Yeah I’m waiting for this as well.

I get that you want to address them or whatever before releasing info but I keep seeing these claims with barely any data and I’m like…how do you expect people to not be skeptical?

I mean hell if you’re a security professional you’re literally paid to be skeptical.

the curl maintainer goes into some more detail on this

https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-v...

Mozilla published some numbers and actual bugs.

https://hacks.mozilla.org/2026/05/behind-the-scenes-hardenin...