Hmm, this new URL attack is nasty (though obvious when you think about unicode usage) - make sure you have define("network.enableIDN", false); in your user.js file if you are using Firefox or Mozilla. (No fix for Opera or Safari, and IE is so old it doesn't get hit) Update: Seems not to work for some people. Use about:config, scroll down to network.enableIDN, change the value, clear your cache and you should be safe.
The six fore firefox doent work.... at least not for me
Bret
I can spell reely I Kan
Bret
Didn't work for me either ... but I navigated to <em>about:config</em> and set the option that way and now it works well.
Chris Wraith
The about:config is probably the right way to do it, but the user.js definitely worked for me on Windows. You may have to clear your cache after doing the about: config.
Lindsay
I hear that Firefox may revert the setting after a restart - even if the actual settin still says false. Better hope for a quick bugfix.
Qinopio