Inside the VMT: Managing Security at Scale in OpenStack

By the end of October, the OpenStack community had shipped fifty security advisories, making 2026 the busiest year in security bug triage and remediation. This is neither a flex nor an embarrassment. The Vulnerability Management Team exists to ensure responsible disclosure, prevent silent fixes, and help protect the critical workloads running globally on OpenStack. On this episode of OpenInfra Live, Goutham Pacha Ravi and Jay Faulkner join Kendall Nelson and Wes Wilson to pull back the curtain on how that process actually works at scale.

The conversation covers the scope of OpenStack's VMT, how project security liaisons coordinate fixes across release branches, and why highly customizable software with wide-ranging deployment strategies requires careful impact framing so operators can assess whether a bug affects their specific cloud configuration. You'll hear why two clear lines of evidence pointing at an exploitable path beat a three-page theoretical essay, how LLM-assisted bug discovery has shifted the triage load, and what makes a security report actionable when the affected codebase spans millions of lines across dozens of projects.