Product

curl

0 mentions in 7 days · 3 in 30 days · 3 total · first seen Aug 19, 2026 · last 7d ago

Timeline3 articles

USN-8670-3: curl vulnerability

Ubuntu issued USN-8670-3 updating curl for Ubuntu 26.04 LTS to fix a flaw where wrong client certificates could be used on reused connections.

Ubuntu Security Notice USN-8670-3 extends the curl fix from USN-8670-1 to Ubuntu 26.04 LTS. The flaw, discovered by Joshua Rogers, involves incorrect handling of connection reuse when client certificate settings change, potentially causing the wrong client certificate to be presented. The issue can lead to authentication mix-ups rather than remote code execution.

Ubuntu Security NoticesSep 8, 17:20 UTC · 7d agoAdvisory

curl: a CVE dispute

curl maintainer Daniel Stenberg details a dispute over a CVE assigned to the curl project.

Daniel Stenberg, lead maintainer of curl, published a post describing a dispute over a CVE affecting the project. The piece covers the vulnerability disclosure and CVE assignment process rather than a new exploitable flaw. Given curl's ubiquity, the process discussion is relevant to defenders tracking CVE quality, but no immediate risk is described.

Lobsters · securityAug 31, 10:38 UTC · 15d agoVulnerability

Microsoft Tracks MacSync Stealer by Its Behavior, Not Its Domains

Microsoft correlates over 30 rotating domains to track MacSync Stealer, which steals passwords, SSH keys, wallets and AWS credentials.

Microsoft Defender Experts tracked MacSync Stealer, a macOS information stealer, by analyzing recurring behaviors rather than individual domains, linking over 30 domains to the campaign. The infection chain uses the ClickFix social engineering technique, tricking victims into pasting commands in Terminal, then uses curl, AppleScript, and native macOS tools to deploy the payload. The stealer targets Keychain data, browser passwords and cookies, SSH keys, AWS credentials, Kubernetes configurations, and Ledger and Trezor wallet data, staging data before exfiltration via chunked HTTP PUT requests. RST Cloud identified rapid C2 infrastructure replacement after initial public disclosure.

Security AffairsAug 19, 08:57 UTC · 27d agoMalware

Appears with

malware MacSync Stealer 1 organization Microsoft 1 organization RST Cloud 1 organization SecurityAffairs 1 product AppleScript 1 product Keychain 1 product Kubernetes 1 product macOS 1 product Ubuntu 26.04 LTS 1 vendor Apple 1 vendor AWS 1 vendor Canonical 1 vendor curl 1 vendor Ledger 1 vendor Microsoft 1 vendor Trezor 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.