libheif's Maintainer Gets $41/Month While Firms Embed It to Process Sensitive Data
craigbalding · x · 2026-09-18
The developer behind one of the most widely used phone image processing libraries receives just $41/month via personal GitHub sponsors. His funding. estimates a one-time security audit at $25K plus $5K/month for two days a week of vulnerability triage and fixes.
The team that found and exploited a libheif RCE will soon publish a list of impacted companies — some embed the library in commercial products processing clients' PII and commercial data. The post urges companies to question vendors on cyber supply chain risk and to fund maintainers of core dependencies.
More from Venture
- Payments firms race to own AI inference: Stripe taps OpenRouter, Ramp enters the chain — xkonjin · 2026-09-18
- Indie maker's Outrank to pay $5,919 to backlink providers; DR30+ blogs can monetize — tibo_maker · 2026-09-18
- Third London AI lab founded by ex-DeepMind staff, Emulate, nears stealth exit at $3.7B valuation — pearsekeane · 2026-09-18
- Automating an X-to-blog/newsletter pipeline with MCP: open rates beat SES — iannuttall · 2026-09-18
- Extreme Lab Lock-In: Frontier Labs Hoarding Best Models May Be the Underpriced Endgame — abhiadesai · 2026-09-18
- Polymarket opens Anthropic bankruptcy market; 2027 odds just 7% after $965B valuation — Polymarket · 2026-09-18