The Daily Index — Tuesday, October 27, 2026 · TLDR Index

Across today’s newsletters

Today’s Index

A visual metaphor for malicious GitHub workflows planted across repositories: routine automation conceals encoded secrets moving from repository logs toward an external archive. — AI-generated editorial illustration

TLDR InfoSec

GHEIST: ATTEMPTED SCALED ABUSE OF STOLEN GITHUB TOKENS STUMBLES

Attackers wielding stolen GitHub tokens from more than 850 accounts planted over 13,500 "sync-check" workflows that base32-encode repository and environment secrets to evade log masking, then pulled the logs through GitHub's own API and deleted the runs. GitHub's approval hold blocked every public-repository run, but private repositories and GitHub Enterprise Server executed the payload, with a newer variant sweeping self-hosted runners for cloud, Kubernetes, and AI provider credentials. Defenders should hunt for ci-sync-* branches, the gheist user agent, and OIDC role assumptions from those branches, then rotate every secret an affected repository could reach, since deleting the branch does not undo the exposure.

wiz.io · 5 min

TLDR Crypto

COINDCX CONFIRMS $16 MILLION LOSS FROM RETIRED WALLETS

CoinDCX admitted losing 15.99M USDT from deposit wallets it stopped using after its July 2025 hack, and says it absorbed the loss. It says an automated sweeping service failed for a period, so user deposits built up at a deprecated address with unknown vulnerabilities. FlashRescue's co-founder flagged the outflows on Wednesday. CEO Sumit Gupta called it “a false alarm,” and the company's account called the claims “misleading.” ZachXBT showed one address was used for 10 months after the 2025 incident and swept deposits as late as April and May 2026. He advised users to withdraw and said the founders either lied or were negligent. CoinDCX says user funds are safe in cold wallets, and trading and withdrawals continued. The July 2025 hack cost about $44M. The founders were also arrested in March over a fraud complaint.

links.tldrnewsletter.com · 4 min

TLDR

THE BIGGEST TAKEAWAYS FROM ANTHROPIC'S IPO PROSPECTUS

Anthropic unveiled its IPO paperwork yesterday, putting it on track to go public as soon as the week before Thanksgiving. The 400-page prospectus tells a story of how the company could usher in a new era of progress that will transform how people code, conduct research, build financial models, and automate routine tasks. It also warned that AI could lead to the development of new bioweapons, destabilize the geopolitical order, and evolve beyond the ability of humans to understand and control. Anthropic plans to trade on the NASDAQ under the ticker 'ANT', with a valuation expected to land between $1.5 trillion and $2 trillion.

links.tldrnewsletter.com · 8 min

TLDR Crypto

VULNERABILITIES FOUND IN GLAMSTERDAM, AGENTS CAME TO THE RESCUE

ChainSecurity flagged vulnerabilities in EIP-8037/8038, two state-pricing EIPs central to Glamsterdam's planned gas limit increase from 60M to 200M, with at least 13 major DeFi protocols identified as affected. The mechanism: EIP-8037's gas refill when storage slots are freed breaks the 1/64 gas guarantee in nested contract calls, enabling attackers to trigger outer-contract error handlers that lacked the gas to execute under the prior pricing model. Researchers from the Ethereum Foundation and Ethlabs each deployed AI agents overnight to scan for vulnerable contracts, then merged their efforts into a shared GitHub coordination repo where agents claim tasks via issue comments, deposit findings in structured directories, and produce consolidated memos without human intermediation. Core devs at the ACD paused any Glamsterdam launch date pending full impact analysis. The same agent-scanning framework is now running against EIP-8198 (Quick Slots, 12s to 10s slot time) ahead of Hegotá.

links.tldrnewsletter.com · 5 min

TLDR

'IT'S OFFENSIVELY CHEAP': HOW SOLAR POWER IS QUIETLY BECOMING BIGGER THAN NUCLEAR

Solar power will likely provide 10% of the world's power by the end of the year. Solar electricity is the fastest-growing source of new electricity in history as it has become unbelievably cheap. China is still the world's biggest solar power producer by far, but the installations in the US are skyrocketing. Even with tariffs, solar is still one of the cheapest sources of new power in the US, and it is getting built regardless of political lines.

bbc.com · 9 min

TLDR Dev

HOW THE CLAUDE CODE TEAM DOES CODE REVIEW

The Claude Code team reported more than twice as many merged PRs from June to September while the share requiring reverts fell by over 40%. Its process combines automated review before and after PR creation, security checks, human approval scaled by risk, and fast rollback. It also caps review cycles after one PR bounced between agents more than fifty times overnight.

links.tldrnewsletter.com · 16 min

TLDR IT

ANTHROPIC'S SOARING SALES, STEEP LOSSES PUT AI FRENZY TO IPO TEST

Anthropic published its US IPO filing as investors scrutinize the cost of the AI boom. Its first-half net loss was $80.7 billion, largely driven by a non-operating convertible-bond item, while its operating loss narrowed to $693 million. The prospectus also highlights growing computing costs and dependence on a small group of cloud and chip suppliers.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

CRITICAL HTTP2SHELL BROTLI VULNERABILITY TRIGGERS EMERGENCY PATCHES

Originally reported as a Node.js vulnerability, researchers found that a critical flaw in the Brotli decoder could affect software across multiple ecosystems that use it. The vulnerability stems from a buffer overflow that an attacker can exploit with a specially crafted Brotli-compressed stream. Node.js, .NET, and several Python libraries released emergency patches to fix the vulnerability.

links.tldrnewsletter.com · 2 min

TLDR IT

AZURE COMMUNICATION SERVICES IS RETIRING: NOW WHAT

Microsoft has announced the retirement of most Azure Communication Services (ACS) features by September 30, 2028, limiting ongoing functionality exclusively to Microsoft Teams integrations. New customer onboarding was restricted starting in late 2026, and existing standalone services such as chat, SMS, and WhatsApp will be shut down entirely. This move suggests Microsoft's failure to capture a viable standalone market, leaving enterprise users facing a difficult migration.

bloggeek.me · 10 min