Anonymous Researcher Dumps 204 Zero-Day Exploit Files, Bypassing Coordinated Disclosure
An anonymous researcher has released 204 proof-of-concept exploit files for numerous open-source projects, including PostgreSQL and Redis, before vendors could patch the vulnerabilities.
An anonymous researcher, operating under the GitHub handle 'bikini,' has created a significant security disruption by publishing 204 zero-day proof-of-concept (PoC) exploit files for a wide array of open-source projects. The collection, hosted in a repository named 'exploitarium,' deliberately bypasses the standard practice of coordinated vulnerability disclosure, releasing exploit code before affected vendors have had the opportunity to develop and deploy patches. This approach effectively eliminates the protective window that coordinated disclosure is designed to provide, leaving defenders scrambling to react to publicly available exploit mechanisms.
The 'exploitarium' repository began accumulating entries in late June 2026, with a substantial initial release around June 27. Analysts from LevelBlue SpiderLabs observed that the project has continued to grow steadily, with new vulnerable projects being added at a pace of two to three per week. Recent additions in early July alone included widely used platforms such as PostgreSQL, Redis, Nextcloud, and Discourse. While early reports cited around 130 PoCs, LevelBlue's analysis has since identified 35 tracked project folders containing a total of 204 files, indicating a significant expansion of the archive.
The attack surface exposed by these PoCs is exceptionally broad, encompassing native C and C++ codebases, kernel drivers, web application logic, remote access tools like AnyDesk and RustDesk, and essential infrastructure components such as Nmap and curl. This wide-ranging impact transforms the incident into a supply chain problem, as many organizations may unknowingly inherit exploitable libraries through transitive dependencies in their software stacks.
This mass disclosure pattern bears similarities to the Nightmare-Eclipse campaign previously observed by LevelBlue, but 'exploitarium' exhibits a more systematic and widespread reach across diverse open-source ecosystems. Unlike campaigns that focus on a single vendor or specific operating system internals, this initiative targets developer tools, cloud-native services, container platforms, and community forums, presenting a complex challenge for broad-spectrum defense.
LevelBlue's assessment cautions that not all entries in the 'exploitarium' archive carry the same level of criticality. While some files appear to be artifacts from automated fuzzing runs with low impact, others document high-severity, pre-authentication flaws in widely embedded components. A notable example is CVE-2026-55200 in libssh2, an out-of-bounds write vulnerability in the ssh2_transport_read function that can be triggered before SSH authentication, potentially leading to remote code execution.
The libssh2 vulnerability also highlights the complex interplay between coordinated and uncoordinated disclosure. Although 'exploitarium' included a PoC for this flaw from its inception, the official CVE designation was assigned through VulnCheck's standard reporting channels, demonstrating how the same vulnerability can surface through both responsible and mass disclosure paths.
Over time, 'exploitarium' has evolved from a personal archive into a lightly moderated clearinghouse that accepts external research contributions. This includes submissions like Pull Request 4, which added new Windows kernel driver issues related to OpenVPN's ovpn-dco-win component. This blend of curated contributions and unvetted external research amplifies the risk associated with the growing collection, potentially lending implicit credibility to publicly disclosed exploits.
LevelBlue advises security and detection teams to prioritize patching upstream fixes and migrating to versions incorporating specific commits, such as commit 97acf3d for libssh2. Organizations should treat the broad transitive footprint of these vulnerabilities as a high priority, regardless of whether exploitation has been confirmed in their specific environments.