Curl ended its paid bug bounty program on January 31, 2026, after maintainer Daniel Stenberg said the share of genuine vulnerabilities in submissions dropped from above 15% to below 5% starting in 2025. Over its run, the program had confirmed 87 vulnerabilities and paid out more than $100,000. Google has separately paused supply-chain bounty submissions, though its broader vulnerability rewards programs paid $17.1 million in 2025.
bleepingcomputer.com
· 2026-10-31
Apple was notified on 17 October that eMudhra had issued compromised TLS certificates, but as of 28 October the git, curl and python3 tools bundled with macOS still trust them. The macOS 27.2 update released on 26 October failed to fix the problem and even reverted a manual workaround some users had applied, leaving them exposed again. Many other open-source projects had already shipped fixes days earlier.
emudhra.we-have-a-problem.com
· 2026-10-28
A blogger published a technical walkthrough explaining how they built a terminal-friendly 'curl' version of their website, where visitors run commands like curl nytpu.com to view ANSI-formatted pages directly in a terminal. The author credits the idea to earlier curl sites by trinkey and strongsand, though an October update notes both of those original sites are no longer functional. Unlike those examples, which reportedly generate pages dynamically using a library like ratatui, this author hand-wrote the ANSI escape codes for their entire blog rather than just a page or two.
nytpu.com
· 2026-10-14
A hobby project called GET Together implements an entire social network—posting, replying, hearting and deleting—using only HTTP GET requests instead of POST. Posts are created by hitting URLs like /post?name=alice&text=hello, with an optional session cookie enabling later deletion, and a /feed endpoint returning JSON. The system includes basic profanity and crypto-content moderation, plus a reporting mechanism for abuse review.
gettogether.dev
· 2026-09-07
After curl founder Daniel Stenberg ran OpenAI's Codex Security and Anthropic's Mythos against the widely-used curl codebase and got zero findings, AISLE's autonomous AI system produced 29 vulnerability reports. Six of those were validated by curl's security team and assigned CVE identifiers, all rated Low severity, and fixed in the newly released curl 8.22.0.
aisle.com
· 2026-09-02
The curl project explains that after becoming a CVE Numbering Authority (CNA) years ago, it now independently issues its own CVE identifiers for security flaws in its codebase, having assigned 57 so far. The maintainers describe a rigorous assessment process that grades each report as LOW, MEDIUM, HIGH, or CRITICAL, and note that some minor issues are deliberately left without a CVE if the risk of exploitation is deemed negligible.
daniel.haxx.se
· 2026-08-31
GoKawiil