A couple quick hits while I rev the content engine back up over here!

• CSS Weaponized at Black Hat 2026: Security researcher Gareth Heyes dropped a research paper showing how CSS alone can break out of webmail sanitizers. Without a single line of JavaScript, malicious stylesheets in Gmail and Outlook were manipulated to spoof UI elements, capture keystrokes, and steal tokens. Stripping <script> tags isn’t cutting it anymore, apparently.
• The 2026 State of CSS Results Are In: The survey numbers show :has() leading as the most used newer feature, while Anchor Positioning holds the crown as the “favorite feature we wish had better browser support.” On the workflow front, 80% of developers report using AI for less than half of their CSS work. It turns out layout still needs humans!