[Daniel's week] October 24, 2026

[Daniel Stenberg]

# October 24, 2026

When we thought everything was already crazy, the eMudhra cert thing and a PHP 
RCE hit us both in the same week...

## security

The race continues. I got some time over on Saturday and figured I would spend 
it catching up with some of the vulnerability report work. It turned out to be 
a challenge as over the weekend and the following days we received about 10 
new reports per day. I spent most of this week trying to sort them out, 
respond, fix and dismiss them. In every combination.

Right now we are at thirteen confirmed vulnerabilities.

We stripped off the three main eMudhra certs from the CA bundle we host at 
curl.se but I suppose it remains to see if we need to do anything further. I 
upgraded PHP on my blog site.

## public

This latest onslaught made me decide that we have to do something to keep our 
noses about the surface, so after deliberations and discussions in the curl 
security team we have decided to go completely open and public with all 
vulnerability reports that are set severity LOW or MEDIUM, leaving only the 
ones at HIGH or CRITICAL to remain privately managed [1]. The idea is that we 
switch over to this new policy starting Monday October 26. Documentation 
updates are prepared, we will update the corresponding information on 
HackerOne and on Monday we will create at least thirteen separate new 
Pull-Requests for the pending security advisories. We will create new tags on 
GitHub to allow everyone to easily filter the issues and changes that are 
related to confirmed vulnerabilities as opposed to regular bugs.

## AI aided changes

Over the last month or so we see a steep rise in the number of pull requests 
submitted to us that are made at least in part with AI aid. In general we 
don’t mind that if the changes are good, but the quality is not always top 
notch and there is a great degree of people simply submitting the large AI 
generated word salad explanations instead of communicating with us as humans. 
I suspect that some of the contributors do this because they simply don’t 
understand the change and the contribution their agent produced for them.

As a direct result of this increase we have decreased the number of open pull 
requests we allow any contributor to have concurrently in the curl repository, 
to 2. It’s better we make sure each one is done correctly and with quality 
before they continue and provide more. This actually applies whether they use 
AI or not.

## we can’t ignore

Sometimes when I speak about the vulnerability report flood we are currently 
handling, people suggest that we should just ignore the “AI slop” as a means 
of managing or coping. I had to write something about why that is not an 
option [2].

## coming up

-The feature window is open, let’s see if we can merge some new stuff

## Links

[1] = https://daniel.haxx.se/blog/2026/10/20/do-minor-curl-vulnerabilities-in-the-open/
[2] = https://daniel.haxx.se/blog/2026/10/22/ignore-the-slop/

-- 

  / daniel.haxx.se