Summary
A pseudonymous security researcher going by “bikini” has published “Exploitarium,” a GitHub repository containing over 30 proof-of-concept exploits for zero-day vulnerabilities in widely used open-source projects — without performing any coordinated vulnerability disclosure to the affected maintainers. The dump, first published on June 27 and expanded over the following days, affects projects including the Linux kernel, libssh2, FFmpeg, Gogs, Gitea, Ghidra, 7-Zip, MyBB, PHP, OpenVPN, and VLC.
The researcher claims to have automated the entire fuzzing process using OpenAI models and tools, and explicitly invited others to file CVEs themselves, framing the work as an effort to lower the barrier to entry for aspiring security researchers. The most severe vulnerability to emerge from the dump is CVE-2026-55200, a pre-authentication remote code execution flaw in libssh2 (CVSS 9.2) that exploits oversized SSH packet_length values to manipulate heap memory. This vulnerability has been independently verified and is reportedly experiencing active exploitation, though a fix has been integrated into the libssh2 mainline development branch.
At least 12 issues from the dump have now received CVE identifiers, including memory corruption in FFmpeg, a heap buffer overflow in libssh2 on 32-bit platforms, a host container escape in Gitea’s act_runner, and a Mark-of-the-Web bypass in 7-Zip. The dump has sparked significant debate within the cybersecurity community over the ethics of mass-publishing unpatched vulnerabilities without disclosure.
Source
Infosecurity Magazine — Researcher Behind ‘Exploitarium’ Explains Release of Undisclosed Zero-Day Exploits
VulnCheck — libssh2 CVE-2026-55200 Advisory
Commentary
This is the coordinated disclosure debate distilled to its most confrontational form. The researcher’s argument — that working exploits against current software are more educational than write-ups of patched bugs — has a kernel of truth, but the real-world consequence is that dozens of open-source projects were handed live zero-days without warning. The libssh2 RCE alone affects virtually every SSH client implementation on the planet.
The AI-assisted fuzzing angle is arguably the bigger story. If one person with access to OpenAI models can generate 30+ zero-days across major projects in a matter of weeks, the vulnerability disclosure pipeline is about to be overwhelmed. The traditional model of coordinated disclosure depends on a manageable volume of reports — that assumption may not hold when AI-powered fuzzing makes bulk discovery trivial. Open-source maintainers are already stretched thin; this kind of dump will only accelerate burnout.