#curl

yesterday the #curl project got an email from a person announcing their grand new project to security audit a range of Open Source projects. Got a fancy project name and all. Asked for permission. Two hours later the same person emailed us again, announcing that he shuts down this effort blaming "widespread failure affecting Codex". We never got to respond. Moving on.

state of #curl dev in three graphs

#curl's law: Everything eventually runs curl A trend in society over the last decade and I don't see it changing anytime soon.

A UAF turned RCE In the #curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time. We grade it severity HIGH. It is known as CVE-2026-92392 with the title HTTP/2 upload Use-After-Free.

I just want to express my gratitude and thanks to Daniel Gustafsson for all the time and efforts spent on #curl over the years. Daniel has decided to step down from the curl security team and has asked to get his "commit bit" revoked. Thanks Daniel, you are always welcome back when you feel like it!

I am awarded a gold medal by the Royal Swedish Academy of Sciences for my work on #curl

Buckle up. One of the pending #curl CVEs that we publish next week is graded severity HIGH. Considered the worst flaw found in curl in several years. Yes, found with AI.

I had the joy to chat with @bagder@mastodon.social and @icing@chaos.social about #curl security things We discussed the Summer of Bliss, the influx of LLM vulnerability reports. The stress of dealing with these things, and how much effort all this security work has become They are both amazing people who have a ton of knowledge and experience to share https://opensourcesecurity.io/2026/2026-09-curl-bliss-stefan-daniel/ #OpenSourceSecurity #security #vulnerability

@nlnetlabs@social.nlnetlabs.nl meanwhile, I sit here with at least 20 new curl CVEs in the queue to publish in sync with the next #curl release...

As of two minutes ago, #curl does no longer support SMB. 🎉

Updated chart showing the share of #curl vulnerabilities caused by "C mistakes" as a share of all the vulns we know existed in code over time.

Average number of hours between each #curl vulnerability report, since March 1 2026 (excluding July as we closed during that month): 16.2 During 2025 the average interval was 48 hours ...

Updated #curl September numbers converted into slides for coming talks

Meteorology Current weather in Leonsberg SR SA with magnifico power of wttr.in & le passion grace beauty & colours of lolcat(6) 🏳️‍🌈 wttr curl(1) & {ba{c{k{z{fi}}}}}sh Background photograph is a nice Clouds in FL shades scene meticulously and passionately composed with CIRC_POL 81A FL and UV filters stacked using a Nikon Analog SLR lens combo in my Negative film photography phaselog metalloid@krishna:~/gate/docs $ curl -v wttr.in/leonsberg_suriname|lolcat % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Host wttr.in:80 was resolved. IPv6: (none)IPv4: 5.9.243.187 Trying 5.9.243.187:80...Connected to wttr.in (5.9.243.187) port 80using HTTP/1.x> GET /leonsberg_suriname HTTP/1.1> Host: wttr.in> User-Agent: curl/8.14.1> Accept: /> Request completely sent off< HTTP/1.1 200 OK< Access-Control-Allow-Origin: *< Cache-Control: public, max-age=600< Content-Type: text/plain; charset=utf-8< Date: Fri, 04 Sep 2026 19:27:35 GMT< Transfer-Encoding: chunked< { [8791 bytes data]100 8778 0 8778 0 0 8929 0 --:--:-- --:--:-- --:--:-- 8929 Connection #0 to host wttr.in left intact Weather report: leonsberg_suriname \ / Sunny .-. +34(37) °C ― ( ) ― ↓ 9 km/h `-’ 10 km / \ 0.0 mm Location: Leonsberg, Blauwgrond, Suriname [5.8692506,-55.1026346] Note: Remember to repeat the request with an interval of 8 then 24 secs when the server sends and empty response to curl, watch the LOG! API https://wttr.in https://en.wikipedia.org/wiki/Bash_(Unix_shell) https://gnu.org https://directory.fsf.org/wiki/Bashhttps://curl.se/ https://github.com/busyloop/lolcat Z #Weather #wttr #lolcat #curl #bash #csk #ksh #zsh #sh #fish #meteorology #environment #Physics #Chemistry #Mathematics #Lineair #algebra #technology #OpenSource #programming #POSIX

#curl surpassed 16,000 closed PRs

24 hours to #curl release: 10 CVEs, 6 changes, ~300 bugfixes, 85 contributors, 43 authors, 4 new command line options...

So tell me. Do you think #curl should support plain SSH:// URLs to execute commands remotely?

#patreon aggregation thread. Since it basically increased daily viewership by something like 1% by posting one video once to go fishing on Patreon, I'm making adding #lispyGopherClimate #technology #podcast episodes-classic a regular thing over there. The intent is to fish for #lisp ( #curl ?) users over there and bring them into the weekly shows (and #lambdaMOO #VR !) rather than send you over there. Boosts welcome for this thread. @bagder@mastodon.social and @kentpitman@climatejustice.social episode.

This episode was and is actually really interesting #interview on #AI if I do say so. #curl@bagder@mastodon.social@kentpitman@climatejustice.social

Heads up! In #curl 8.23.0 (end of October 2026) SMB(S) support will be gone.