curl Moves Low-Severity Security Reports Public

Short answer: starting October 26, 2026, the curl project asks that low and medium severity security reports be filed publicly on GitHub. Only high and critical reports stay private on HackerOne. For most site owners nothing needs to change, but keep curl up to date.

What changed

• Reports curl rates low or medium go to its public GitHub repository.
• Reports rated high or critical stay private on HackerOne until a fix is ready.
• A reporter who is unsure of the severity can still submit privately, and curl will rate it. If it is low or medium, the reporter is asked to resubmit on GitHub.

Why curl made the change

Coverage says maintainer Daniel Stenberg described the change as a way to cope with an avalanche of reports, many produced by AI tools. Reports say over 90% of submissions are rated below high severity.

The trade-off is that earlier public disclosure gives attackers more time before a fix ships. Coverage says Stenberg called this unfortunate but unavoidable. I read news coverage of his post, not the post itself, so check curl's own blog for exact wording.

What site owners should do

Step 1: find out if you use curl

Most hosting servers include curl, and PHP often uses it for web requests. Ask your host, or run this on a server you control:

curl --version

Step 2: keep it updated

Let your operating system or host apply updates. Back up first (see no website backups).

Step 3: update the software around it

Outdated plugins and CMS code cause more real-world damage than most library bugs. See outdated CMS plugins.

Step 4: watch for security notices

Follow your host's announcements and curl's security page for fixes to low and medium issues that are now public earlier.

Common mistakes

• Thinking public means exploited. A public low-severity report is not proof of an attack.
• Ignoring updates because a report was rated low.
• Using an old curl copy bundled inside an app and never updating it.
• Skipping basics such as a strong admin password.