Risky Bulletin: Researcher drops giant cache of zero-day exploits

1. Executive summary

An anonymous researcher using the pseudonym "Bikini" has published proof-of-concept exploit code and write-ups for more than a dozen zero-day vulnerabilities across 15 open-source projects — including the Linux kernel, libssh2, Gitea, OpenVPN, 7-Zip, FFmpeg, and AnyDesk — without any prior vendor notification. Nine vulnerabilities have received official CVE identifiers so far; at least two (CVE-2026-55200 in libssh2 and CVE-2026-20896 in Gitea) are confirmed critical and are being actively exploited in the wild. EMEA financial services running self-hosted Gitea instances or incorporating libssh2 into SSH-adjacent tooling face immediate pre-authentication RCE and authentication-bypass exposure. The repository ("Exploratorium"/"exploitarium") has been removed by GitHub but was suspended twice before final takedown, and the PoC code is circulating.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed vulnerabilities

CVE-2026-55200 — libssh2 pre-authentication heap corruption RCE

• Component: libssh2 — client-side C library implementing the SSH2 protocol.
• Severity: Critical (per VERIFIED REFERENCE DATA).
• Mechanism: Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution. The vulnerability is exploitable pre-authentication — no valid credentials required.
• Patch status: A fix has been merged into the libssh2 mainline development branch; maintainers are preparing a release containing the patch. No fixed release version is available at time of writing.
• Expitation: Active exploitation observed (single-sourced via Ethan Andrews / Federal Signal; corroborated by The Register reporting "attackers are already exploiting at least two of these").

CVE-2026-20896 — Gitea self-hosted Docker authentication bypass

• Component: Gitea — self-hosted Git server, Docker deployment specifically.
• Severity: Critical (per VERIFIED REFERENCE DATA).
• Mechanism: Unauthenticated remote attackers can impersonate any user and fully take over the Git server. The vulnerability affects self-hosted Gitea Docker deployments.
• Patch status: Fixed in Gitea 1.26.3.
• Expitation: Active exploitation observed (same sourcing as above).

Attack chain — Gitea Docker auth bypass (CVE-2026-20896)

1. Attacker identifies internet-exposed self-hosted Gitea Docker instance (common on development infrastructure, CI/CD pipelines).
2. Attacker sends unauthenticated request exploiting the authentication bypass to impersonate an administrative user.
3. With admin-level access, attacker can modify repository contents, inject malicious code into CI/CD pipelines, create new admin accounts for persistence, or access all private repository data.
4. Lateral movement: compromised Gitea can serve as a pivot point — malicious commits/PRs injected into repositories that are pulled and built by developer workstations or CI/CD runners, enabling downstream code execution.

Attack chain — libssh2 pre-auth RCE (CVE-2026-55200)

1. Attident identifies service incorporating libssh2 (SSH clients, SFTP tools, automated SSH libraries, custom integrations).
2. Attacker sends crafted SSH packet with excessively large packet_length value to the libssh2-consuming service.
3. Heap memory corruption occurs, enabling attacker to achieve remote code execution in the context of the process using libssh2.
4. No authentication required — exploitation occurs before the SSH handshake completes credential exchange.

Additional vulnerabilities (confirmed CVEs, details not fully sourced)

The source reports nine vulnerabilities have received official CVE identifiers. Beyond CVE-2026-55200 and CVE-2026-20896, the specific CVE identifiers, affected components, and technical details for the remaining seven are not available in the provided source material. The 15 impacted projects are: Linux kernel, libssh2, AnyDesk, FFmpeg, Gogs, Gitea, Ghidra, 7-Zip, MyBB, PHP, OpenVPN, VLC, Splunk, RustDesk, c-ares, and Floci.

