explore | Grilled Cheese

@bagder.mastodon.social.ap.brid.gy Sep 25, 2026, 7:57 AM

Today we celebrate #curl 25 years on Apple computers:

https://daniel.haxx.se/blog/2026/09/25/25-years-on-apple-computers/

@bagder.mastodon.social.ap.brid.gy Sep 25, 2026, 6:21 AM

#curl 8.23.0-rc2 is here. The second release candidate: https://curl.se/rc/

Do not use release candidates in production. They are work in progress. Use them for testing and verification only. Use actual releases in production.

@bagder.mastodon.social.ap.brid.gy Sep 25, 2026, 6:10 AM

Rock-solid #curl with Daniel Stenberg

https://youtu.be/w7-St22V1sA

@bagder.mastodon.social.ap.brid.gy Sep 23, 2026, 6:30 AM

When we announce over 20 new #curl CVEs on October 14, you will learn that every single one of them were found by clever humans using harnesses powered by AI models. Every. Single. One.

The holy trinity of modern vulnerability research.

@bagder.mastodon.social.ap.brid.gy Sep 23, 2026, 6:19 AM

Another security person said this about #curl in an email to me the other day:

"Maybe we're really headed towards curl being the most informally verified library in existence (although it seems to me it likely already is)."

@bagder.mastodon.social.ap.brid.gy Sep 23, 2026, 5:51 AM

Dan Lorenc at Chainguard posted this statement about #curl on LinkedIn...

We put curl 8.22.0 through an eight-and-a-half-hour automated tree search, about 4,100 tool calls and roughly 190 million tokens of model work (the vast majority cache reads), aimed only at High and Critical outcomes: memory safety on an ASan build across the HTTP/1, HTTP/2, HTTP/3, WebSocket, FTP, IMAP, POP3, SMTP, SMB, LDAP, cookie, and NTLM/Digest/Negotiate parsers under tens of thousands of hostile server responses, plus integrity hunts for TLS verification bypass under an on-path attacker,
STARTTLS and 1implicit-TLS downgrade, cross-handle response confusion, CONNECT tunnel handling, credential leakage through redirects, file writes outside the output directory, and Alt-Svc and HSTS guarantees. Thirty-one lines of attack closed clean with no sanitizer report and no verification
bypass; all that surfaced were three Medium-class edges, one of which the curl team had already fixed on master days before we looked. That outcome is a credit to the project: years of continuous fuzzing, the maintainers' own audits, and a codebase where every server-controlled length is bounded
before use left a persistent automated adversary with nowhere to go. Congratulations to the curl team, and thanks for making our negative result so thoroughly earned.

One note on the token figure: the run log records usage for only about 400 of the turns (18.6 million tokens, 46,500 per turn on average), so the 190 million is that average scaled to the 4,103 tool-call turns.

@bagder.mastodon.social.ap.brid.gy Sep 22, 2026, 7:34 AM

we received a list with ~160 #curl bugs (explicitly *not* vulns) from Aisle that now sits in a private repo for us to work through over time. Things they fell over while scanning for issues. Nothing major, but smaller things we might want to polish.

@bagder.mastodon.social.ap.brid.gy Sep 21, 2026, 9:29 PM

I'll do a free webinar on Thursday about our long term support #curl branches we call rock-solid curl:

https://us02web.zoom.us/webinar/register/8017896840644/WN_6hFAhtvATy6NOtnhvl8T0A#/registration

@wolfssl.com Sep 21, 2026, 4:54 PM

Save the date: September 24, 9 AM PT.
Register today: us02web.zoom.us/webi...
#curl #libcurl #LTS #opensource daniel:// stenberg://

@bagder.mastodon.social.ap.brid.gy Sep 21, 2026, 3:13 PM

Welcome Filippo Tedeschi as #curl commit author 1536: https://github.com/curl/curl/pull/23020

@bagder.mastodon.social.ap.brid.gy Sep 21, 2026, 1:37 PM

At 22 confirmed #curl vulnerabilities queued up to announce on October 14...

@threadlinqs.bsky.social Sep 21, 2026, 11:35 AM

One unauthenticated request into a Python eval() and your Lambda's IAM keys are gone. https://intel.threadlinqs.com/threat/TL-2026-2601 #ThreatIntel #Python #AWS #curl

Unauthenticated AWS API Gateway + Over-Permissioned Lambda: Credential Extraction Attack Chain

@bagder.mastodon.social.ap.brid.gy Sep 21, 2026, 6:17 AM

Welcome to minnnjuuu as #curl commit author 1535: https://github.com/curl/curl/pull/23008

@madppiper.bsky.social Sep 21, 2026, 5:02 AM

A health check of mine kept calling a server down while the server answered 200 the whole time. curl exits 18 when the body is cut off mid-transfer, and I read any non-zero exit as no response. Two different questions, one variable.

#Curl

@bagder.mastodon.social.ap.brid.gy Sep 20, 2026, 9:37 PM

Welcome Jorge Rocamora as #curl commit author 1534: https://github.com/curl/curl/pull/23005

@bagder.mastodon.social.ap.brid.gy Sep 18, 2026, 12:01 PM

#curl 8.23.0 release candidate one is up: https://curl.se/rc/

Please take it for a spin and double-check that it works just as smooth as you would expect.

Do not use release candidates in production. They are work in progress. Use them for testing and verification only. Use actual releases in […]

@bagder.mastodon.social.ap.brid.gy Sep 18, 2026, 8:32 AM

I had a look at the “project number of CVEs” that we estimated back at #curl up in late May. We then said it could end up at 55 by the end of the year. As we now already have published 45 and there are (at least) 20 coming, we have certainly exceeded those projections. The question is now rather […]

@bagder.mastodon.social.ap.brid.gy Sep 18, 2026, 7:33 AM

Last year I blogged about the vulnerability reporting process in #curl. It remains the same, just with about 3-4x the volume...

https://daniel.haxx.se/blog/2025/09/18/from-suspicion-to-published-curl-cve/

@bagder.mastodon.social.ap.brid.gy Sep 17, 2026, 8:05 PM

Welcome Paolo Ganci as #curl commit author 1532: https://github.com/curl/curl/pull/22987

@bagder.mastodon.social.ap.brid.gy Sep 17, 2026, 12:59 PM

Welcome Ilias Aberkane as #curl commit author 1531: https://github.com/curl/curl/pull/22980