.53.4 yesterday.

Grav also clarified that the vulnerability is located in Grav core rather than the Form plugin.

“The bug lives in Grav core, not the Form plugin, so the Form plugin version (7.3.0 in their example) doesn’t change whether a site is vulnerable. It’s the core version that matters,” Grav said.

Grav is urging anyone still running the 1.7 branch to upgrade to version 1.7.53.4. Users of current Grav 2.x releases have already been protected from the vulnerability for months.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

Even before France approved legislation banning social media for children under 15 last January, 13-year-old Benjamin was already wondering what life without social media would look like. “If we want to play football, we won’t be able to organize it. What will we do? Send letters instead?” he joked in an interview for Le Monde.

His reaction captured the central challenge behind the growing wave of youth social media bans: Removing access is one thing; understanding what those platforms mean in children’s lives is another.

Within weeks of Australia’s similar ban, the country’s eSafety Commissioner reported that platforms had restricted access to 4.7 million under-16 accounts. Two months later, though, one in five Australian teenagers under 16 was still using TikTok and Snapchat, according to a parental-control data company. But even if all children’s social media accounts were to disappear, do such bans actually make children safer online?

Governments are moving ahead without answering that question as they follow Australia’s lead. Indonesia’s child-safety framework, which took effect in March, bars children under 16 from holding accounts on “high-risk” platforms. The U.K. government has announced plans to ban social media for under-16s, add default overnight social media curfews for 16- and 17-year-olds, and extend child-safety rules to cover risky AI features. And on 17 September, the European Commission proposed the EU KIDS Act, which would bar children under 13 from social media, set 15 as the EU-wide minimum age for opening an account independently, and require platforms to show that their services are age appropriate and safe by design.

But based on my experience working on Child Online Protection initiatives with the International Telecommunication Union (ITU) across Southeast Asia and the Pacific, I know the bans don’t address the real problems. Instead, we should be paying more attention to the systems that generate harm in the first place—namely, recommender algorithms, engagement-maximizing design, opaque moderation, and extractive data practices.

Account removals are not the same as online child safety

My experience working on protecting children’s online safety has taught me three main lessons:

First, the public institutions responsible for child online protection often lack the staff, budget, or technical capacity to enforce complex online safety policies.

Indonesia is illustrative. A 2026 UNICEF evaluation found capacity constraints among service providers, long-term funding uncertainty, and a need for specialized personnel. At the local level, some staff lacked digital skills, while budget constraints left some areas reliant on external support.

Second, many children, and often their parents, lack the digital literacy and critical thinking skills needed to navigate online risks safely. My policy research on child online protection in Indonesia, published earlier this year in Digital Society, found substantial gaps that account removals cannot repair: Many children lacked guidance on navigating the internet safely, and large numbers did not know how to report harmful experiences.

And third, the platforms have limited independent oversight as they identify underage users, design age-verification systems, and report their own compliance. In Indonesia, platforms themselves are responsible for carrying out age verification, while the Ministry of Communication and Digital Affairs oversees compliance. TikTok’s appeals process for users flagged as underage, for instance, can require a government-issued ID and selfies, which is a problem because it involves collecting the additional personal data on an ID card, beyond that needed to confirm age. Will government regulators ensure that TikTok handles that data responsibly?

The privacy paradox of proving age

Every age-based ban creates an engineering problem: How can a platform reliably determine that a user is old enough, without intruding on other information? Governments and companies may use identity documents, parental authorization, app-store checks, or facial age estimation. Each approach has trade-offs among accuracy, privacy, accessibility, and resistance to circumvention.

There are also technical issues. One tool, facial age estimation, draws on enormous databases but it is probabilistic, not exact, because people vary so much. It’s also been shown to misclassify both children and adults.

The challenge should not merely be to “verify age.” It should be to prove that someone is above a threshold, without disclosing their identity, birth date, or other information third parties might use to create a marketing profile. The European Commission’s age-verification blueprint challenges companies to verify ages without collecting all that additional information.

Privacy-preserving technologies offer promising ways to achieve this. Zero-Knowledge Proofs (ZKPs) can confirm that someone meets an age threshold without revealing their identity or exact date of birth. W3C Verifiable Credentials are cryptographically verifiable digital claims that can disclose only the information needed, such as “over 16.” And device-based age signals can allow a phone or app store to share an age range without revealing a user’s exact birth date. But these methods still require rigorous security testing, common standards, independent oversight, and clear limits on data retention. Otherwise, poorly designed child-safety policies risk creating permanent identity infrastructures in which businesses, not people, control personal data.

