Exploitarium: Mass Disclosure of Zero-Day Proof-of-Concepts

An anonymous GitHub researcher known as 'bikini' has published 'Exploitarium,' a repository containing over 30 proof-of-concept (PoC) exploits and vulnerability research write-ups. This mass disclosure was conducted without prior notification to the affected vendors, resulting in several zero-day vulnerabilities becoming publicly exploitable. While some findings are considered minor or AI-generated noise, at least two are verified as critically dangerous: a pre-authentication Remote Code Execution (RCE) in libssh2 (CVE-2026-55200) and a full authentication bypass in Gitea (CVE-2026-20896).

The most significant threat, CVE-2026-55200, affects libssh2, a library transitively used by curl, Git, and PHP, giving it a massive attack surface. Exploitation occurs during the initial SSH handshake before authentication, allowing an attacker-controlled server to corrupt client memory. Simultaneously, Gitea's vulnerability allows anyone to impersonate administrative users via a simple HTTP header due to insecure default configurations in Docker images.

This event highlights a growing trend in AI-assisted vulnerability research where the barrier to discovery is lowered, potentially overwhelming maintainers with unverified reports. The risk of immediate exploitation is high, as threat actors have already been observed probing for these flaws within days of the disclosure.