AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs
Summary: A security startup called depthfirst reported 21 previously unknown vulnerabilities in FFmpeg, the media library used in most video software, all found by an autonomous AI agent that scanned roughly 1.5 million lines of C for about $1,000, with each bug backed by a reproducible proof-of-concept input. The same week, Google shipped Chrome 149 with patches for 429 security bugs, a record for a single release, more than 100 of them critical or high severity, including CVE-2026-10881 (CVSS 9.6), an out-of-bounds read and write in the ANGLE graphics engine that lets a crafted page escape the sandbox and run code on the host.
What you should know: Several of the FFmpeg bugs had been latent for 15 to 20 years, and one stack overflow dates to 2003, which means the cost of finding them has collapsed to about $1,000 while triaging the reports, shipping the fixes, and getting them installed still falls to volunteers and a thin layer of human triagers.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-10881CVE-2026-39210CVE-2026-39218
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026