19 Oct 2026
On September 22, 2026, VideoLAN shipped VLC 3.0.24 with over 130 security fixes. VideoLAN president Jean-Baptiste Kempf calls it "our biggest security release ever". He says part of the reason is funded security work, and part is that "LLMs have changed the economics of finding bugs". In his words, finding suspicious code got cheaper, while reproducing, fixing, reviewing and backporting "did not get cheaper at all". This video goes through what is in the release, what Kempf says caused it, and what curl, FFmpeg, the Linux kernel, Node.js, Python, HackerOne, Google and GitHub have said about AI-assisted bug reports. Every claim in the video is attributed to the person or project that said it. This video covers:
- who makes VLC, and the Chrome bundling offer Kempf says he turned down
- what VLC 3.0.24 fixes: 50+ issues in VLC, 74+ in bundled libraries, FFmpeg 4.4 to 8.1.2, a new RSA-4096 update key
- Kempf's explanation and his "new normal" warning
- curl: AI slop reports, the end of the bug bounty, and the July "summer of bliss" pause
- FFmpeg vs Google's Big Sleep ("CVE slop"), and the 21 FFmpeg zero-days reported by depthfirst
- HackerOne, Bugcrowd, Linux kernel, Node.js and Python numbers, paused bug bounties, and the Linux Foundation's $12.5M
Sources:
- Jean-Baptiste Kempf, VLC 3.0.24: our biggest security release ever (Sep 25, 2026): https://jbkempf.com/blog/2026/vlc-3.0...
- VideoLAN, VLC 3.0.24 release page: https://www.videolan.org/vlc/releases...
- VideoLAN news (Sep 22, 2026): https://www.videolan.org/news.html
- VideoLAN security bulletin VideoLAN-SB-VLC-3024: https://www.videolan.org/security/sb-...
- VideoLAN on X (Sep 23, 2026): https://x.com/videolan/status/2102899...
- Jean-Baptiste Kempf, VLC 3.0.7 and security (2019): https://jbkempf.com/blog/VLC-3.0.7-an...
- VideoLAN organization page: https://www.videolan.org/videolan/
- TechCrunch, VLC crosses 7 billion downloads (Aug 31, 2026): https://techcrunch.com/2026/08/31/vlc...
- Clubic on VideoLAN and the 7 billion milestone (Sep 2, 2026): https://www.clubic.com/actualite-6277...
- BFM Business interview with Jean-Baptiste Kempf (Feb 23, 2026): https://x.com/bfmbusiness/status/2025... and https://x.com/bfmbusiness/status/2025...
- Clubic on the Google Chrome offer (Feb 24, 2026): https://www.clubic.com/actualite-6020...
- Wikipedia, Jean-Baptiste Kempf: https://en.wikipedia.org/wiki/Jean-Ba...
- Daniel Stenberg, The I in LLM stands for intelligence (Jan 2, 2024): https://daniel.haxx.se/blog/2024/01/0...
Chapters 0:00 VLC's biggest security release 0:49 Who makes VLC 1:39 What's inside VLC 3.0.24 3:04 Why 130 fixes at once 4:19 curl and the AI slop reports 5:48 FFmpeg vs Google 7:26 The numbers across open source 9:24 Real bugs, and what's next
