Anonymous 'exploitarium' repo dumps undisclosed 0-days. Now what?

What happened

An anonymous GitHub account operating as `bikini/exploitarium` posted a repository containing what it claims are multiple previously undisclosed zero-day vulnerabilities — proof-of-concept code, write-ups, and target identifiers, all dropped without prior vendor notification. The post reached 362 points on Hacker News within hours, a level of traction that usually requires a named researcher or a household-brand vendor in the headline. Here it was neither: just an alias and a repo name designed to provoke.

The disclosures bypass every step of the coordinated process most large vendors and the CVE ecosystem have spent two decades hardening: no embargo, no vendor heads-up, no CVE reservation, no CERT coordination. The author has not surfaced a manifesto, a grievance against a specific vendor, or a bounty dispute — the standard tells when a researcher goes scorched-earth. The repository simply exists.

GitHub's policy on weaponized exploit code is famously elastic. The platform has historically taken down only the most egregious cases — typically when active in-the-wild exploitation can be tied to the published artifact, or when a vendor files a targeted DMCA. As of writing, the repo remains up. Whether it stays up through the weekend is an open question, and one mirror operators are already answering for themselves.

Why it matters

The security community has been quietly losing faith in coordinated disclosure for years, and this drop is what that erosion looks like in practice. The implicit bargain — researchers sit on findings for 90 days while vendors patch — only works when vendors actually patch. Project Zero's own published data shows a long tail of fixes shipping past deadline; smaller vendors routinely ignore reports entirely. When the incentive structure breaks, somebody eventually defects, and 'somebody' increasingly looks like an anonymous account with nothing to lose.

There is a real argument for what `exploitarium` is doing, and it deserves to be stated in its strongest form. Public PoCs measurably accelerate patching: vendors that ignored a private email find religion when their CVSS 9.8 lands on the front page of HN. Defenders get IOCs, detection rules, and a concrete reason to escalate the ticket their security team has been begging product to prioritize. Asymmetry between attackers (who buy 0-days regardless) and defenders (who don't) collapses a little.

The counter-argument is equally real. Mass disclosure without a patch window guarantees a measurable window — usually 24 to 72 hours — where every motivated attacker has working exploits and no defender has a fix. Ransomware crews monitor these dumps in real time; we know this from the 2021 ProxyLogon disclosure, which went from researcher PoC to mass exploitation in under 48 hours. The body count from that episode is still being counted. If even one of the bugs in `exploitarium` hits a widely deployed dependency, the next few news cycles will be ugly.

The attribution question is its own minefield. Anonymous drops can come from anywhere on the spectrum: a frustrated researcher whose bounty was lowballed, a contractor laundering findings they're contractually barred from publishing, a state actor burning capabilities a rival is about to burn first, or — and this is the one nobody wants to say out loud — an attacker dumping the leftovers of a campaign that's already finished. We can't tell the difference from the outside, and neither can the vendors scrambling to triage which bugs are already being exploited in their telemetry.

What this means for your stack

If your incident response process assumes you'll learn about new 0-days through CISA's KEV catalog, a vendor advisory, or a vendor's monthly patch Tuesday cadence, this week is a useful drill. The realistic detection path for something like `exploitarium` is: somebody on your team sees it on HN, screenshots the affected products list to Slack, and your on-call has to figure out exposure with no CVE to grep for and no patch to apply. Most orgs are not set up for this.

Three concrete moves worth making before Monday. First, audit what your SBOM tooling actually catches when the input is a repo URL and a binary diff rather than a CVE number — most commercial scanners need a CVE-to-package mapping to do anything useful, and that mapping doesn't exist yet for anything in this dump. Second, confirm your WAF/EDR vendor has a process for turning a public PoC into a virtual patch rule in hours, not days; ask them point-blank what their SLA is for unattributed drops. Third, pre-write the executive comms template for 'a vulnerability affecting [vendor] was publicly disclosed before a patch existed' — you will use it more than once over the next year.

The deeper change is cultural: the assumption that the disclosure pipeline routes through institutions is an artifact of a smaller, more genteel security community, and it isn't coming back. Plan accordingly.

Looking ahead

The repo will likely come down — either via GitHub policy action, a coordinated DMCA storm from affected vendors, or a quiet takedown after a law enforcement letter. The mirrors won't. We've now run this experiment enough times — Shadow Brokers, the Conti leaks, vx-underground, half a dozen Telegram channels — to know that the half-life of an interesting security dump is forever. The interesting question isn't whether `exploitarium` stays up; it's whether the next anonymous drop comes with a manifesto, a target list, or a Monero address. Each of those is a different story, and the security industry's response to this one will quietly determine which we get.