macOS git still trusts compromised eMudhra certificates after 10 days
macOS 27.2, released October 26, left git, curl, and python3 trusting the certificates and undid manual workarounds.
76
- Mentions · 7d3
- Mentions · 30d16
- All mentions24
- First seenAug 19, 2026
- Last mentioned2d ago
Timeline
24 articles · newest firstPHP rebuilds Windows packages to fix Brotli flaw CVE-2026-111497
Rebuilt 8.2–8.5 Windows packages ship Brotli 1.2.1; cURL auto-decompression can reach the memory flaw, with no known attacks.
68
Linux Foundation survey: AI slop hits the largest projects hardest
Of 234 respondents, large-project maintainers estimate nearly a third of queued changes are low quality or AI-generated.
36
curl will handle low and medium vulnerability reports in public
From October 26, 2026, only high and critical reports stay private on HackerOne; over 90% of recent submissions were below high.
48
Chrome and Firefox drop eMudhra root after certificate compromise
Whether Edge, Internet Explorer, cURL, and other private root stores still trust eMudhra is unconfirmed.
62
Ubuntu 26.10 curl update fixes WebSocket read and reuse bugs
USN-8927-2 backports fixes for an out-of-bounds read and a connection-reuse flaw, CVE-2026-107928 and CVE-2026-107929.
36
AI Agent Workflows Could Expose Credentials Through Trusted Developer Tools
Trellix warns AI agent workflows can leak credentials from vaults into commands, logs, and model context.
52
USN-8932-1: curl vulnerabilities
Ubuntu patched curl flaws that could leak AWS SigV4 state or proxy credentials.
48
[SECURITY ADVISORIES] curl 8.23.0
curl 8.23.0 fixes high-severity HTTP/2 upload use-after-free CVE-2026-92392.
68
curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution
curl 8.23.0 fixes high-severity HTTP/2 use-after-free CVE-2026-92392 after a PoC showed client code execution.
66
USN-8927-1: curl vulnerabilities
Ubuntu’s USN-8927-1 patches curl flaws that may leak data or reuse the wrong network interface.
38
A UAF turned RCE
curl 8.23.0 fixes CVE-2026-92392, a high-severity HTTP/2 use-after-free that can lead to RCE.
68
Twenty-two pending curl vulnerabilities
Curl 8.23.0, due October 14, will fix 22 flaws including high-severity CVE-2026-92392.
72
Two arm64-specific miscompiles induce vulnerabilities in curl
Curl's maintainer says two arm64-specific compiler miscompiles introduce vulnerabilities in curl.
40
Google pauses open source bug bounty program after rise in AI submissions
Google paused its open-source bug bounty after invalid, mostly automated AI submissions overwhelmed reviewers.
48
Google halts open-source bug bounty program amid AI spam surge
Google paused OSS Vulnerability Rewards submissions after a surge of invalid AI-generated bug reports.
58
Microsoft Warns NeedyMantis Malware Enables Persistent Network Access
Microsoft warns China-linked NeedyMantis malware maintains persistent access in telecom, university, and government networks.
78
USN-8487-2: curl regression
Ubuntu patches an incomplete curl fix for CVE-2026-8927 and related connection-reuse flaws.
42
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
Microsoft details NeedyMantis, modular post-compromise malware used in targeted intrusions linked to China-based operators.
66
USN-8820-1: curl vulnerabilities
Ubuntu patched curl flaws that may bypass LDAP peer checks or allow HTTP/2 crashes and code execution.
52
HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th)
RFC 10008 standardizes the HTTP QUERY method, creating potential WAF inspection bypasses, cache poisoning, and CSRF gaps because most defenses don't recognize the new verb.
38
USN-8670-3: curl vulnerability
Ubuntu issued USN-8670-3 updating curl for Ubuntu 26.04 LTS to fix a flaw where wrong client certificates could be used on reused connections.
22
curl: a CVE dispute
curl maintainer Daniel Stenberg details a dispute over a CVE assigned to the curl project.
28
Microsoft Tracks MacSync Stealer by Its Behavior, Not Its Domains
Microsoft correlates over 30 rotating domains to track MacSync Stealer, which steals passwords, SSH keys, wallets and AWS credentials.
50
Related CVEs
by mentions- CVE-2026-923921%8.1HTTP/2 upload use-after-free in curl
- When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer
- When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding…
- CVE-2023-3854578%9.8This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake
- CVE-2026-18924<1%9.1Use-After-Free in libcurl HTTP/2 Server Push Handling with Shared Connections
- An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the…
- CVE-2026-8927<1%9.1When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication…
- CVE-2026-8286<1%8.1A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS…
- Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation
- CVE-2026-13608<1%7.4MITM peer-verification bypass in libcurl SASL negotiation for LDAP authentication
Appears with
- Microsoftvendor · 6
- libcurlproduct · 4
- curlvendor · 4
- Canonicalvendor · 3
- Ubuntuvendor · 3
- Ubuntuorganization · 3
- Googlevendor · 3
- HackerOneorganization · 3
- curlorganization · 3
- Microsoftorganization · 3
- NeedyMantismalware · 2
- Poeditproduct · 2
- macOSproduct · 2
- TightVNCproduct · 2
- Applevendor · 2
- eMudhravendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.