- Exploitarium shares attack demos for Firefox, Docker and other common software.
- The author had an OpenAI model do the bug hunting.
- Software makers did not get private warnings before the code went public.
- One libssh2 bug scored 9.2 out of 10 and was already under attack.
- The archive remained active in September with over 5,000 GitHub stars.
An anonymous researcher called bikini made Exploitarium, a public GitHub archive of code meant to show security holes in common software. It contains more than 30 demos aimed at software projects. The author released the code without first warning the people who care for those projects. Most entries had no fix when the code went public.
Exploitarium has three Firefox entries and one Docker entry. Two target Firefox 152.0.5 and 152.0.6. Another says Firefox's Smart Window feature can reveal a private window's web address. The Docker entry concerns copying files out with the docker cp command.
Docker's own engine project reproduced the docker cp bug on Docker 29.4.0. Its issue tracker closed the report as completed on August 10.
The author says GPT-5.3 automated fuzzing, a test that sends odd data into software to find crashes and security holes. Almost all the demo code was typed by hand. Other targets include 7-Zip, VLC, OpenVPN and FFmpeg. The archive tells readers not to use its code for attacks.
Infosecurity reports that bikini did not tell software makers before publishing. That skipped coordinated disclosure, where researchers privately warn software makers and give them time to fix a bug. Bikini said public posting was the best way to help people learn and enter the field. The README invites readers to report the bugs and claim credit if an official bug number is issued.
Infosecurity Exploitarium report
One entry affects libssh2, code that apps use for secure network connections. The 9.2-out-of-10 bug could let an attacker run code before a login. The Register reported that the bug was already being attacked. A fix was added to libssh2's development code.
The Register reported on June 29 that GitHub had removed the archive. GitHub's record showed it online again on September 22 after its latest update on September 16. It then had 5,130 stars and 1,313 user-made copies. Federal Signal analyst Ethan Andrews told Infosecurity that some entries were dismissed as low-risk noise.
