I hope you can excuse me for the 4,500 words, but man, thirty years!!

30 years of Internet transfers with curl

https://daniel.haxx.se/blog/2026/11/11/30-years-of-internet-transfers-with-curl/

"curl took a bold move by deciding to publish low and medium vulnerabilities findings publicly as issues for full transparency and we encourage other open source maintainers to follow their lead."

🪅

https://www.vulncheck.com/blog/anthropic-glasswing-november-update

here are the 45 findings Anthropic reported to #curl last week: https://github.com/curl/curl/issues?q=is%3Aissue+ANT-2026

The trillion dollar monsters are all focusing on *finding* issues at high speed in large volumes. Hardly any of them care about *fixing* these problems with any sense of quality.

Assuming we spend an average of 4 hours per vuln report, we just yesterday got ourselves **four weeks** of full-time work.

#curl 30 years gource visualization with Daniel's comments

https://youtu.be/Xk_GK1ZAqkc

Just *guess* if Apple's LDAP library makes a DNS resolve when queried for its version which can make it take 5 seconds to return! 😱

https://github.com/curl/curl/issues/23651

the alarm: https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ?pli=1

The CA cert bundle on curl.se is updated accordingly after the latest alarms. If you use one of these: update.

https://curl.se/docs/caextract.html

Welcome Máté Szabó as #curl commit author 1549: https://github.com/curl/curl/pull/23444

Hello #HackerOne.

We are deeply disappointed that you have started to require ID verification from hackers who want to submit vulnerability reports to #curl, as this now makes them turn away and we miss out on their reports.

We have not been a bug bounty program since February and we do not intend to go back to bounties. What do we need to do for you to switch us to "just" a Vulnerability Disclosure Program so that you can stop requiring ID from security researchers trying to help us out?

OSI approved the #curl license

https://daniel.haxx.se/blog/2026/10/15/osi-approved-the-curl-license/

A UAF turned RCE

In the #curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time. We grade it severity HIGH. It is known as CVE-2026-92392 with the title HTTP/2 upload Use-After-Free.

https://daniel.haxx.se/blog/2026/10/14/a-uaf-turned-rce/

#curl 8.23.0

https://daniel.haxx.se/blog/2026/10/14/curl-8-23-0/

We're all "happy" for the pending curl release...

#cats #catsofMastodon

A slightly faster slimmer #curl

https://daniel.haxx.se/blog/2026/10/13/a-slightly-faster-slimmer-curl/

Half of the AI patches don't work with Keith Hoodlet and @joshbressers

This paper proves exactly what I have been saying in numerous talks: fixing vulnerabilities properly still requires a clever human involved.

https://opensourcesecurity.io/2026/2026-10-keith-ai-patches/

Buckle up. One of the pending #curl CVEs that we publish next week is graded severity HIGH. Considered the worst flaw found in curl in several years.

Yes, found with AI.

"Google freezes open-source bug bounty program amid flood of invalid AI slop submissions"

https://www.tomshardware.com/tech-industry/artificial-intelligence/google-suspends-part-of-the-oss-vrp-bug-bounty-program-due-to-an-influx-of-invalid-ai-submissions-product-vulnerability-submissions-ended-october-1