curl

Evidence (10)

• 8Hacker News·10/10/2026security
  Telegram Desktop flaw enabled file theft and account takeover

  A security researcher reported that Telegram Desktop had an IPC injection flaw that could split crafted links into multiple commands when passed between processes. Combined with the app’s internal interpret: URI handling, the bug could be used to trigger arbitrary local file reads and exfiltrate files such as login data. The issue affected versions through 7.2.8 and was fixed in 7.2.9.

• 8The New Stack·9/23/2026security
  AI is reshaping software supply chain security

  AI coding tools are accelerating both software development and attacker workflows, making the software supply chain a growing security battleground. The article highlights how AI agents can choose dependencies, chain lower-severity flaws into viable attacks, and intensify threats to open-source ecosystems and vulnerability management.

• 6The New Stack·9/10/2026security
  AI-driven security noise forces better vulnerability prioritization

  Security teams are being overwhelmed by large volumes of vulnerability and alert data, making it difficult to determine which issues deserve immediate attention. The article argues that effective triage requires business and environmental context, not just technical severity scores, to avoid wasting effort on low-impact findings.

• 4Hacker News·9/7/2026product_launch
  GET Together Launches a GET-only Social Network

  GET Together is a social network where all posting, replying, liking, and deleting actions are done through HTTP GET requests instead of POST. The project emphasizes simple public posts, optional cookies for deletion, and URL-based content with rate limits and moderation rules.

• 7Hacker News·9/2/2026security
  Aisle Finds Six curl CVEs After OpenAI and Anthropic Found None

  Aisle says it identified six security vulnerabilities in curl after OpenAI and Anthropic had previously reported none. The item highlights a contrast in results from different AI-assisted or automated vulnerability discovery efforts on the same open-source project. curl is a widely used internet transfer library, so confirmed CVEs can have broad downstream impact.

• 6Hacker News·8/31/2026security
  Curl disputes a requested CVE for a niche hostname bug

  The curl project says it has received its first CVE dispute since becoming a CNA, and it believes the reported issue does not warrant a CVE. The disputed bug concerns wildcard certificate hostname matching for URLs using a leading-dot hostname, a case curl describes as highly niche and unlikely to affect most users.

• 7Hacker News·7/24/2026security
  Hacker says YC Startup School scoring flaw was exploitable

  A Hacker News post claims Y Combinator’s Startup School application flow used Paxel to collect and rank founder submissions, and that a flaw allowed forged scores to be pushed into its ranking database. The author says the issue was disclosed privately first and then publicly, after which YC reportedly patched it and invited them to Startup School.

• 8Hacker News·7/14/2026security
  Leaked ICM schedule appears to reveal 2026 Fields Medal winners

  Front-end code from the official ICM 2026 schedule reportedly exposed four hidden Fields Medal lecture entries, and a Codex-generated curl command surfaced the names Yu Deng, John Pardon, Jacob Tsimerman, and Hong Wang. If confirmed on July 23, the leak would mark a historic edition of the award, including the first time two Chinese mathematicians receive Fields Medals in the same year.

• 3Hacker News·7/12/2026research
  LARP Satirizes Circular Revenue Recognition for Founders

  The item presents LARP as a satirical revenue infrastructure product that mirrors circular deal structures, where capital and services loop between companies and are recorded as revenue on both sides. It frames the concept as a legal but potentially misleading way to inflate reported growth without increasing net cash or real demand.

• 5Hugging Face Blog·6/26/2026product_launch
  Run a vLLM Server on HF Jobs in One Command

  Hugging Face explains how to launch a private, OpenAI-compatible vLLM endpoint on HF Jobs with a single command, using a GPU-backed container and a public jobs proxy. The post covers how to query the server with curl or the OpenAI Python client, plus how to stop the job and manage access securely.