It is interesting that Tom and Nexcess seem to be saying that thousands of their users have been affected because it’s all core’s fault…

But I haven’t seen anything but cURL 7.29 affected – and that version is 10 years old and riddled with security issues. It is also notable that anyone who still hasn’t moved from centOS 7 (EOL june 2023) is likely still running this version, because that project is dead.

So at this moment, it does look like anyone affected has a site on hosting that is likely running outdate EOL OS and ancient versions of cURL.

That is not to say WP Core didn’t handle this badly, but the Nexcess lady seems to be deflecting and not taking any responsibility for their stack.

With regards to her reported sequence of events, I would also disagree.

I don’t think missing tests are the real issue, the real issue as far as core is, the ticket should have been closed immediately as a won’t fix. This is an upstream bug and should have been reported upstream and not been handled in core… IMO

I mean should you write tests to test every single versions of cURL going back 10 years? Why on earth is anyone still running 10 year old cURL?

Its a mess, but not just with an update to core and how bugs are handled, it exposes a lot of hosts.