An anonymous profile on GitHub is doing something that puts the cybersecurity industry in check: publishing “zero-day” vulnerabilities —security flaws manufacturers don’t yet know about— without warning anyone in advance. The repository, named exploitarium, has appeared out of nowhere and already contains dozens of proof-of-concept (PoC) exploits demonstrating how to attack widely used programs.
What exactly is happening?
The account bikini —whose owner is unknown— has uploaded a file to GitHub with functional exploits for tools such as Ghidra (the NSA’s code analyzer), nmap (the network scanner), Wireshark (the traffic analyzer), c-ares (a network library used in millions of applications), and even FFmpeg (the video processor). The most striking thing is that, according to the author himself, none of these vulnerabilities has been reported to the developers. In other words, they are genuine zero-days: flaws that these companies’ security teams don’t know exist.
The repository comes with a sui generis statement of intent: “Feel free to report them yourself and take the CVE credit if they grant it. Please don’t abuse this. I do it to attract people to the security field, and I’ve always found this to be the most effective way”.
Is this ethical?
Here’s the debate. The norm in cybersecurity is to follow responsible disclosure: whoever finds a flaw notifies the manufacturer first, gives it a deadline (usually 90 days) to fix it, and only then makes it public. This allows users to update before attackers can exploit the hole.
Publishing zero-days without warning is a ticking time bomb. Anyone —from an ethical hacker to a cybercriminal group— can use those exploits to break into systems running those programs. The Hacker News community has already started analyzing the content: some exploits seem solid, others are more questionable, but as a whole the file represents a real risk.
What does it mean for you?
Even if you use programs like Wireshark or FFmpeg only occasionally, these flaws affect tools that are everywhere. Libraries like c-ares are in operating systems, browsers, and applications you use daily. If a hacker exploits one of these holes, they could take control of a computer or steal data without you noticing.
The good news is that, thanks to the file now being public, the security teams of the affected companies can start working on patches. Some developers have already confirmed they are investigating the reports. But until the updates arrive, the recommendation is the usual one: keep all your software up to date and don’t trust tools that aren’t from official sources.
This case reopens the debate about how to share vulnerabilities: is total transparency better or responsible disclosure? While some see “exploitarium” as a way to attract talent to cybersecurity, others consider it an irresponsibility that puts users around the world at risk.
— Marta, for intermittent intelligence.