Where connection goes when a platform closes

Blocking access to a platform redirects some young people, but not always where expected. Early anecdotal reports in Australia pointed to teenagers migrating to smaller, less-regulated platforms like Yope, a pattern the Cato Institute flagged as a “whack-a-mole” problem for regulators. But industry data collected two months later found no broad-based shift of that kind, aside from a small uptick in WhatsApp use. Many teens simply found a way to stay on the banned platforms.

This points to a deeper gap in current society: the erosion of youth “third places“ physical spaces where young people have room to socialize and build identity outside home and school. As those spaces have diminished, commercial communications platforms have absorbed that role.

For many teenagers, social media workarounds are merely inconvenient. But for isolated, marginalized, disabled, or LGBTQ+ youth who depend on online communities for support that’s otherwise unavailable, displacement can mean losing certain kinds of belonging, or having to move to a platform with even weaker oversight.

How to design safer online systems for children

If blanket social media bans don’t work, then what will? The platforms have created many of the conditions that governments are now trying to contain: engagement-optimized recommenders, intrusive data practices, weak safeguards against unwanted contact, and features such as infinite scroll, autoplay, streaks, and persistent notifications.

These design patterns increasingly face regulatory scrutiny, including what’s required under the European Union’s Digital Services Act. A 2026 study from the 5Rights Foundation that tracked children’s device use minute by minute found that the user interfaces shape children’s attention, sleep, and well-being in real time.

A more durable response would regulate those interfaces directly, treating children as legitimate users whose privacy, agency, and well-being are required protections, not afterthoughts. That means designing for safety from the outset. One example would be for children’s apps to have high-privacy defaults, such as private accounts and location sharing switched off for minors. They could also have recommender systems that explain the main factors shaping a feed and give young users more control over personalization. The European Commission has published age-appropriate interaction guidelines that limit unsolicited contact and prevent minors from being added to groups without consent. Rules could also prohibit engagement-maximizing features that demand users’ attention, such as autoplay, infinite scroll, usage streaks, read receipts, and push notifications, by disabling or limiting them by default.

Governments should define measurable outcomes and fund independent evaluation, platforms should give researchers meaningful data access, and engineers should audit age-assurance systems for bias and data leakage. Schools, parents, and children themselves need a seat in designing the technology that’s designed to protect children.

If policymakers still decide to remove an infrastructure for youth connection, they should offer something better in return. Social media bans may reduce some forms of exposure to harmful content and may be justified for particular ages, services, or risks. But they are just one tool, not a comprehensive substitute for safer design, accountable platforms, digital literacy, institutional capacity, and noncommercial digital “third places”—moderated communities, creative spaces, and public-interest platforms designed for youth participation rather than profit.

The first wave of social media restrictions isn’t enough to keep children safe. Governments are still measuring what’s easiest to count, while neglecting harder-to-measure outcomes such as children’s access to safe third places and meaningful social connection, both online and offline. Until governments can show evidence that harm has actually declined, they will keep mistaking account removal for safety.

Thousands of U.S. banks and credit unions can pursue their Apple Pay fee claims together after a federal judge certified their antitrust lawsuit as a class action.

The financial institutions accuse Apple of blocking competing tap-to-pay wallets on iPhone while charging card issuers fees for transactions. They argue Apple could impose those fees because rival wallets couldn’t compete for contactless payments on the iPhone.

Judge Jeffrey White certified the class on September 23 and rejected Apple’s attempt to exclude the plaintiffs’ damages expert. The ruling doesn’t decide whether Apple violated antitrust law or owes the issuers money.

Card issuers pay Apple 0.15% of the value of credit card purchases made through Apple Pay and half a cent for each debit transaction, according to the credit unions’ lawsuit. For example, a $100 credit card purchase through Apple Pay costs the card issuer 15 cents in Apple Pay fees.

Affinity Credit Union, GreenState Credit Union, and Consumers Co-op Credit Union filed the lawsuit in 2022. They argue Apple couldn’t have sustained its Apple Pay fees with meaningful competition, pointing to Android wallets that don’t charge card issuers transaction fees.

The lawsuit alleges Apple blocked rival wallets from using the iPhone’s contactless payment hardware, leaving Apple Pay as the only option for tap-to-pay card transactions. The credit unions say the lack of competition let Apple charge inflated fees, which they want repaid along with changes to the challenged practices.

