“The people who deleted or replaced the curl executable noticed that they cannot upgrade because the Windows update procedure detects that the Windows install has been tampered with and it refuses to continue.”
NVD bumped a low-severity curl use-after-free to medium, and scanners like Nessus started flagging Windows’ bundled curl.exe. Admins under contract to clear every warning deleted the system binary, some on advice from Microsoft’s own forum volunteers. Microsoft’s real fix, KB5025221, now refuses to install on those machines. The curl project fixed the bug in December 2022 and still gets the support tickets.