A stranger is handing out code that they say can break into everyday software, and anyone can download it for free. The targets include Firefox, Docker and 7-Zip, tools that sit on millions of computers. The person says the bugs had not been reported to the makers when they posted the code, which is the worst time to make it public.
The code lives in a public GitHub project called "exploitarium," posted under the name "bikini." Since then, official warnings have shown up for a few of the entries, but not all, and the fix status is all over the map. No company has confirmed the flaws are real, and one Hacker News reader who checked the entry aimed at the Ghidra tool says it is not even a bug.
The person behind it has added to the project about 40 times since June 23. Other users have already saved it 1,400 times and made nearly 300 copies.
What's in the dump
Each folder goes after a different program. There is code aimed at the 7-Zip file tool, the AnyDesk remote-control app, the Docker developer tool, and the FFmpeg video tool, among others. Most of it looks like sample code meant to trip the bug, not a finished attack.
Several of the demos just make the target program pop open the Windows calculator. That is a common, harmless way to prove you can run your own code on a machine without doing real harm. But the same trick gives a real attacker a big head start.
Why it's risky
A flaw the maker has not fixed yet, often because they only just heard about it, is called a zero-day. Several of the claimed issues here have no public fix. Posting working demo code for them in the open lets attackers start early, before anyone can patch.
If you use any of the named programs, turn on automatic updates and install fixes the moment they land. One of the 7-Zip demos abuses the Windows warning that flags files pulled from the internet, so take extra care opening files sent by people you do not know.
It is not clear whether the affected companies were ever warned, and the person behind the project stays anonymous.
