By curl 8.23.0 shipped today, as scheduled. Eighteen of the twenty-four security fixes it contains were found by a startup called AISLE and its AI-native platform — that is 75% of every vulnerability patched in this release. For context: before AISLE began auditing curl, Anthropic Mythos, OpenAI Codex Security, and ZeroPath had each reviewed the same codebase and found zero additional issues.
One Audit, 35 CVEs, 12 Months
AISLE emerged from stealth in October 2025, founded by former Avast CEO Ondrej Vlcek, Rapid7 CISO Jaya Baloo, and Anthropic researcher Stanislav Fort. Its core product is a Cyber Reasoning System (CRS) — a term borrowed from DARPA’s 2016 Cyber Grand Challenge — that ingests a project’s full code stack, builds a continuously updated “enterprise twin,” and autonomously finds vulnerabilities, generates patches, and verifies fixes before submitting pull requests. Today AISLE announced it has passed 500 CVEs across more than 100 codebases in its first year.
The curl engagement alone spans 35 CVEs and 160 additional bugs over 12 months. Six vulnerabilities landed in curl 8.22.0 earlier this year. Eighteen more ship in today’s 8.23.0 release. Daniel Stenberg, curl’s author, acknowledged in his post on the audit that AISLE has now found more curl CVEs than any other group or individual in the project’s history. That is a project with 25 years of active security review behind it.
Why Frontier AI Failed Where AISLE Succeeded
This result deserves a direct statement: general-purpose frontier AI models are not specialized security audit tools, and the gap is not small. Mythos, Codex Security, and ZeroPath each have real capabilities — ZeroPath beats Mythos on general pen-testing benchmarks, and Mythos solved 21 of 41 V8 ACE challenges in ExploitBench. None of that translated to finding new bugs in curl.
AISLE’s advantage is architecture. Its CRS is built specifically to model interaction effects between connection reuse logic, credential handling, redirect chains, protocol state machines, and rarely-exercised configuration paths. Those interaction zones are exactly where mature, well-audited software hides its remaining bugs. A general reasoning model given a source file does not automatically reconstruct the full protocol state that produces a vulnerability. AISLE builds that model continuously, from the full stack.
The CVE You Need to Patch: CVE-2026-92392
The one HIGH-severity fix in 8.23.0 was found by a different AI tool: Anthropic’s OSS Scanner, credited to researcher Luna Tong. CVE-2026-92392 is an HTTP/2 upload use-after-free affecting curl 8.12.0 through 8.22.0. The attack requires a malicious HTTP/2 server: it pauses your upload by zeroing the window size, returns a partial response, then resets the stream. curl correctly tears down the transfer but leaves a dangling pointer to the freed easy handle. Subsequent cleanup of the multi handle then processes attacker-controlled data into that freed memory, corrupting a function pointer. The reporter confirmed it can be turned into remote code execution, though doing so requires precise alignment of architecture, heap layout, TLS behavior, and timing. Crashes are the more likely real-world outcome.
If your curl version is anywhere between 8.12.0 and 8.22.0, treat this as urgent. Backport patches exist for 8.20.2, 8.16.2, and 8.14.3 if a full upgrade is not immediately possible. Daniel Stenberg’s technical writeup on the exploit chain is worth reading if you ship software that performs HTTP/2 uploads.
# Check your version
curl --version
# Find embedded libcurl in your system
ldconfig -p | grep curl
# Scan scripts and configs for SMB URLs
grep -r "smb://" /etc/cron* ~/.local/bin/ 2>/dev/nullSMB Support Is Gone — Check Your Pipelines
curl 8.23.0 permanently removes SMB and SMBS protocol support. This has been telegraphed for months — NTLM was disabled in 8.20.0, removed entirely in 8.21.0, and SMB followed in 8.23.0 — but the cutover is now final. Any script, container, CI job, or application using smb:// or smbs:// URLs will break on upgrade. curl’s SMB implementation only ever supported SMBv1 and was tightly coupled to NTLM authentication, which Microsoft has deprecated and which contributed to at least seven historical curl CVEs. The removal reduces the attack surface without removing anything useful.
What to Do Right Now
Upgrade to curl 8.23.0. That is the primary action. Beyond that: audit every Docker image, CI pipeline, and deployment script for embedded libcurl — it shows up in places you would not expect, including language runtimes, database clients, and cloud SDKs. Check for any smb:// usage before the upgrade lands in your infrastructure. And take a moment to notice what today’s release actually signals: the organizations maintaining critical open-source infrastructure are increasingly relying on specialized AI to keep it secure. That is not a trend — it is already the operating condition. The question for your project is whether you have an equivalent audit process in place.
