A security update in the Laravel stack spotlights a narrow but dangerous boundary: when web apps hand mail delivery off to shared components, a parsing flaw can turn into a trust problem.