Unconfirmed / single-sourced claims

• Attribution to "Bikini": No MITRE ATT&CK profile exists for this actor. Attribution is unconfirmed — Bikini is an anonymous pseudonym with no verified identity.
• AI-assisted fuzzing claim: Bikini claims to have used OpenAI's GPT-5.5-3-Codex-Spark model for fuzzing. This is self-reported and unverified. The Register explicitly states it "has not verified these claims or that the code works."
• Active exploitation of two CVEs: Corroborated by The Register ("attackers are already exploiting at least two of these") and Ethan Andrews (Federal Signal), who wrote that the libssh2 and Gitea findings "have been independently verified as high-risk with active exploitation observed." Single-sourced to Andrews for the "independently verified" claim; The Register corroborates active exploitation but does not name a verifier.
• Community dismissal of some findings: Andrews noted some exploitarium disclosures "have been dismissed by the community as low-impact AI-fuzzing noise" — single-sourced.
• 44 KQL detection rules: Built by Ethan Andrews covering the full exploitarium repo. Not reviewed by Adverse Trace; availability and quality unconfirmed.

4. Mitigation & containment

P1 — Within 24 hours

1. Gitea (CVE-2026-20896): Upgrade all self-hosted Gitea Docker deployments to version 1.26.3 immediately. Identify all instances via asset inventory: search for Docker containers running gitea/gitea images, check for Gitea on standard ports (3000, 22 for SSH). Command: docker ps | grep gitea and docker images | grep gitea.
2. Gitea interim containment: If upgrade to 1.26.3 cannot be completed within 24h, restrict network access to Gitea instances — block all external access at WAF/firewall, allow only from internal VPN/bastion IPs. Disable the Docker deployment temporarily if it hosts critical repositories.
3. libssh2 (CVE-2026-55200): Identify all services incorporating libssh2. No fixed release is available yet (patch is in mainline dev branch only). Containment: restrict network exposure of any service using libssh2 to trusted networks only. If the service is internet-facing, place behind a reverse proxy or VPN gateway. Monitor for anomalous SSH connection attempts with oversized packet data.
4. Asset discovery: Inventory all 15 affected products across the estate: Linux kernel, libssh2, AnyDesk, FFmpeg, Gogs, Gitea, Ghidra, 7-Zip, MyBB, PHP, OpenVPN, VLC, Splunk, RustDesk, c-ares, Floci. Prioritize internet-facing and production-critical instances.

P2 — Within 72 hours

1. libssh2: For services where source compilation is feasible, pull the mainline development branch containing the merged fix and rebuild. For packaged/library dependencies, contact the upstream package maintainer (e.g., distro package manager) to check for backported patches. Track the libssh2 release announcement for the first patched release.
2. Gitea: Verify all instances upgraded to 1.26.3. Audit Gitea access logs for signs of exploitation: unauthenticated admin actions, new admin account creation, unexpected repository modifications. Review: gitea.log, access logs, and audit logs.
3. EDR/network monitoring: Deploy detection rules for SSH packets with abnormally large packet_length values targeting libssh2 services. Monitor for unauthenticated access to Gitea administrative endpoints.
4. Review Ethan Andrews' 44 KQL rules (if obtainable) and adapt to your SIEM stack. Treat as unverified — test in detection-only mode before enforcement.

P3 — Within 7 days

1. Monitor for remaining CVE disclosures: Track the nine confirmed CVEs and any additional disclosures Bikini has promised. Establish a watch on GitHub repositories for the affected projects' security advisories.
2. Patch all remaining affected products as upstream fixes become available. Prioritize by exposure: internet-facing > production internal > developer workstations.
3. Review supply chain: For any product using libssh2 as a transitive dependency (common in SSH tooling, SFTP clients, automation frameworks), trace dependency trees and flag for patching when the fixed libssh2 release lands.
4. Threat hunt: Search for indicators of pre-expitation reconnaissance against Gitea and libssh2 services — anomalous SSH handshakes, unexpected user-agent patterns against Gitea web endpoints, failed authentication spikes.

5. Indicators of compromise

No specific IOCs (IPs, domains, hashes, mutex names, file paths) are present in the source material. The sources describe vulnerability classes and exploitation techniques but do not provide concrete artefact values.

Confidence caveat: IOC development for this item requires direct analysis of the PoC code from the (now-removed) exploitarium repository or network telemetry from observed exploitation. Neither is available in the provided sources. Single-sourced; verify before enforcement.

