The Daily Index — Wednesday, September 30, 2026 · TLDR Index

Across today’s newsletters

Today’s Index

An MCP client attempts to authenticate with its expected login service, but a malicious server redirects the OAuth exchange and captures the credentials and authorization proofs. — AI-generated editorial illustration

TLDR InfoSec

OFFICIAL MCP PYTHON SDK FLAW CAN LET MALICIOUS SERVERS STEAL OAUTH CREDENTIALS

A high-severity flaw in the official MCP Python SDK let malicious MCP servers redirect OAuth token requests to attacker-controlled endpoints. Affected 1.x (1.9.1–1.29.1) and 2.x (2.0.0–2.1.1) clients sent the client secret, authorization code, and PKCE proof key to the attacker, enabling full account takeover with the app's granted permissions. Fixes are in 1.30.0 and 2.2.0. ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider also require passing issuer= to pin the expected login service.

thehackernews.com · 2 min

TLDR IT

WHAT HAPPENS WHEN THE CLOUD BLOWS UP?

Missile and drone strikes during the March 2026 Iran conflict hit AWS facilities in the UAE and Bahrain. AWS says the damage exceeded what its multi-AZ design can withstand, and restoration isn't expected until early 2027. The piece argues that availability zones don't fail independently when a whole region is physically attacked, and that continuity plans should account for that.

infoworld.com · 4 min

TLDR Hardware

STARSHIP REACHES ORBIT FOR THE FIRST TIME ON FLIGHT 14, DEPLOYS 26 NEXT-GEN STARLINK SATELLITES

Starship's 14th test flight reached orbit for the first time on Monday, despite one engine shutting down unexpectedly mid-flight, deploying 26 next-generation Starlink V3 satellites one by one from a Pez-dispenser-style mechanism at roughly 269km altitude before the mission ended early. Each Starship can now carry about 60 Starlink V3 satellites, roughly 20 times the capacity of a Falcon 9 launch, and the new satellites offer around 10x the downlink and 22x the uplink capacity of the previous V2 generation, capability SpaceX needs to support Musk's stated goal of Starlink eventually carrying a majority of the world's internet traffic.

arstechnica.com · 4 min

TLDR DevOps

INTRODUCING CF: THE AGENTIC CLI FOR THE ENTIRE CLOUDFLARE API

Cloudflare has introduced cf, a new command-line interface that allows agents to access over 3,000 operations across the entire Cloudflare API. Wrangler previously supported around 280 commands, and agent usage of that tool reached 48% last week. cf uses a unified API generation pipeline to standardize commands and defaults to JSON output for agents. Cloudflare will provide maintenance support for Wrangler for 18 months after the beta ends.

blog.cloudflare.com · 7 min

TLDR IT

MICROSOFT'S COPILOT SUPER APP COMES WITH A METER ATTACHED

Microsoft is splitting Copilot pricing in two. A per-user subscription still covers "Everyday AI" in Office apps, while agentic features like Cowork, Code, Autopilot, and frontier models are billed by usage on top of the seat. Admins get spending caps and alerts, but budgets that were fixed per head now have to absorb costs from agents that run without a user prompting them.

theregister.com · 3 min

TLDR Crypto

CHAINLINK LAUNCHES CCIP 2.0 WITH ETHLABS FCR, CUTTING CROSS-CHAIN CONFIRMATIONS 30X

Chainlink launched CCIP 2.0 on September 28, adding Cross-Chain Verifiers (CCVs) that let enterprises attach custom security checks before destination-chain execution, built-in KYC, AML, and sanctions screening on every transaction, AWS and Google Cloud deployment kits, and additive verification from Infosys, Nethermind, and Deutsche Börse's Crypto Finance, bringing the protocol's secured token value above $84 billion. Ethlabs integrated its Fast Confirmation Rule (FCR) with CCIP 2.0, drawing quick-action signals from Ethereum's existing validator consensus to drop cross-chain confirmation times from approximately 13 minutes to 12-24 seconds (30x faster) without new economic assumptions or additional infrastructure. The combined update targets institutional RWA issuers and tokenized asset distributors requiring compliance enforcement and sub-30-second settlement across chains.

threadreaderapp.com · 3 min

TLDR Hardware

VSMC OPENS FIRST 300MM FAB IN SINGAPORE, VIS-NXP JOINT VENTURE HITS 99%+ YIELDS

VisionPower Semiconductor Manufacturing Company, a joint venture between Vanguard International Semiconductor and NXP, opened its first 300mm wafer fab in Tampines, Singapore, completed in just 22 months and now in risk production after its first sample lot cleared yields above 99%. The fab targets mature nodes between 130nm and 40nm for power management, mixed-signal, analog, and interposer chips serving automotive, industrial, consumer, mobile, and HPC customers, with volume manufacturing starting Q1 2027 and full capacity, roughly 44,000 wafers a month and 1,600 jobs, targeted by 2029.

verdict.co.uk · 2 min

TLDR DevOps

BEYOND KUBERNETES AT MODAL: HOW TO SCALE 1 MILLION CONCURRENT SANDBOXES IN SECONDS

Modal engineers rebuilt their sandbox platform to support millions of concurrent sandboxes by replacing Kubernetes-style centralized coordination with distributed worker state and parallel scheduling. The redesign created one million sandboxes in under 60 seconds with sub-half-second startup times, prompting talk that infrastructure is splitting into separate coordination and execution planes.

infoq.com · 5 min

TLDR IT

MICROSOFT ANNOUNCES GENERAL AVAILABILITY OF WSLC: LINUX CONTAINERS ON WINDOWS

WSLC, Microsoft's native way to run Linux containers on Windows, is now generally available through a new wslc.exe command. Each session gets its own storage VHD, stronger isolation, and a new networking model compared with standard WSL. The code is open source in the microsoft/wsl GitHub repository.

phoronix.com · 1 min