Published file metadata, source observations, indicators, and research history in one bounded catalog.
It takes a village to make curl. A rather big village. I have not been a solo maintainer of curl for a long time and I don’t even do half of the commits anymore Since today, the curl git repository holds the accumulated efforts from 1,500 separate and named individuals. Only 4.5 years since we … Continue reading 1,500 curl authors →
First reported Jul 25, 2026 14:29 UTCOpen evidence recordIndicator published by the cited source.
First reported Sep 02, 2026 05:52 UTCOpen evidence recordIndicator published by the cited source.
First reported Aug 14, 2026 11:20 UTCOpen evidence recordThis afternoon I had a meeting with IT people at a huge US power infrastructure company. They had found a libcurl.dll file in their C:\Windows\System32 directory and asked us for help to upgrade it. Their vulnerability scanner identified it as vulnerable to several publicly known vulnerabilities. Can we bump it to the latest version please? … Continue reading There’s a libcurl.dll in my system32 →
First reported Aug 17, 2026 21:27 UTCOpen evidence recordtldr: the live version is here: https://curl.se/perf/ How fast is “fast” and is it good enough? Does it run as fast now as it did before or was there a regression? What exactly needs to be fast? How fast is it? These are questions that many projects and products face, and in curl we are … Continue reading curl performance →
First reported Aug 14, 2026 11:20 UTCOpen evidence recordWelcome to this new release. Get it as always from https://curl.se. If you rather want a security-patched older release branch, stay tuned for the follow-up Rock-solid curl announcement within a few days. Release presentation Numbers the 276th release6 changes70 days (total: 10,887)302 bugfixes (total: 14,489)525 commits (total: 39,608)0 new public libcurl function (total: 100)4 new … Continue rea
First reported Sep 02, 2026 05:52 UTCOpen evidence recordIf you missed it. I already described day one. Caffeinated and ready, we all gathered in the same spacious room as yesterday, but seated in new places as “suggested” by our captain. Some of us even remembered to move over the name tags we wrote yesterday to our new seats. No time was wasted on … Continue reading Workshop Basel day two →
First reported Jul 15, 2026 20:07 UTCOpen evidence recordSee also: day one, day two. There is only one thing that is better than two days of HTTP workshop, and that is of course three days of HTTP workshop. The final day of this edition of the series started out with us again shuffling around where we parked ourselves around the big table. Except … Continue reading Workshop Basel day three →
First reported Jul 16, 2026 20:01 UTCOpen evidence recordExactly on this day, September 25 2001, Apple shipped version 10.1 of their OS X operating system. The one they later would rename to macOS. Exactly twenty-five years ago today. Within all their fancy release presentations and videos there are barely no mentions of curl. In their technical notes page, there is just this short … Continue reading 25 years on Apple computers →
First reported Sep 25, 2026 07:57 UTCOpen evidence recordAt this exact moment curl’s summer of bliss 2026 ends. We (the maintainers of curl) took the entire month of July off from vulnerability reporting and in this post I will try to explain how this went. (If you feel like skipping the wordy blab below, the single word answer is: fine) This was possibly … Continue reading What the bliss taught us →
First reported Aug 03, 2026 06:42 UTCOpen evidence recordThe recently published RFC 9421 describes how to do HTTP Message Signatures, and starting just now, curl experimentally supports them. Message Signatures The specification describes this as a mechanism for creating, encoding, and verifying digital signatures or message authentication codes over components of an HTTP message. It is a way to verify that selected parts … Continue reading HTTP Message
First reported Jul 27, 2026 06:55 UTCOpen evidence recordOn October 14 2026 we will ship curl 8.23.0. The next iteration in the never-ending series of version bumps from the curl project. We always think of the next release as the best version we ever did – and this time is no exception. Decades of collected experiences and meticulous polishing has lead us to … Continue reading Twenty-two pending curl vulnerabilities →
First reported Oct 07, 2026 07:12 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.