Mojo goes open source; Vercel stakes $1M on sandbox security; untethered AI agents need capital accountability

PortSwigger Research

CSS: The Bomb Inside Your Inbox

Researchers discovered multiple CSS-based attack vectors that compromise webmail clients. Attackers use CSS attribute selectors and mutations to steal authentication tokens and intercept user clicks. These attacks bypass security filters in Gmail, Outlook, ProtonMail, and other major email services. CSS can log passwords without JavaScript in protected environments. Webmail providers must update sanitization to prevent these CSS exploitation techniques.

Seth Larson

When str.lower() Is a Security Vulnerability in Python

Python's str.lower() function does not follow RFC 3454 specifications for IDNA 2003 case-folding. RFC 3454 requires Unicode 3.2.0 case-folding rules, but Python uses the interpreter's current Unicode version. Different Unicode versions produce different IDNA encodings for the same input string, creating security issues. The fix requires exceptions to make str.lower() behave consistently with Unicode 3.2.0 standards. This vulnerability shows how standards-compliant code can become insecure when implementation details diverge from specifications.

Cloudflare Blog

BGP Role Model: Tracking the Adoption of RFC 9234

RFC 9234 introduces a BGP Role capability that stops route leaks by requiring neighbors to agree on their relationship type. An Only to Customer (OTC) attribute keeps routes within their intended scope. Cloudflare found that some Tier-1 networks strip the OTC attribute, which weakens the standard's value for early adopters. After researchers contacted them, one major Tier-1 (Arelion) rolled out a fix while GTT continues to strip the attribute.

Vercel

$1 Million Hacker Challenge for Vercel Sandbox

Vercel launched a public bug bounty program running two weeks that offers up to one million dollars. Researchers compete to find security problems in Vercel Sandbox, which uses Firecracker microVMs to isolate untrusted code. Demonstrations must show how to break compute isolation or bypass network firewalls. Vercel chose to test its sandbox on its own schedule instead of waiting for attackers to find problems.

Linear

AI Usage Patterns in Software Teams

Linear reports that AI feature use more than doubled from January to June 2026 across all roles. AI now authors just under half of all content created in Linear. Product managers and designers now ship code using AI tools. AI adds capacity rather than saves time, as total product development time increases.