Anonymous account drops 20 unpatched zero-days on open source tools, credits AI fuzzing

An anonymous GitHub user named 'bikini' published a repository called 'exploitarium' last week, containing over 20 proof-of-concept exploits targeting widely used open source software including nmap, FFmpeg, VLC, Firefox, Docker, and OpenVPN. None of the vulnerabilities were disclosed to project maintainers beforehand, and none had been patched at the time of posting. The repository's README explicitly invited others to report the bugs and claim CVE credit themselves. Security researchers who reviewed the findings on Hacker News reached mixed conclusions, with some bugs dismissed as non-exploitable while others — particularly in c-ares, libssh2, FFmpeg, and nmap — were flagged as credible and unresolved. The mass disclosure has forced the open source security community into a rushed, decentralised triage effort with no coordinated response in place.