Gmail Address Variants Bypass String Comparison and Enable Multiple Registrations
A developer investigation revealed that one user had successfully registered four separate accounts using only legitimate Gmail address variants that all route to the same mailbox: Ivan.Petrov@gmail.com, ivanpetrov@gmail.com, ivan.petrov+shop@gmail.com, and IVAN.PETROV@gmail.com.
Colleagues noticed more user records than actual people in the database. The discrepancy traced back to a single line of code that compared email addresses as raw strings without normalization.
Gmail treats the local part of an address case-insensitively, discards everything after a plus sign, and ignores dots. These rules let one inbox generate an unlimited number of distinct strings that still receive mail at the same destination.
Why string comparison fails
Three common cases break naive equality checks:
- Case differences in the local part or domain
- Plus-addressing suffixes such as +shop or +promo
- Dots inserted anywhere in the local part of a Gmail address
Normalization must be applied selectively. Dots are ignored only for gmail.com and googlemail.com; applying the same rule to other providers would incorrectly merge unrelated mailboxes.
Homograph domain attacks
A separate but related threat appears when domains contain visually identical Cyrillic characters. The string еxample.ru (with Cyrillic е) encodes under IDNA to xn--xample-2of.ru, creating a look-alike address that passes superficial inspection yet points elsewhere.
Recommended implementation
Store two fields: the original address for sending mail and a normalized address for uniqueness enforcement. Perform lower-casing on the entire address, strip plus-suffixes only for Gmail, remove dots only for Gmail, and run every submitted domain through IDNA encoding to detect hidden non-ASCII labels. A simple confirmation email remains the most reliable validator of deliverability.
A diagnostic query can surface existing problems by grouping on the normalized domain and comparing raw versus deduplicated local parts.
Related articles
CISA Adds Apple CVE-2024-27834 to Known Exploited Vulnerabilities Catalog After Confirmed Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency has added the Apple vulnerability CVE-2024-27834 to its Known Exploited Vulnerabilities catalog following confirmed in-the-wild exploitation. The flaw impacts multiple Apple platforms including iOS, iPadOS, macOS, Safari, tvOS, and watchOS. It is an authentication bypass issue that can be exploited for arbitrary read and write operations when an attacker already possesses initial access rights. The vulnerability was discovered and patched in 2024, yet exploitation activity has now prompted federal action. NIST rates the issue at CVSS 5.5 Medium. U.S. federal agencies are required to apply mitigations by November 18.
Ruby on Rails Releases Security Updates Fixing 21 Vulnerabilities Including Critical Active Storage Flaw
The Ruby on Rails development team has issued security updates for versions 8.1.4.1 and 8.0.5.2 that address a total of 21 vulnerabilities. One issue rated critical affects the Active Storage component when ImageMagick is used for image processing. The flaw tracked as CVE-2026-122006 carries a CVSS v3.1 base score of 9.8 and could allow arbitrary file writes or data exfiltration from untrusted uploads. Additional high-severity problems enable remote code execution, arbitrary file reads, parameter validation bypass, IP spoofing, cross-site scripting, and denial-of-service conditions. The 8.0 branch will reach end of security support on November 7, 2026, after which no further fixes will be provided. Administrators are strongly advised to apply the patches immediately.
European Supermarkets Hit by Refrigeration Cyberattacks Exploiting Danfoss CVEs
Multiple European supermarket chains suffered coordinated cyberattacks that remotely altered refrigeration unit temperatures to 50°C, causing widespread food spoilage across France, Sweden, Ireland, Belgium, Luxembourg, and Estonia. Attackers exploited publicly disclosed vulnerabilities in Danfoss AK-SM 800A controllers, including a code-of-the-day authentication bypass and command injection flaws tracked as CVE-2025-41450 and CVE-2025-41451. The incidents, occurring in October and November, resulted in millions of euros in losses with no ransom demands observed. Claroty researchers had previously mapped thousands of exposed management interfaces running outdated firmware. Investigations by ANSSI and national authorities highlight risks to cyber-physical systems where configuration changes produce direct physical damage. Experts recommend immediate network segmentation, firmware updates, and enhanced monitoring of setpoint changes.
Negative Specifications: How Bug History Strengthens AI Agent Code for Ginux Kernel
The article explores how incomplete positive specifications lead to vulnerabilities and compatibility gaps when AI agents develop complex systems like the Ginux kernel. Author sgordey describes discovering memory limit bypasses, domain controller takeover via infinite loops, and ineffective SO_REUSEADDR flags during security audits of the Rust-written Linux-compatible kernel created by Gregory Kurtzer using HDAE methodology. It argues for building negative specifications drawn from historical vulnerabilities such as SACK Panic and SACK Slowness to define what must never happen and how to test it. The piece details practical integration of past bug data into frameworks including BMAD, OpenSpec, Kiro, and Superpowers, recommending dedicated steps like failure-history and challenge-spec tasks before coding begins. Tools rust-in-peace and reproof already apply similar multi-angle searches combining threat modeling, unaided discovery, and CVE history. The author stresses that requirements derived from real failures must enter both specifications and test plans to prevent agents from repeating known mistakes.