Apple previously tried to have the case dismissed. A 2023 ruling allowed the monopolization claim to continue while dismissing a separate allegation that Apple unlawfully tied iOS devices to Apple Pay.

Thousands of issuers can pursue the case together

The certified class covers U.S. entities that issued an Apple Pay-enabled card and paid Apple a fee for a transaction made with that card. The plaintiffs estimate that thousands of banks and credit unions qualify.

Apple didn’t dispute that the proposed class was large enough to meet the numerical requirement for certification. White found that the court can resolve key questions for the entire class rather than separately for every issuer.

The questions include whether Apple had monopoly power, harmed competition, and charged fees that injured card issuers. Apple’s uniform rates for credit and debit transactions could also provide a common way to calculate any overcharges if the issuers prove their case.

Apple Pay setup on iPhone

The ruling also allows Christopher Vellturo, the plaintiffs’ damages expert, to testify. Vellturo compares Apple’s issuer fees with the zero-dollar issuer fees he attributes to competing mobile wallets, then uses that difference to estimate how much class members may have overpaid.

Apple challenged his methodology and asked the court to exclude his testimony. White instead found that Apple’s objections concern how convincing the analysis is, leaving the company free to attack its assumptions and conclusions as the case continues.

iPhone tap-to-pay access has changed since the lawsuit began

Apple’s restrictions have changed since the credit unions filed the lawsuit. Starting with iOS 18.1 in 2024, eligible third-party apps can handle contactless iPhone payments without routing them through Apple Pay, and users can choose an eligible app as their default for contactless transactions.

Developers still need Apple’s approval and a commercial agreement that includes applicable platform fees, according to Apple’s documentation. Apple’s developer fees are separate from the Apple Pay transaction fees challenged in the lawsuit.

The September 23 ruling lets the issuers pursue their claims together, including a request to change Apple’s practices. Expanded NFC access could affect what changes remain necessary, but it doesn’t resolve claims over fees already paid or establish that the fees were unlawful.

Google is finally rolling out the Pixel Watch’s long-awaited Health Guardian features, bringing blood pressure trends, insulin resistance trends and sleep breathing quality metrics to the Google Health app.

The new tools start appearing for eligible users today, September 24, with monthly trend reports expected to arrive in October. They’re available for free on the Pixel Watch 3, Pixel Watch 4 and Pixel Watch 5, while Fitbit Air users will eventually get access through a Google Health Premium subscription.

The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2.

The agency also added CVE-2026-71362, another critical-severity flaw affecting Adobe Commerce, to the list of security issues being leveraged in attacks.

Hackers are also exploiting two additional vulnerabilities: a high-severity code injection flaw in Microsoft SharePoint tracked as CVE-2026-65660, and a medium-severity pre-authentication SSH state-machine/workflow bypass in Mikrotik RouterOS identified as CVE-2026-67279.

For the two critical issues added to the Known Exploited Vulnerabilities (KEV) catalog, federal agencies using the affected products have until  Sunday, September 27, to apply the recommended updates or mitigations, or discontinue their use.

The CVE-2026-5430 flaw received a maximum severity score and impacts WSO2 API Manager versions 4.1.0 through 4.6.0, API Control Plane, Traffic Manager, and Universal Gateway versions 4.5.0 and 4.6.0.

In the original advisory on May 3, the vendor says that an attacker successfully exploiting the vulnerability could compromise administrative accounts and take full control.

The problem stems from the JWT authentication mechanism accepting tokens signed with an unsupported algorithm.

CISA has not shared any details about the attacks, but security firm watchTowr announced on September 15 announced that its honeypots captured exploitation attempts.

The researchers said they observed a limited number of attempts from one IP address on September 13 using forged JWT tokens against a WSO2 product. However, the attacker targeted the wrong product for CVE-2026-5430.

watchTowr reproduced the attack on the correct product, where a forged token could expose API endpoints and application credentials.

Yordan Ganchev, threat intelligence specialist at watchTowr, told BleepingComputer that WSO2 is not a niche target.

“Its technology is used by nearly 1,000 customers across banking, government, telecommunications, and logistics,” explained Ganchev.

“Organizations in these sectors can’t afford to wait for exploitation to be formally confirmed.”

The second critical-severity bug added to the KEV is CVE-2026-71362, an incorrect authorization vulnerability in Adobe’s Commerce and Magento e-commerce platforms.

