[Daniel's week] October 24, 2026
# October 24, 2026
When we thought everything was already crazy, the eMudhra cert thing and a PHP RCE hit us both in the same week...
## security
The race continues. I got some time over on Saturday and figured I would spend it catching up with some of the vulnerability report work. It turned out to be a challenge as over the weekend and the following days we received about 10 new reports per day. I spent most of this week trying to sort them out, respond, fix and dismiss them. In every combination.
Right now we are at thirteen confirmed vulnerabilities.
We stripped off the three main eMudhra certs from the CA bundle we host at curl.se but I suppose it remains to see if we need to do anything further. I upgraded PHP on my blog site.
## public
This latest onslaught made me decide that we have to do something to keep our noses about the surface, so after deliberations and discussions in the curl security team we have decided to go completely open and public with all vulnerability reports that are set severity LOW or MEDIUM, leaving only the ones at HIGH or CRITICAL to remain privately managed [1]. The idea is that we switch over to this new policy starting Monday October 26. Documentation updates are prepared, we will update the corresponding information on HackerOne and on Monday we will create at least thirteen separate new Pull-Requests for the pending security advisories. We will create new tags on GitHub to allow everyone to easily filter the issues and changes that are related to confirmed vulnerabilities as opposed to regular bugs.
## AI aided changes
Over the last month or so we see a steep rise in the number of pull requests submitted to us that are made at least in part with AI aid. In general we don’t mind that if the changes are good, but the quality is not always top notch and there is a great degree of people simply submitting the large AI generated word salad explanations instead of communicating with us as humans. I suspect that some of the contributors do this because they simply don’t understand the change and the contribution their agent produced for them.
As a direct result of this increase we have decreased the number of open pull requests we allow any contributor to have concurrently in the curl repository, to 2. It’s better we make sure each one is done correctly and with quality before they continue and provide more. This actually applies whether they use AI or not.
## we can’t ignore
Sometimes when I speak about the vulnerability report flood we are currently handling, people suggest that we should just ignore the “AI slop” as a means of managing or coping. I had to write something about why that is not an option [2].
## coming up
-The feature window is open, let’s see if we can merge some new stuff
## Links
[1] = https://daniel.haxx.se/blog/2026/10/20/do-minor-curl-vulnerabilities-in-the-open/ [2] = https://daniel.haxx.se/blog/2026/10/22/ignore-the-slop/
--
/ daniel.haxx.se
--
Daniel's weekly mails https://lists.haxx.se/listinfo/daniel