Curious to know how a vulnerability fixed in curl in 2018 survived in PHP until last month (and also how we fixed it)?
I made it short and quick to read: https://daubois.dev/blog/cve-2026-91766-php-http-redirect-credential-leak/
daubois.devCVE-2026-91766: PHP had the redirect credential leak curl fixed in 2018PHP's http:// stream wrapper sent Authorization, Cookie and Proxy-Authorization to any host a redirect pointed at, the bug curl fixed in 2018.
commit d44a404