The Daily Index — Friday, November 21, 2025 · TLDR Index

Across today’s newsletters

Today’s Index

TLDR

ANDROID QUICK SHARE NOW WORKS WITH AIRDROP ON IPHONE, STARTING ON PIXEL 10

Android's Quick Share now works with Apple's AirDrop system. Apple devices will now appear in the Quick Share interface on Android, and Android devices will appear on macOS devices. The two-way sharing works for photos, videos, and other files. The connection is direct and peer-to-peer - data is never routed through a server, and shared content is never logged.

9to5google.com · 4 min

TLDR AI

GEMINI 3 PRO IMAGE

Nano Banana Pro, aka Gemini 3 Pro Image, claims studio-quality image gen and editing. It can render text (a historic struggle), consistent multi-character scenes, and real-world knowledge integration for creating infographics.

deepmind.google · 5 min

TLDR Dev

BRUTE-FORCEABLE AIRLINE RESERVATION API LEFT MILLIONS OF PASSENGER RECORDS VULNERABLE

A security researcher discovered a vulnerability in Avelo Airline's reservation API that allowed unauthorized access to passenger data through a brute-force attack due to the lack of last name verification and rate limiting. By exploiting this flaw, an attacker could have potentially accessed millions of passenger records, including PII, government ID numbers, and partial payment data, within a few hours. The researcher responsibly disclosed the vulnerability to Avelo on October 15, who quickly responded and patched the issues by November 13.

alexschapiro.com · 7 min

TLDR InfoSec

TAMPEREDCHEF MALWARE SPREADS VIA FAKE SOFTWARE INSTALLERS IN ONGOING GLOBAL CAMPAIGN

TamperedChef (aka BaoLoader) distributes JavaScript backdoors through fake software installers signed with fraudulent certificates from shell companies in the US, Panama, and Malaysia. Delivered via malvertising and SEO poisoning targeting searches for PDF editors and product manuals, the malware establishes persistence through scheduled tasks that execute obfuscated JavaScript, which beacons encrypted system data to C2 servers, with primary infections concentrated in US healthcare, construction, and manufacturing sectors. Security teams should implement application allowlisting, monitor for suspicious scheduled tasks executing JavaScript payloads, validate code-signing certificates against threat intelligence, and restrict access to product manuals through authorized channels only.

thehackernews.com · 2 min

TLDR Crypto

BANKS' CRYPTO RULES MUST BE REWORKED

Basel Committee chair Erik Thedéen acknowledged crypto capital rules need reworking after the US and UK refused to implement the 2021 framework requiring banks to hold large capital reserves against crypto losses, with Fed Vice-Chair Michelle Bowman calling the rules "not very realistic." The original framework focused on volatile assets like Bitcoin but failed to account for stablecoins' rapid growth and lower risk profiles. The Bank of England declined to implement the rules in their current form as the committee faces pressure to quickly reassess whether stablecoins warrant the same capital treatment as traditional cryptocurrencies ahead of the framework's planned January implementation.

coindesk.com · 5 min

TLDR

GOOGLE LAUNCHES NANO BANANA PRO, AN UPDATED AI IMAGE GENERATOR POWERED BY GEMINI 3

Google's Nano Banana Pro image editing and generation tool is now available. Built on Gemini 3 Pro, the model can create infographics, slide decks, and blend images with consistency. Nano Banana Pro is available in the Gemini app, Google's writing assistant, NotebookLM, and the company's developer, enterprise, and advertising products. Google AI Pro and Ultra subscribers will have access to it through Google Search's AI mode.

cnbc.com · 4 min

TLDR

BLUE ORIGIN REVEALED SOME MASSIVELY COOL PLANS FOR ITS NEW GLENN ROCKET

Blue Origin has revealed a roadmap for upgrades to its New Glenn booster that includes more main engines and a super-heavy lift capability. The upgrades are designed to increase payload performance and launch cadence while enhancing reliability. They will be phased in over time, starting with the third launch of New Glenn, which will likely be in the first half of 2026. A list of the planned modifications is available in the article.

arstechnica.com · 4 min

TLDR

GLASS, NOT ICE

Cryopreservation is a technology that brings tissue into a temporary glassy state to pause biological time so that patients can have more time. It is used in IVF and to help people recover from chemotherapy through hematopoietic stem cell transplants. The technology uses controlled-rate freezers, perfusion systems, novel cryoprotectants, and rewarming devices to preserve complex biological systems. The field is aiming for whole-body medical hibernation, but there are many fundamental questions that must be answered before we can start heading toward that goal.

untillabs.com · 20 min

TLDR

HOW TO WRITE A GREAT AGENTS.MD: LESSONS FROM OVER 2,500 REPOSITORIES

GitHub's agents.md feature allows developers to create agents with custom instructions. agents.md is where developers define all of the specifics, provide code style examples, and set clear boundaries of what not to do. Most agent files fail because they're too vague. The best files provide agents with a clear job or persona, exact commands to run, well-defined boundaries to follow, and clear examples of good output for the agent to follow.

github.blog · 12 min