If you need to get your mood down a few notches, there are some new slop entries to torment yourself with here:

Gist

AI slop security reports submitted to curl

AI slop security reports submitted to curl. GitHub Gist: instantly share code, notes, and snippets.

new day, new slop

slip slop slap

HackerOne

curl disclosed on HackerOne: Path Traversal Bypass in file:// URLs...

## Summary: The `dedotdotify()` function in `lib/urlapi.c` is responsible for removing path traversal sequences (`../` and `./`) from URLs accordi...

Please stop using AI when responding. It is enough if you answer with no more than 20 lines. The rest is just word sallad. *shakes fist in the air*

Microsoft will pay bug bounties even for 3rd party components:

Microsoft now buys bugs, with or without a bounty program

: Critical vulnerabilities found in third-party applications eligible for award under 'in scope by default' move

My week:

[Daniel's week] December 13, 2025

Security, AI, FOSDEM, 40K stars, rc1, URLs, AIxCC, mallocs

I am probably getting old, but the idea to cram in lots of events in Brussels the entire week before FOSDEM is not getting my thumbs up. Or well, you can have them but I won't be there. A regular FOSDEM already wears me out on its own. Being at the European Open Source Awards on the Thursday before FOSDEM is stretching it but I will do it. Adding *more* events to my agenda that week would probably kill me. Did I mention I'm old? Leave me alone.

"Base Score: 9.8 (Critical)"

HackerOne

curl disclosed on HackerOne: Buffer Overflow in cURL Internal...

A critical buffer overflow vulnerability exists in the `curl_msprintf()` function in cURL's internal printf implementation. The function writes for...

Made with AI. Of course.

We currently have three pending CVEs to be announced in the next #curl release (severity low + medium x 2) All three found with AI powered tooling. So it is happening.