News for hackers. Stuff that matters.

A comment on After 7 Months, Glasswing Overwelms Maintainers with Underwhelming Findings. Parent comment

Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by Eridrus on Tuesday November 10, 2026 @06:46PM (#50447931)
A client-side bug in a command line utility that is mostly used as a debugging tool or glue in shell scripts where the URL is not attacker controlled? Probably close to nothing. Maybe if you can find some other software which lets you run curl with an attacker controlled URL, you could package it up as an exploit for that piece of software, but it's not a common config.
[ Parent | on HN ]
Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by palata on Tuesday November 10, 2026 @06:57PM (#50448026)
Curl is also a library. Just saying :-).
[ Parent | on HN ]
Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by Eridrus on Tuesday November 10, 2026 @07:33PM (#50448306)
Fair, libcurl is pretty widely used in PHP, but it has to be in the core.

Still way less impactful than the PHP2Shell issue.

[ Parent | on HN ]
Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by jonhohle on Tuesday November 10, 2026 @09:04PM (#50448971)
libcurl is used in a lot more than PHP. libcurl is installed on more than 20 billion devices.
[ Parent | on HN ]
Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by oasisaimlessly on Wednesday November 11, 2026 @10:50AM (#50454831)
... 50% of which probably never get connected to the internet, and 50% of the remainder probably only connect to one hardcoded domain name.
[ Parent | on HN ]