6. Detection

The sources provide usable technical detail for detection rule construction: the libssh2 vulnerability mechanism (crafted SSH packets with excessively large packet_length values) and the Gitea authentication bypass (unauthenticated access to administrative functions on Docker deployments).

rule Exploitarium_PoC_Artifacts {
  meta:
    author = "Adverse Trace"
    date = "2026-07-01"
    description = "Detection for PoC artefacts from Bikini exploitarium zero-day dump — covers libssh2 and Gitea exploit patterns"
    reference = "https://www.theregister.com/security/2026/06/29/anonymous-researcher-drops-0-day-exploitarium-repo/5263961"
  strings:
    $exploitarium = "exploitarium" nocase
    $exploratorium = "Exploratorium" nocase
    $bikini = "bikini" nocase
    $libssh2_pkt = "packet_length" nocase
    $gitea_docker = "gitea/gitea" nocase
    $gogs = "Gogs" nocase
    $gpt_codex = "GPT-5.5" nocase
  condition:
    3 of them
}

title: Gitea Docker Authentication Bypass - Unauthenticated Admin Access
id: adtrace-2026-07-01-212-gitea-auth-bypass
status: experimental
description: Detects potential exploitation of CVE-2026-20896 - unauthenticated access to Gitea Docker admin endpoints
author: Adverse Trace
date: 2026/07/01
references:

  - https://www.theregister.com/security/2026/06/29/anonymous-researcher-drops-0-day-exploitarium-repo/5263961
logsource:
  product: gitea
  service: access
detection:
  selection:
    http.request.method:

      - GET
      - POST
    http.request.path|contains:

      - "/admin"
      - "/user/settings"
      - "/api/v1/admin"
    http.request.user|isempty: true
  filter:
    http.status_code:

      - 401
      - 403
  condition: selection and not filter
falsepositives:

  - Legitimate unauthenticated access to public Gitea pages (filter by admin-specific paths)
  - Health check probes configured without authentication
level: critical

title: libssh2 Pre-Auth RCE - Oversized SSH Packet Length
id: adtrace-2026-07-01-212-libssh2-rce
status: experimental
description: Detects potential exploitation of CVE-2026-55200 - crafted SSH packets with excessively large packet_length values targeting libssh2
author: Adverse Trace
date: 2026/07/01
references:

  - https://www.theregister.com/security/2026/06/29/anonymous-researcher-drops-0-day-exploitarium-repo/5263961
logsource:
  product: network
  service: ssh
detection:
  selection:
    network.protocol: ssh
    network.packet.length: ">65535"
  condition: selection
falsepositives:

  - Misconfigured SSH clients with non-standard packet sizes
  - SSH protocol fuzzing in authorised security testing
level: critical

7. Sources

• Risky Bulletin — "Researcher drops giant cache of zero-day exploits" — https://news.risky.biz/risky-bulletin-researcher-drops-giant-cache-of-zero-day-exploits/ — 2026-07-01
• The Register — "Anonymous researcher drops 0-day 'exploitarium' repo" — https://www.theregister.com/security/2026/06/29/anonymous-researcher-drops-0-day-exploitarium-repo/5263961 — 2026-06-29

8. Adverse Trace position

This item carries critical severity for EMEA financial services. Two confirmed critical CVEs with active exploitation — a pre-auth RCE in libssh2 (no patch release available) and an authentication bypass in Gitea Docker (patched in 1.26.3) — demand immediate action. The broader dump of 15 affected projects with nine confirmed CVEs and promised additional disclosures creates sustained exposure risk, particularly for institutions with large open-source dependency footprints. Attribution to "Bikini" is unconfirmed (no MITRE ATT&CK profile; anonymous pseudonym). The claim of AI-assisted fuzzing is self-reported and unverified. Active exploitation of the two critical CVEs is corroborated by The Register and Ethan Andrews (Federal Signal) but the "independently verified" language is single-sourced to Andrews — verify before treating as fully confirmed. Adverse Trace will monitor for the libssh2 patched release, additional CVE disclosures from Bikini, and any emerging IOCs from observed exploitation. We will issue a follow-up advisory if the promised additional zero-day disclosures materialize or if concrete exploitation IOCs become available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.