In the hours following the release of CVE-2026-92392 for the project curl, site reliability workers and systems administrators scrambled to desperately rebuild and patch all their systems to fix a use-after-free in HTTP/2 upload retries where cleanup turns leftover upload data into a new request and leaves a pointer to a freed Curl_easy handle (apparently freeing it was only a suggestion), allowing a malicious server to achieve remote code execution under specific conditions. This is due to the affected components being written in C, the only programming language where these vulnerabilities regularly happen. "This was a terrible tragedy, but sometimes...