Curl 24-Year-Old Bug, Hoppscotch RCE, Cloudflare PACT: Weekly Threats
This week's threat landscape blended privacy innovation with two decades of dormant risk. Cloudflare announced a partnership with Google Chrome, Microsoft Edge, and Mozilla Firefox to launch Private Access Control Tokens (PACT), a privacy-preserving protocol that lets websites verify a human is behind a browsing session without relying on invasive tracking or clunky CAPTCHAs. Tokens are issued anonymously, designed so participating sites cannot correlate user identities or reconstruct browsing history. For defenders and privacy-conscious users, this is a meaningful shift away from fingerprinting-heavy bot defense. Readers can audit their own exposure to browser-based tracking using our browser fingerprint test and broader privacy checkup.
On the vulnerability front, AISLE disclosed six flaws in curl, the ubiquitous command-line tool and library. The standout is CVE-2026-8932, the oldest curl vulnerability ever reported, present in releases since curl 7.7 shipped on March 22, 2001. The bug allows libcurl to reuse a previously created connection even after mTLS configuration options have changed in ways that should have prohibited reuse, opening the door to credential and host-identity mismatches. The remaining CVEs span memory-lifetime and logic flaws in how libcurl validates connection, credential, and host state. All six are patched in curl 8.21.0, and administrators should prioritize upgrades on any system handling TLS-terminated or mTLS-protected traffic, verifiable with our SSL/TLS checker.
In self-hosted deployments of Hoppscotch, an open-source API development platform, CVE-2026-50160 carries a maximum CVSS score of 10.0 and enables full server takeover without authentication. Offgrid Security's autonomous AI agent Kiro discovered that the POST /v1/onboarding/config endpoint permits mass assignment of arbitrary InfraConfig keys, including JWT_SECRET and SESSION_SECRET, because NestJS's ValidationPipe fails to strip undeclared properties before they reach the service layer via Object.entries(dto). With control over those secrets, an attacker can forge tokens and fully compromise the instance. Self-hosted operators must patch immediately and rotate every signing secret, as exposed JWT and session keys should be considered permanently burned; our password checker can help validate the strength of newly generated replacements. The incident is also a reminder that secrets misconfiguration at the application layer can be just as dangerous as a remote code execution bug, and that AI-driven fuzzing agents are now a credible source of high-severity finds.