Dolphin 2609 brings Android NetPlay as the team fends off AI bug hunters

The GameCube and Wii emulator's latest release adds NetPlay to Android and other fixes, while its progress report details a wave of AI-generated security reports and a brief buildbot compromise.

AI-drafted from 2 sources. This story was written with AI from the outside reporting listed under Sources, and checked by automated tools before it went up. The originals have the full detail.

Dolphin, the open source GameCube and Wii emulator, has shipped release 2609 with NetPlay finally working on Android, alongside a clutch of smaller fixes. The accompanying progress report spends less time on the code than usual, because the team has also been dealing with what it calls a “Techpocalypse”: a surge of AI-generated vulnerability reports and a brief compromise of its macOS build server.

NetPlay is Dolphin's lockstep online multiplayer system, which keeps every connected copy of the emulator perfectly synchronised frame by frame so that games designed only for local split screen, think Mario Party 7 or F-Zero GX, can be played over the internet. It has existed on desktop for years but never made it to Android, partly because building a decent touch interface for something this fiddly is a slog, and partly because forcing weaker phones into the deterministic single core mode NetPlay demands used to be a bad trade. According to the Dolphin progress report, contributor tom-pratt built the feature using Jetpack Compose, Google's modern toolkit for Android interfaces, shipping it in stages so it could be reviewed and merged rather than landing as one enormous patch. Host side controller port configuration has since caught it up close to desktop parity.

Notebookcheck's write-up frames this as NetPlay going “fully cross-platform”, meaning phone and desktop users can now play against each other rather than being locked to matching operating systems. The Dolphin team's own caption on a demo screenshot is more cautious, warning that “even on different x86 PC architectures but especially on Android, Dolphin's crossplay netplay will desync eventually”, which suggests this is a genuinely useful feature rather than a flawless one.

Why the bug reports have exploded

The more striking part of the progress report is about process, not features. The Dolphin team writes that AI tools are now being used to “mass-scan open source projects for potential vulnerabilities”, generating what it describes as very verbose reports that a volunteer team then has to work through by hand. Notebookcheck's article puts a number on it: more than ten security reports so far this year, which it says is more than the previous decade combined. Most were reportedly simple buffer overflows, the kind of bug that used to warrant its own dedicated progress report entry, back when a single one turned up roughly once every few years. Dolphin has responded by routing security reports through GitHub's dedicated vulnerability disclosure flow rather than its normal bug tracker, an attempt to stop the volume from swamping ordinary development.

A cryptominer on the buildbot

Separately, the team reports that a macOS vulnerability let an attacker briefly compromise its macOS buildbot, the server that compiles official releases, with what both sources describe as a generic cryptominer. The progress report states plainly that no builds were compromised, though it does not go into how the intrusion was discovered or closed off, so the practical details of that incident remain unconfirmed beyond the team's own reassurance.

What else changed

Away from the security drama, release 2609 also adds an option to show XFB framebuffer resolution in Dolphin's on screen display, useful because the GameCube and Wii both rendered with non-square pixels and the raw framebuffer size can differ from what ends up on screen. Notebookcheck also notes improved rumble support with separate controls for touch feedback and vibration, better MayFlash DolphinBar balance board compatibility, Dolphin settings now appearing in Android's system search, and a clean-up of Visual Studio project files following a shift to CMake, which should mean less manual fiddling for Windows contributors.

None of this changes what Dolphin plays or how it plays it. What it does show is a volunteer project increasingly having to spend its limited time defending its own infrastructure and triaging reports it did not ask for, a pattern likely to be familiar to plenty of other open source teams as 2026 goes on.

Sources

Image: Notebookcheck

More news from Gaming World