🚨 Anonymous GitHub User Mass-Releases Undisclosed 0-Days

A mysterious entity operating under the handle bikini has launched a repository titled exploitarium, serving as a centralized vault for public Proof-of-Concept (PoC) exploits and detailed vulnerability research.

"I do this to allure people into the field, and I've always found this is the most efficient way."

The author encourages others to take these findings, report them officially, and claim the CVE credit for the "lulz."

---

🛠️ Methodology & The AI Debate

There has been significant chatter regarding the use of Artificial Intelligence in these discoveries. The author clarifies their workflow to debunk the narrative that they are just some random child burning tokens.

The Fuzzing Pipeline

The author utilized a highly automated fuzzing workflow. While the "thought" process was minimal, it was underpinned by a strict harness.

Key Technical Clarifications:

• Model Used: GPT-5.5-3-Codex-Spark handled all fuzzing operations.
• Human Element: The author holds a degree in the field and has published multiple academic papers on fuzzing methodologies.
• SOTA Models: The author asserts that State-of-the-Art (SOTA) models are not a requirement. The efficiency gain from a more expensive model is marginal when compared to the impact of a quality harness and human oversight.
  • $\text{Effectiveness} \approx \text{Harness Quality} + \text{Human Oversight} \gg \text{Model Tier}$
• Coding Process:
  • Most PoCs were hand-typed (not "vibe-coded").
  • Exception: AI assistance was used for RustDesk due to the author's lack of familiarity with the Rust language.
  • Exception: All README.md files were generated by AI for formatting purposes.

---

📂 Repository Contents: The Exploitarium

The author admits the repo was slightly incomplete upon launch, meaning some early entries (like the Ghidra one) are "kinda ass." However, they pledge that future releases will focus exclusively on "serious" vulnerabilities, specifically mentioning Floci, libssh2, FFmpeg, and c-ares.

Vulnerability Index

The following PoCs have been dropped in the archive:

Detailed Tracking Table

---

📢 Community Notes & Future Drops

The author has noted a frustrating trend where many self-proclaimed "security researchers" are unable to modify the provided PoCs to fit their specific local environments.

Roadmap & Updates

• Initial mass-drop of PoCs
• The "Biggest Thing Yet" (Delayed, but promised to be worth the wait)
• Transition to a schedule of one new PoC per day

Credits & Contact

The author acknowledges that they were beaten to the punch on the objdump vulnerability. Credit for a superior PoC goes to: https://github.com/4D4J/objdump-Out-Of-Bounds-write.

Collaboration/Discussion: If you want to get in touch, reach out via Discord: @ashdfrkl