cURL patches 24 CVEs — AI flagged 18, one bug 25 years old
libcurl is in nearly everything you ship — patch your base images now. Plus a LangChain router that cuts coding-agent cost 64%, and a Foundry billing trap.
Copy markdown
Patch your cURL now
The newest cURL and libcurl release fixes 24 security vulnerabilities in one shot — among the largest CVE batches the project has ever shipped. libcurl rides along in almost every container image, SDK and CLI you build on, so rebuild your base images and bump the package before a scanner flags it in production.
AI found three-quarters of them
AISLE, an AI-native vulnerability platform, says its system discovered 18 of the 24 CVEs — roughly 75% — including an authentication flaw that had sat in the code for 25 years. It claims 35 CVEs and 160 other bugs found in cURL to date. Lead maintainer Daniel Stenberg calls it "a cooperation unlike any we've had with a security organization before." Automated find-and-fix is reaching the core of open source.
LangChain routes agents to cheaper models
LangChain's Open SWE added a model router that sends each coding thread to a fast, balanced or performance tier. In an early proof-of-concept it cut median cost about 64% to ~$0.94 per thread with no measurable quality drop — a near drop-in way to trim spend if you run long agentic coding sessions.
Claude on Foundry: mind the meter
Startup founders report surprise bills from calling Claude through Microsoft Foundry: usage meters through Azure Marketplace, which Microsoft for Startups sponsorship credits don't cover. Reported charges run from ~$17,500 past $22,000 with little warning. On Azure credits? Confirm which meter Foundry models bill to before you scale traffic.