Ecommerce security company Sansec observed CVE-2026-71362 being exploited in the wild, saying that threat actors require “no existing account, administrator privileges, or user interaction” to leverage it.

The deadline for federal agencies to mitigate both vulnerabilities is September 27, but CISA encourages all organizations to take action and prioritize addressing the security issues listed in the KEV.

For the Microsoft SharePoint and Mikrotik RouterOS flaws, CISA is giving agencies until Monday, September 28 to fix them.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

[This is a sponsored article written in collaboration with Selangor Information Technology & Digital Economy Corporation (Sidec).]

The world is getting hungrier for more chips, and no, not the crispy kind you get at the supermarket. 

With AI fueling the chip demand, Deloitte projects the global chip marketing will hit US$975 billion in annual sales this year. And Malaysia already has our cards in it. In fact, we rank as the sixth largest semiconductor exporter in the world, handling roughly 13% of global ATP (assembly, testing, and packaging) capacity.

Yet, there’s a crucial gap that has to be addressed for us to continue being a prominent semiconductor player. 

Just earlier this year, PwC reported that local universities are producing 5,000 graduates annually in the semiconductor industry. But we actually need around 10x more homegrown talents to move up the semiconductor value chain.

This is where AiSEM@Selangor, or better known by its former name SDEC, comes in. This October 14 to 17, the annual summit will return at KLCC and Grand Hyatt KL as one of the flagship components of the Selangor International Business Summit (SIBS) 2026.

Here is what’s happening across the four days and how you can get involved.

Why did SDEC rebrand to AiSEM@Selangor & why does it matter?

For the past decade, SDEC served as Selangor’s smart city and e-commerce platform, featuring forums, exhibitions, and awards for the region’s top digital players.

Now that Al and semiconductors has increasingly become a vital aspect in Selangor’s digital economy, Sidec has rebranded the event to AiSEM@Selangor to match the region’s evolving technology landscape.

Name change aside, AiSEM@Selangor continues SDEC’s legacy of promoting technological innovation and providing a platform for industry players. But with a stronger focus on AI and semiconductors this time.

This year’s theme is “Designed By Malaysia: Building a Globally Competitive AI Semiconductor Ecosystem” and the scale remains as substantial as ever: 15,000 visitors, over 150 exhibitor booths, and two flagship conferences.

Globally esteemed leaders will be sharing their industry insights, including names such as:

Sharing the stage with them are some of our very own Malaysian chip companies—QES Group Berhad, Oppstar Berhad, Alphaswift Industries, SkyeChip Berhad, Infinecs Systems, and SiliconX.

The homegrown chips taking centre stage 

For years, Malaysia’s semiconductor reputation has rested on the back end — assembly, testing, and packaging chips designed somewhere else. That’s still true, and it’s still valuable but our nation has since grown to contribute more than that.

At AiSEM@Selangor, six Malaysian companies are stepping up to prove it, in a showcase aptly named Design by Malaysia: Meet the Six Homegrown Chips that’s happening on Day 3. 

Each will take the stage to present technology that’s designed or developed entirely in-house:

1. HBM3E Controller by SkyeChip
2. AI PC and Server by MaiStorage
3. Malaysia and Southeast Asia’s First FPGA Chip by SiliconX
4. Maxwell Automotive Grade Low Dropout Regulators by Infinecs
5. Space ASIC by Weeroc
6. Alphaswift FC Mini by Alphaswift Industrie

From memory controllers and AI computing to automotive electronics, space technology, and drones, the lineup spans a broad range of applications. They’re also a reminder that Malaysia’s semiconductor story isn’t just about what happens on the factory floor anymore.

It’s worth carving out time for, especially if you’ve been hearing about Malaysia’s semiconductor industry mostly in terms of ATP. This gives you a look into the other side of the semiconductor story that’s brewing locally.

Day 1 (October 14) at Plenary Theatre, KLCC: Startup pitches before the talks even begin

In the tradition of SDEC, AiSEM@Selangor doesn’t start with talks. Instead, you’ll get front row seats to the Selangor Triple Accelerator Programme Grand Final Demo Day.

Participants of three Sidec accelerator tracks—Retail-X, Deep-X, and Token-X—will pitch their solutions to investors, corporates, and ecosystem leaders. The top eight companies from each of these accelerators will compete for top honours, including further exposure to industry players, mentorship, funding access, and market expansion support.

For context, in the eight years since its launch, the programme has run 11 cohorts, drawn nearly 1,900 applications, and helped 380 companies raise RM212 million in funding collectively. 

