--- title: Issue #764: The spyware hiding in old script tags —... description: This newsletter issue rounds up frontend news and tools. Chris Coyier argues most dynamic social media cards waste the image by restating the title, and shows... canonical: https://daily.dev/posts/issue-764-the-spyware-hiding-in-old-script-tags-frontend-focus-5nlcewvsb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Issue #764: The spyware hiding in old script tags — Frontend Focus | daily.dev og:description: This newsletter issue rounds up frontend news and tools. Chris Coyier argues most dynamic social media cards waste the image by restating the title, and shows... og:url: https://daily.dev/posts/issue-764-the-spyware-hiding-in-old-script-tags-frontend-focus-5nlcewvsb og:image: https://api.daily.dev/og/posts/5nlCeWVsB.png og:image:alt: Issue #764: The spyware hiding in old script tags — Frontend Focus og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Issue #764: The spyware hiding in old script tags — Frontend Focus **[Frontend Focus](https://daily.dev/sources/ffocus)** · 2 min read · 0 upvotes · 0 comments ## Summary This newsletter issue rounds up frontend news and tools. Chris Coyier argues most dynamic social media cards waste the image by restating the title, and shows better alternatives. Safari 27.2 adds ::field-content for styling a customizable select's displayed text and renames flow-tolerance to fit-tolerance. Harry Roberts revises his performance budget advice to use a 'representative worst' (P90 or P95) instead of a single worst result. A Fireship video recaps a rough security week covering PHP2Shell RCE bugs, a backdoored LiteLLM release, and a CA with private keys that were numbers under 256. Keshav Malik hardens AI-generated HTML previews with iframe sandboxing, CSP and checked postMessage handlers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does setting a performance budget from my single worst test result cause problems? A budget based on the single worst result lets one statistical outlier mask real regressions, since that one bad data point sets a ceiling so high that genuine slowdowns stay hidden underneath it. The fix is to use a 'representative worst' instead, such as the P90 or P95 of recent measurements, which better reflects typical bad-case performance. _Developers tightening performance budgets can track techniques like this one on daily.dev._ ### What is PHP2Shell and why was it a major security issue? PHP2Shell refers to a pair of PHP engine bugs that allowed unauthenticated remote code execution (RCE), making it one of the more severe vulnerabilities disclosed during a particularly bad week for internet security that also included a backdoored LiteLLM release and a certificate authority using private keys derived from numbers under 256. _Teams patching PHP engines after incidents like this follow security writeups on daily.dev._ ### How do you safely render AI-generated HTML in a browser preview without exposing your app to attacks? Harden the preview with iframe sandboxing, a strict Content Security Policy, and a carefully validated postMessage handler for communication between the preview and the parent app. Five separate attack demos showed how an unprotected preview rendering model-generated HTML can be exploited, motivating each of these three defenses. _Developers building AI code-generation features can study hardening patterns like this on daily.dev._ ## Similar posts on daily.dev - [Issue \#758: When CSS could run JavaScript — Frontend Focus](https://daily.dev/posts/issue-758-when-css-could-run-javascript-frontend-focus-wdmfmtcwj) · Frontend Focus · 2 upvotes · 0 comments - [WebKit Features for Safari 27.2](https://daily.dev/posts/webkit-features-for-safari-27-2-ujx5lb1g6) · WebKit · 0 upvotes · 0 comments - [Issue \#755: The asteroid hitting frontend development — Frontend Focus](https://daily.dev/posts/issue-755-the-asteroid-hitting-frontend-development-frontend-focus-mu1e0hypu) · Frontend Focus · 4 upvotes · 0 comments --- Tags: [#webdev](https://daily.dev/tags/webdev), [#css](https://daily.dev/tags/css), [#web-security](https://daily.dev/tags/web-security), [#safari](https://daily.dev/tags/safari) [View this post on daily.dev](https://daily.dev/posts/issue-764-the-spyware-hiding-in-old-script-tags-frontend-focus-5nlcewvsb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Issue #764: The spyware hiding in old script tags — Frontend Focus","url":"https://daily.dev/posts/issue-764-the-spyware-hiding-in-old-script-tags-frontend-focus-5nlcewvsb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/issue-764-the-spyware-hiding-in-old-script-tags-frontend-focus-5nlcewvsb"},"datePublished":"2026-10-28T14:25:05.239Z","dateModified":"2026-10-28T15:03:25.285Z","description":"This newsletter issue rounds up frontend news and tools. Chris Coyier argues most dynamic social media cards waste the image by restating the title, and shows...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"Frontend Focus","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Frontend Focus","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ffocus","url":"https://daily.dev/sources/ffocus"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/issue-764-the-spyware-hiding-in-old-script-tags-frontend-focus-5nlcewvsb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"webdev,css,web-security,safari","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Frontend Focus","item":"https://daily.dev/sources/ffocus"},{"@type":"ListItem","position":3,"name":"Issue #764: The spyware hiding in old script tags — Frontend Focus"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/issue-764-the-spyware-hiding-in-old-script-tags-frontend-focus-5nlcewvsb#faq","mainEntity":[{"@type":"Question","name":"Why does setting a performance budget from my single worst test result cause problems?","acceptedAnswer":{"@type":"Answer","text":"A budget based on the single worst result lets one statistical outlier mask real regressions, since that one bad data point sets a ceiling so high that genuine slowdowns stay hidden underneath it. The fix is to use a 'representative worst' instead, such as the P90 or P95 of recent measurements, which better reflects typical bad-case performance. Developers tightening performance budgets can track techniques like this one on daily.dev."}},{"@type":"Question","name":"What is PHP2Shell and why was it a major security issue?","acceptedAnswer":{"@type":"Answer","text":"PHP2Shell refers to a pair of PHP engine bugs that allowed unauthenticated remote code execution (RCE), making it one of the more severe vulnerabilities disclosed during a particularly bad week for internet security that also included a backdoored LiteLLM release and a certificate authority using private keys derived from numbers under 256. Teams patching PHP engines after incidents like this follow security writeups on daily.dev."}},{"@type":"Question","name":"How do you safely render AI-generated HTML in a browser preview without exposing your app to attacks?","acceptedAnswer":{"@type":"Answer","text":"Harden the preview with iframe sandboxing, a strict Content Security Policy, and a carefully validated postMessage handler for communication between the preview and the parent app. Five separate attack demos showed how an unprotected preview rendering model-generated HTML can be exploited, motivating each of these three defenses. Developers building AI code-generation features can study hardening patterns like this on daily.dev."}}]} ```