[cakealert]

> No, based on cURL's history, it really seems like they would love to have found a really novel bug.

You just confirmed that you didn't read the article.

"Eventually, I was instead offered that someone else, who has access to the model, could run a scan and analysis on curl for me using Mythos and send me a report."

[bilekas]

I'm not sure how that proves I didn't read the article ?

[croon]

Someone external to the curl team ran the test. If that third party found a severe CVE that they could use across all the global curl attack surface, and did not disclose it back to the curl team, the third party could keep using the exploit until discovered independently.