With that kind of track record, there’s plenty to look forward to as the latest batch of startups takes the stage for the Grand Final Demo Day!

Day 2 (October 15) at Grand Hyatt KL: All things semiconductor

On the second day, the summit moves to Grand Hyatt KL for the Semiconductor Conference, where over 20 speakers will dig into supply chain resilience, global partnerships, and funding pathways for chip startups. 

The second day’s panels will cover:

Day 3 (October 16) at Grand Hyatt KL: All things AI

Continuing at Grand Hyatt KL, the summit’s lens will shift from chips to the AI systems running on them at the AI Conference.

You’ll get to learn from Robert Li on how AI-powered EDA tools are transforming semiconductor innovation, and how to harness AWS and agentic AI for next-generation semiconductors from Umar Shah. 

Here’s what else is on the agenda:

All four days (October 14 to 17): Discover new technologies and careers

While the conferences run at Grand Hyatt, KLCC will be equally bustling with the AiSEM Exhibition & Showcase. 

150 companies are set to exhibit their technologies, from global chipmakers like Intel and Sandisk, to Malaysian players like Oppstar and SkyeChip. Alongside them will be agencies such as MIDA, MRANTI, and several Selangor local councils.

Beyond the booths, Sidec is providing a comprehensive summit ecosystem for industry players to learn and grow together. You’ll be treated to:

• Startup Street, a dedicated zone for early-stage companies 
• Investor Lounge and Business Matching, structured spaces for funding conversations and networking, with a special opportunity to link up with delegations from Japan and the UK
• Autonomous Showcase, where robotics, drones, and intelligent mobility technologies are put on display
• ChampionCHIP eXperience Competition Demo Day, grand finale of the high-energy integrated circuit (IC) design competition

Running alongside it is the Malaysia Semiconductor Recruitment Day, which is Sidec’s most direct shot at the 10x talent gap mentioned. Here, 35 semiconductor companies meet engineering and technical talent face-to-face, no cover letter required.

The employer list spans multinationals and local firms alike: Intel, Sandisk, STMicroelectronics, NXP Semiconductors, Melexis, X-FAB, Tektronix, Toppan, Altera, Greatech Technology, SkyeChip, MaiStorage, Infinecs, Alphaswift, Weeroc, Oppstar, Sophic, and more.

Oh, and did we mention it’s free entry?

Where this fits into Malaysia’s bigger plan

AiSEM@Selangor lands just months after Malaysia launched the National AI Action Plan 2026–2030, the country’s blueprint for becoming an “AI Nation”. With it carries ambitious goals of becoming among the top 10 countries on the Global AI Index and 300,000 new AI-related jobs by the end of the decade.

The event’s theme, “Advancing Malaysia’s Intelligent Future”, reflects that broader ambition, bringing together the people and businesses working to move the country’s technology ecosystem forward.

Whether you’re looking for your next career opportunity, hoping to pitch your startup, or keen to connect with industry players, this is one event you should not pass up.

Tickets are available here. Conference passes are RM399 for a 2-day all-access pass, or RM299 for a single day. Early bird and other discounts may apply. 

• Learn more about Sidec and AiSEM@Selangor here.

A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts.

Threat actors can exploit the flaw by tricking a logged-in administrator into opening a malicious link, causing the victim’s authenticated session to perform a REST API action permitted by their account.

On default installations, the result is the creation of an administrator account under the control of the attacker.

The Elementor Website Builder is a popular WordPress plugin active on 10 million websites that lets users create websites using a drag-and-drop interface.

The CSRF flaw has yet to receive an identifier and impacts only versions 4.3.0 and 4.3.1. According to statistics from WordPress.org, the two versions are used by up to 2 million sites.

Security firm Patchstack reported the vulnerability to the Elementor team on September 22 after receiving it from bug hunter “Saggre.” Elementor released a fix two days later, in version 4.3.2 of the plugin.

According to Patchstack’s analysis, the CSRF flaw is caused by Elementor’s Editor Events module checking the raw request URI for the elementor/v1/events/ path and bypassing WordPress’s REST nonce validation when that string is present.

Because the URI also contains attacker-controlled query parameters, attackers can append the path to requests targeting other REST endpoints and trick logged-in users into executing them with their existing privileges.

Patchstack says the flaw can be abused in one-click attacks against a logged-in administrator to create a new attacker-controlled admin account.

“One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform,” Patchstack explains.

