Loading story…
An autonomous security agent developed by depthfirst uncovered 21 previously unknown zero-day vulnerabilities in FFmpeg, the widely used open-source media processing library embedded in browsers, streaming services, surveillance products, and cloud workloads. Reported flaws span the TS demuxer, VP9 decoder, RTP depacketizers, RTSP server, and RTMP client, with multiple memory-corruption bugs and at least eight assigned CVEs. The most severe issue, DFVULN-127, is a heap buffer overflow in FFmpeg’s AV1 RTP depacketizer that researchers said could enable remote code execution through a single 183-byte RTP packet delivered over RTSP, without authentication or user interaction.
The FFmpeg findings were disclosed alongside Chrome 149, which fixed a record 429 vulnerabilities, including more than 100 critical or high-severity flaws and a severe ANGLE issue tracked as CVE-2026-10881 with a CVSS 9.6 score. Researchers said the FFmpeg bugs were found after an AI agent scanned roughly 1.5 million lines of C code, performed threat modeling, reachability analysis, and proof-of-concept generation, reportedly at a cost of about $1,000. The disclosures add to evidence that AI is sharply increasing the speed and volume of vulnerability discovery, while leaving defenders and maintainers under growing pressure to triage findings, patch exposed software, and review network-facing workflows that process untrusted RTSP/RTP media streams.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Google recently changed its bug bounty process in response to a flood of AI-generated vulnerability submissions. The change was cited alongside the surge in AI-assisted vulnerability discovery affecting vendor triage and remediation workflows.
Google released Chrome 149 with a record 429 vulnerability fixes in a single release, including more than 100 critical or high-severity issues. Coverage highlighted a severe ANGLE flaw, CVE-2026-10881, with a CVSS score of 9.6.
Security startup depthfirst reported that its autonomous agent discovered 21 previously unknown zero-day vulnerabilities in FFmpeg, including memory corruption issues across multiple components and reproducible proof-of-concept inputs. The reporting said the agent analyzed roughly 1.5 million lines of C code and made the discoveries at an estimated cost of about $1,000.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FFmpeg patched **CVE-2026-8461**, a high-severity heap out-of-bounds write flaw dubbed **PixelSmash** in the `libavcodec` **MagicYUV** decoder. The bug is triggered by an odd `slice_height` condition while parsing malicious **AVI**, **MKV**, or **MOV** files and affects FFmpeg versions before **8.1.2**. The vulnerability can cause denial of service and, in some environments, lead to remote code execution. JFrog reported that applications embedding FFmpeg are exposed through their media-processing pipelines, and demonstrated full remote code execution against **Jellyfin 10.11.9** via its automated media library scan workflow, although successful RCE required **ASLR** to be disabled or bypassed. **Nextcloud** was also identified as potentially vulnerable under additional conditions, while **Plex** appears largely protected by a restricted custom FFmpeg build. Organizations using FFmpeg directly or through downstream products have been urged to upgrade to **FFmpeg 8.1.2 or later** and apply vendor patches because the decoder’s broad adoption creates a notable supply-chain exposure.
Jul 30, 2026
Anthropic disclosed that its **Claude Mythos Preview** model autonomously discovered and, in some cases, exploited vulnerabilities across major software targets, including **Firefox**, **OpenBSD**, **FreeBSD**, **Linux**, **FFmpeg**, cryptography libraries, and a memory-safe virtual machine monitor. The company said the system produced browser exploit chains involving JIT heap sprays and sandbox escapes, chained Linux kernel flaws into local privilege escalation, and developed a fully autonomous exploit for **`CVE-2026-4747`**, a FreeBSD NFS issue that reportedly enables unauthenticated remote root access. Anthropic said most findings remain under coordinated disclosure because fewer than 1% had been patched at the time of publication. Publicly described examples included a **27-year-old OpenBSD SACK denial-of-service bug** that was later addressed in an OpenBSD patch, and a **16-year-old FFmpeg H.264 out-of-bounds write**. Anthropic also said it partnered with Mozilla to improve Firefox security, underscoring that modern AI systems are now capable of meaningful autonomous vulnerability research against widely deployed platforms. To limit immediate misuse, the company withheld most technical details and published **SHA-3 commitments** for future disclosure while urging defenders to accelerate AI-assisted bug hunting, patching, disclosure coordination, and incident-response automation.
Jul 28, 2026
Google has released two Chrome Stable channel security updates that together patch **34 vulnerabilities**, including multiple flaws that could allow **remote code execution** if users are lured to malicious webpages. The first update fixed **26 issues**—including **three critical**, **22 high-severity**, and **one medium-severity** bugs—in components such as **WebGL**, **WebRTC**, **V8**, **Blink**, **Network**, **WebAudio**, **Dawn**, **PDFium**, **ANGLE**, and **Extensions**. Google said the most serious weaknesses involved memory corruption, including use-after-free, heap and stack buffer overflows, out-of-bounds access, integer overflows, type confusion, and insufficient validation of untrusted input. A follow-up update addressed **eight additional high-severity vulnerabilities** affecting **WebAudio**, **CSS**, **WebGL**, **Dawn**, **WebGPU**, **Fonts**, and **FedCM**, again dominated by memory-safety bugs that could lead to browser compromise. Google shipped versions `146.0.7680.153` and `146.0.7680.154` for Windows and macOS and `146.0.7680.153` for Linux in the first release, followed by `146.0.7680.164` and `146.0.7680.165` for Windows and macOS and `146.0.7680.164` for Linux in the second. The company said many flaws were found through **AddressSanitizer**, **MemorySanitizer**, and **libFuzzer**, paid a **$7,000** bounty for one WebAudio bug, and is withholding technical details until more users have updated to reduce the risk of exploit development.
Jun 29, 2026