Historic Curl flaw shows AI risk to legacy supply chain | TechTarget
Enterprise security teams have long assumed that the more widely deployed and heavily scrutinized an open-source library is, the less likely it is to harbor fundamental flaws. The conclusion of a yearlong AI code audit of Curl shatters that assumption.
On Oct. 14, Curl maintainers released version 8.23.0, fixing 24 total security vulnerabilities -- 18 of which stem from an extended AI-powered audit by security firm Aisle. Across the entire engagement, Aisle's models unearthed 35 CVEs and 160 bugs.
Chief among the security firm's discoveries was CVE-2026-8932, a 25-year-old authentication bypass lurking in Curl's connection pool since February 2001 that had survived decades of manual code reviews, static analysis, and bug bounties.
For enterprise security teams, the release is an immediate reminder to check whether affected versions of Curl are running across their environments. However, it's also a stark reminder that as AI drastically lowers the cost of...
Copyright of this story solely belongs to www.techtarget.com. To see the full text click HERE
