A GitHub account known as “bikini,” operating under the Exploitarium name, has published a large and expanding archive of vulnerability proof-of-concept (PoC) files targeting 353535 open-source projects.
The repository contains 204204204 tracked files, exceeding earlier reports that cited roughly 130130130 PoCs. Its first dated entries appeared on June 232323, 202620262026, and the archive drew broad attention around June 272727.
Unlike responsible disclosure programs, the repository states that its findings were not reported to affected vendors before publication.
That approach creates an immediate challenge for security teams. Some submissions may be severe and technically valid. In contrast, others may be low-impact crashes or artifacts produced through automated fuzzing.
However, public PoC availability can enable rapid testing by both defenders and threat actors before patches, advisories, and mitigations are widely available.
The archive continued to grow after its initial publicity. New folders for PostgreSQL, Redis, Nextcloud, and Discourse were added during the first week of July.
The project now includes vulnerabilities or alleged flaws across infrastructure, developer tooling, web applications, remote-access software, media-processing libraries, and native C/C++ projects.
Exploitarium differs from prior mass releases because of its scale and persistence. Earlier 2026 disclosures, including the Nightmare-Eclipse campaign, focused on Windows-related targets and a single vendor ecosystem.
Exploitarium instead spreads across diverse open-source projects and is developing into a shared publication platform rather than a one-time disclosure event.
Exploitarium Releases 204 Zero-Days
The most notable entry is CVE-2026-55200, a vulnerability affecting libssh2 through version 1.11.11.11.11.11.1.
The issue is an out-of-bounds write in the ssh2_transport_read() function caused by inadequate validation of the SSH packet packet_length field.
An attacker could send a specially crafted SSH packet before authentication. The vulnerable code performs size calculations using insufficiently wide values, allowing an oversized packet length to wrap around.
This may result in an undersized heap allocation followed by a write beyond the buffer boundary.
Upstream maintainers addressed the flaw in commit 97acf3d, which rejects packet_length values exceeding LIBSSH2_PACKET_MAXPAYLOAD before allocation logic runs. Organizations should update to a libssh2 release that includes the fix.
The concern extends beyond direct libssh2 deployments. The library can appear as a dependency in widely used tools and build environments, including curl, Git, PHP builds, CI/CD systems, container images, and vendor-supplied packages.
Security teams should use software composition analysis to locate both direct and transitive libssh2 dependencies, levelblue said
| Metric | Details |
|---|---|
| Archive Name | Exploitarium |
| GitHub Account | bikini |
| Initial Entries | June 23, 2026 |
| Public Visibility Spike | Around June 27, 2026 |
| Open-Source Projects Targeted | 35 |
Although Exploitarium published a PoC for the issue, the CVE was formally disclosed through VulnCheck’s coordinated process and credited to researcher Tristan Madani.
This distinction matters, a repository can reproduce or publish material related to a vulnerability without being the original discoverer or coordinated reporter.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
