The recent release of a GitHub repository called 'Exploitarium' by an anonymous researcher, known as 'bikini', has sent shockwaves through the cybersecurity community. This repository contains exploit code for zero-day vulnerabilities across 15 software products and open-source projects, including libssh2, Splunk, RustDesk, 7-Zip, VLC, AnyDesk, OpenVPN, c-ares, Gitea, and Floci. The researcher claims that none of the exploits have been reported, but the damage is already being felt.
One of the vulnerabilities, CVE-2026-55200, is a critical, pre-authentication remote code execution (RCE) vulnerability in libssh2. This vulnerability allows remote attackers to send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution. A fix has been merged into the libssh2 mainline development source control branch, but maintainers are still preparing a release containing the patch.
The second vulnerability, CVE-2026-20896, is a critical authentication bypass vulnerability affecting self-hosted Gitea Docker deployments. This vulnerability allows unauthenticated remote attackers to impersonate any user and fully take over the Git server. The fix is available in Gitea 1.26.3.
Bikini's actions remind us of 'Nightmare Eclipse', a zero-day bug hunter who has been publishing Microsoft exploits over the past couple of months. However, unlike Nightmare Eclipse, bikini doesn't appear to hold a grudge against any one vendor, publishing purported vulnerabilities across multiple products and projects.
The release of Exploitarium has sparked concerns about the use of advanced AI models, such as GPT-5.5 Codex, to automate fuzzing and vulnerability discovery. Some researchers, including Federal Signal analyst Ethan Andrews, suggest that bikini used AI to automate the process. This raises questions about the ethical implications of using AI to find and exploit vulnerabilities.
Andrews built 44 KQL detection rules covering the full exploitarium repo, noting that the most technically significant findings have been independently verified as high-risk with active exploitation observed. However, some of the exploitarium disclosures have been dismissed by the community as low-impact AI-fuzzing noise.
The removal of the Exploitarium repository by GitHub doesn't mean that the damage is fully contained. Attackers are now using AI to scan for vulnerable instances, and bikini's PoCs mean they don't even have to spend time developing an exploit. This raises concerns about the future of cybersecurity and the potential for widespread attacks.
In conclusion, the release of Exploitarium by bikini has highlighted the dangers of zero-day vulnerabilities and the potential for widespread attacks. The use of AI to automate vulnerability discovery and exploitation raises ethical questions and concerns about the future of cybersecurity. It is crucial for vendors and maintainers to remain vigilant and proactive in addressing these vulnerabilities to protect their users and systems.
