An anonymous GitHub user, operating under the pseudonym “bikini,” has released a collection of 204 zero-day proof-of-concept (PoC) exploit files targeting numerous open-source projects. This release occurred before the affected vendors had the opportunity to develop and distribute patches, effectively eliminating the protective window typically afforded by coordinated vulnerability disclosures.
The repository, named “exploitarium,” began accumulating these PoC files in late June 2026. The initial batch, dated June 23, gained significant public attention around June 27. The repository’s README file explicitly states that none of the vulnerabilities were reported to the respective vendors prior to their public release, and it encourages others to independently disclose these findings.
Security analysts from LevelBlue SpiderLabs have observed that this approach places exploit code in the hands of both attackers and defenders simultaneously, thereby increasing the risk of exploitation before patches can be developed and deployed. Since its inception, the repository has continued to expand, adding new vulnerable projects at a steady pace of approximately two to three per week. Notable additions in early July include widely used platforms such as PostgreSQL, Redis, Nextcloud, and Discourse.
The scope of the vulnerabilities is extensive, encompassing native C and C++ codebases, kernel drivers, web application logic, remote-access tools like AnyDesk and RustDesk, and core infrastructure components such as Nmap and curl. This breadth transforms the situation into a significant supply chain issue, as many organizations may unknowingly incorporate these exploitable libraries as dependencies in their software stacks.
This mass disclosure strategy mirrors patterns observed in the earlier Nightmare-Eclipse campaign, which focused on a single vendor and Windows internals. In contrast, “exploitarium” systematically targets a wide array of open-source ecosystems, including developer tools, cloud services, container platforms, and community forums.
The release of such a substantial number of zero-day exploits without prior vendor notification underscores the critical importance of proactive security measures. Organizations must remain vigilant, continuously monitor for emerging threats, and implement robust security practices to mitigate potential risks. This incident also highlights the need for the open-source community to enhance its vulnerability management processes to better protect against such uncoordinated disclosures.