The security firm says that the attack does not require JavaScript, an attacker-controlled webpage, or a submitted form, and the link can be delivered to the target via email, a chat message, or a comment on the site.

Elementor releases before 4.3.0 do not contain the affected Editor Events proxy, but those older versions are vulnerable to other flaws, some of which are already actively exploited.

Users of the plugin are recommended to upgrade to Elementor version 4.3.2 as soon as possible, which prevents attackers from triggering the bypass through the query string.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

Audioengine has a strong presence in the compact powered speaker category, and one of its most enduring products is the A2+ Series. Labeled as a home music system, the A2+ began as the A2 Desktop Hi-Fi system in 2007, followed by the first A2+ in 2013, which added a USB DAC. The A2+ Wireless followed in 2019 with Bluetooth connectivity, followed by the A2+ Next Gen and Anniversary Editions in 2025.

Building on the success of one of its best-known products, Audioengine has unveiled the A2+ Gen 3 for 2026 with additional improvements designed to keep it relevant in today’s market.

As with its predecessors, the A2+ Gen 3 consists of two compact powered speakers. The primary speaker (left) incorporates wireless and wired source connectivity, along with the amplification required to power both speakers. The secondary speaker (right) is passive and connects to the primary speaker using standard speaker cable.

Audioengine has been a major supporter of this type of system, with the A2 and A2+ helping inspire additional high-performance compact speaker systems such as the A5+, HD3, HD4, HD5, HD6, A1-MR, and more.

What’s New with A2+ Gen 3

The significant addition to the A2+ Gen 3 is the incorporation of Bluetooth 5.3 with Qualcomm aptX Adaptive Bluetooth, along with more refined USB compatibility.

“For years, the A2+ has been the product people recommend when someone asks how to get the highest-quality sound from a small desktop setup,” said Nate Rodriguez, President and CEO of Audioengine. “The A2+ Gen 3 keeps the size and simplicity people already know and love, but gives it broader Bluetooth support and better USB compatibility.”

aptX Adaptive is designed to dynamically adjust transmission based on the audio content and wireless environment. The system supports aptX Adaptive, aptX HD, aptX, AAC, and LC3. Bluetooth audio support now provides a 24-bit input through compatible aptX codecs, while the internal Qualcomm QCC3040 Bluetooth receiver handles wireless playback.

Another update Audioengine is including in the A2+ Gen 3 is the switch from Class A/B amplification to Class D, as well as an increase in power output from 15 to 20 watts per channel.

What Makes the A2+ Legacy Special 

The A2+ has remained a successful part of the Audioengine lineup since its initial introduction as the A2, combining high-quality sound, straightforward connectivity, and a compact footprint without requiring apps, accounts, or a complicated setup. The A2+ Gen 3 continues that focus while introducing updated amplification and wireless connectivity to the platform.

“Technology changes, but the reason people buy an A2+ really hasn’t,” Rodriguez said. “They want their music to sound great without turning listening into a project. That continues to be the idea behind this product.”

Comparison

The Bottom Line 

The wireless powered speaker category has become an increasingly popular option for a wide range of audio setups. These include computer workstations, gaming systems, soundbar replacements, and space-saving compact music systems.

Audioengine is a go-to brand in this category, offering consistently solid products that often perform beyond expectations. The periodic upgrades to the A2+, now in its third generation, continue that trend while keeping the price at or below $300.

However, despite the addition of Bluetooth aptX Adaptive, claimed improvements in USB audio, and the switch from Class A/B to Class D amplification, there are still some omissions from the A2+ that may be deal breakers for certain users.

For example, the A2+ still doesn’t provide HDMI ARC or a dedicated phono preamplifier. Adding these two features would noticeably improve setup flexibility, making the A2+ a more practical soundbar alternative while also bringing vinyl enthusiasts into the fold.

It is also important to keep in mind that there is some notable competition from brands such as KEF and Edifier.

KEF commands much higher prices but includes some of the aforementioned features, such as HDMI eARC, on several models, including the LSX II and LSX II LT. KEF also includes Wi-Fi, providing access to more streaming options than Bluetooth alone.

On the other hand, Edifier’s M90 does include HDMI eARC and is often on sale for around $300, while its step-up R2750DB MKII could appeal to listeners who don’t mind a larger speaker.

Ultimately, the Audioengine A2+ Gen 3 is for those looking for a compact desktop audio solution with minimal connectivity needs, or who primarily intend to use its Bluetooth wireless connection.

Where to Buy:

Related Reading: