The latest #curl update will now properly report long transfer times when sending data to Mars.

The latest #curl update will now properly report long transfer times when sending data to Mars.

Augment (which gave the #curl project free access) is changing pricing (again) in what seems to be a 10x increase.

Augment pricing changes from ‚messages‘ (number of answer which you control) to ‚credit‘ (which is effort controlled by Augment).

And this is probably still not enough to cover their real costs, not even speaking of profit.

Wherever you stand on the LLM debate, don‘t become dependant on those companies. Their business model sucks.

https://www.theregister.com/2025/10/15/augment_pricing_model/

Two years ago we dropped the years from all copyright mentions in the #curl project: https://daniel.haxx.se/blog/2023/01/08/copyright-without-years/

In this latest #curl release, we are now three persons having our names on >10,000 lines of product code when doing git blame. @icing, @vsz and myself.

10 separate people have their names on 1000+ lines.

#curl 8.18.0 with Daniel Stenberg

https://youtu.be/QVxFW6eqG_c

@bagder #curl binaries for Windows are out at: https://curl.se/windows/ matching build log: https://ci.appveyor.com/project/curlorg/curl-for-win/builds/53332479

As always, I will live-stream a #curl release presentation at 10:00 CET (09:00 UTC) tomorrow on my twitch channel: https://www.twitch.tv/curlhacker

#curl 8.18.0 has been released. This release fixes 1 medium and 5 low level vulnerabilities:
- CVE-2025-14017: broken TLS options for threaded LDAPS https://curl.se/docs/CVE-2025-14017.html
- CVE-2025-14524: bearer token leak on cross-protocol redirect https://curl.se/docs/CVE-2025-14524.html
- CVE-2025-14819: OpenSSL partial chain store policy bypass https://curl.se/docs/CVE-2025-14819.html
- CVE-2025-15079: libssh global knownhost override https://curl.se/docs/CVE-2025-15079.html
- CVE-2025-15224: libssh key passphrase bypass without agent set https://curl.se/docs/CVE-2025-15224.html

I discovered the last 2 vulnerabilities.

Download curl 8.18.0 from https://curl.se/download.html

#vulnerabilityresearch #vulnerability #cybersecurity #infosec

#curl 8.18.0 has been released. This release fixes 1 medium and 5 low level vulnerabilities:
- CVE-2025-14017: broken TLS options for threaded LDAPS https://curl.se/docs/CVE-2025-14017.html
- CVE-2025-14524: bearer token leak on cross-protocol redirect https://curl.se/docs/CVE-2025-14524.html
- CVE-2025-14819: OpenSSL partial chain store policy bypass https://curl.se/docs/CVE-2025-14819.html
- CVE-2025-15079: libssh global knownhost override https://curl.se/docs/CVE-2025-15079.html
- CVE-2025-15224: libssh key passphrase bypass without agent set https://curl.se/docs/CVE-2025-15224.html

I discovered the last 2 vulnerabilities.

Download curl 8.18.0 from https://curl.se/download.html

#vulnerabilityresearch #vulnerability #cybersecurity #infosec

#curl 8.18.0 has been released

https://daniel.haxx.se/blog/2026/01/07/curl-8-18-0/

6,000 #curl stickers: https://daniel.haxx.se/blog/2026/01/06/6000-curl-stickers/

As always, I will live-stream a #curl release presentation at 10:00 CET (09:00 UTC) tomorrow on my twitch channel: https://www.twitch.tv/curlhacker

The list of top #curl sponsors remains the exact same release after release...

I spend a ridiculous amount of my time on #curl security these days. Because I think that's my responsibility.

something something open source sustainability

buckle up and prepare for an unload of *six* CVEs against #curl getting published tomorrow, severity low and medium

The year's 6th day just started and we just clocked in our 8th hackerone report on #curl for the year.

This doesn't work.

less than 24 hours to the next #curl release...

6,000 #curl stickers. 3 Kg.

Get yours at #FOSDEM