curl

curl项目宣布自2026年10月26日起改变漏洞披露流程，将LOW和MEDIUM级别的漏洞报告公开提交至GitHub，仅HIGH和CRITICAL级别保留在HackerOne私密处理，以应对持续不断的漏洞报告洪流并维持项目生存。

Stanislav Fort's AI security research lab AISLE claims to have discovered 500+ zero-day vulnerabilities with CVEs across 100+ codebases in a year, roughly 1% of 2026's global open-source CVEs, while matching or outperforming frontier AI labs on hardened codebases like curl.

curl 8.23.0 修复了一个严重的 Use-After-Free 漏洞 (CVE-2026-92392)，该漏洞源于 HTTP/2 上传过程中残留的 easy handle 悬垂指针，可在特定条件下被利用为远程代码执行。

nytpu explains how they added ANSI-styled curl-rendered versions of their entire blog to nytpu.com, hand-writing escape codes for static pages and plugging their custom markup language Gemroff into their static site generator for automatic generation of all posts.

curl 8.23.0 引入多项性能优化，包括 base64 编解码、URL 编解码、日期和数字解析提速，以及约 40% 的结构体内存缩减和更少的内存分配。

curl 8.23.0 will be released early on October 14, 2026 to address one HIGH-severity vulnerability (CVE-2026-92392) along with 21 other, less serious security flaws.

Two arm64-specific compiler miscompiles were found to induce security vulnerabilities in curl. The issue highlights how architecture-specific code generation bugs can propagate into widely used open-source software, and is being discussed on Lobsters.

AISLE's autonomous AI system discovered six curl CVEs after OpenAI and Anthropic's systems found none, demonstrating advancements in AI-driven cybersecurity. The low-severity vulnerabilities were fixed in curl 8.22.0.

The curl project describes its CVE assignment process and reports on a dispute with a reporter over a vulnerability deemed too minor for a CVE, leading to escalation to MITRE.

The article announces a new feature in curl 8.10.0 that automatically generates a local filename when using the -O option for URLs without explicit filenames, improving command-line usability.

Daniel Stenberg announces a new performance test suite for curl, with automated builds and results published publicly at curl.se/perf.

A developer shares an undocumented GitHub endpoint that allows programmatically uploading images and attachments to Issues, Pull Requests, and Comments, enabling automation for screenshots and visual diffs.

AISLE discovered 6 new CVEs in curl, including the oldest vulnerability ever reported (over 25 years old), using its model-agnostic AI system. All findings were fixed in curl 8.21.0.

The curl project will temporarily stop accepting vulnerability reports during July 2026 for maintainer rest, pushing the next release to September 2, 2026.

The curl project's lead argues for a balanced approach to AI in software development, emphasizing human code review and responsibility while acknowledging AI tools can assist in error detection.

Daniel Stenberg describes the unprecedented pressure on the curl project due to a deluge of credible AI-assisted security reports, which have quadrupled the rate of incoming reports and increased the workload, while noting that most vulnerabilities found are low or medium severity.

Daniel Stenberg reflects on the pressure of maintaining the curl open-source project, discussing the relentless work on security, scrutiny, and the impact of AI-generated bug reports.

Tip for installing the Codex CLI via curl, useful for remote VMs and avoiding npm.

Agent.email enables AI agents to sign up for email inboxes via curl, with a human OTP claim process, allowing agents to have their own email accounts without human credentials.

Daniel Stenberg reports that Anthropic's Mythos AI model identified a vulnerability in curl, highlighting the growing role of advanced AI in security auditing while noting initial access hurdles via the Linux Foundation.