VLC 0.9,5 already released, check out the vlc website. "The VideoLAN team is pleased to announce the release of VLC media player 0.9.5. This is a bugfix release. VLC media player 0.9.4 and earlier versions suffer from security vulnerability in TiVo demuxer. More technical details are available in our advisory (CVE-2008-4654, CVE-2008-4686). Also, libpng was updated in Windows and MacOS builds to fix its security issue (CVE-2008-3964)."

This release also improves media keys support under Windows, file access under all OSes, QT interface usability as well as fixing few more other bugs. Full list of changes can be found here.
They strongly recommend all users to update to this new version.
Binary packages for Mac OS X and source code tarballs are available for download. Windows binaries might arrive at a later time.