A developer named Jay published a proposal called UTF-8000 aiming to remove the size limits of standard UTF-8 encoding, and reached out to Ken Thompson and other researchers behind earlier extension schemes for feedback. Ken Thompson replied with a technical observation about a zigzag signed variant requiring full code-unit reads for string comparison, while another correspondent, Thomas Eugene Bishop, pushed back on the proposal's framing, objecting to language calling rival schemes 'rejected' and disputing the claim that Larry Wall's UTF-8 extension is 'inextensible'.
utf-8000.jb2170.com
· 2026-09-20
Microsoft researchers identified a large phishing operation that inserts invisible Unicode 'Tags' characters inside finance-related keywords—splitting words like 'funding' into fragments—to slip past email filters that scan for suspicious terms. The campaign peaked at 2.37 million daily messages in late February and, despite a drop in volume by May, remains active, with Defender for Office 365 tracing it to 148 finance-themed sender domains.
bleepingcomputer.com
· 2026-09-06
Microsoft says spammers have repurposed ASCII smuggling, a technique once used mainly to sneak hidden prompt-injection instructions into AI systems, to disguise spam keywords and slip past Office 365 filters. The company detected daily signature hits jump from about 21,000 to over 1.3 million in early February, reaching 2.5 million within days before tapering off by mid-May.
arstechnica.com
· 2026-09-04
Security researcher Seth Larson identified that Python's stringprep module, used in IDNA 2003 domain name processing, relies on str.lower() which uses whatever Unicode version ships with the interpreter rather than the fixed Unicode 3.2 version specified in RFC 3454. This means case-folding behavior for internationalized domain names can differ across Python versions, since unicodedata.unidata_version varies by interpreter build.
sethmlarson.dev
· 2026-08-25
GoKawiil