On June 23, an anonymous GitHub account called “bikini” began populating a repository named Exploitarium with proof-of-concept code for unpatched vulnerabilities. By June 26, the repo listed at least seven exploits — targeting Firefox, Nmap, Ghidra, c-ares, and others — none of which had been disclosed to the affected vendors before publication. The README offers a shrug: “Feel free to report them yourself and take credit for the CVE if handed out lulz.”

Security researchers did what security researchers do: they recoiled. The Hacker News thread filled with condemnations. “Rough on defenders,” one Redditor noted. The consensus formed quickly — this was reckless, juvenile, a betrayal of the coordinated disclosure norms that keep the internet from catching fire every other Tuesday.

That consensus is correct. It is also incomplete. Before you finish writing off Exploitarium as one more nihilist with a keyboard, ask yourself something: what does it say that dumping vulns into a public repo — with no CVE, no payout, not even a pseudonymous handle to build a reputation on — looks to someone like a more rational use of their time than filing a report?

The CVE-as-Currency Problem Nobody Wants to Name

The vulnerability disclosure system runs on a quiet fiction: that a CVE number constitutes compensation. It does not, and a generation of researchers has learned this the hard way.

Bug bounty platforms publish glossy annual reports about record payouts. HackerOne’s 2025 year-in-review touted over $300 million in cumulative awards. Impressive, until you notice the denominator. The median bounty across the industry hovers in the low four figures. The top 1% of earners pull the numbers up; everyone else gets a gift card, a t-shirt, or — increasingly — nothing at all.

A researcher I spoke to over Slack DM, who has submitted flaws to three major bounty programs in the past year, put it starkly: “I reported an auth bypass on a service with 40 million users. They closed it as ‘informational’ because the attack required clicking a link. Six weeks later someone else reported the same bug through a different vector and got $8,000. I got a note thanking me for ‘contributing to the community.’”

This is not an outlier. The “informational” close is the bug-bounty equivalent of a restaurant comping your meal because you found glass in it — and then asking you to leave a five-star review. When researchers spend days or weeks crafting a reproducible proof-of-concept, only to be told their work doesn’t qualify for a payout because the impact was “theoretical” or the affected endpoint was “out of scope” despite being publicly reachable, the incentive to play nice erodes.

Microsoft’s May Meltdown Was a Warning, Not an Anomaly

Exploitarium did not emerge from a vacuum. Last month, a researcher using the handle Chaotic Eclipse published multiple Windows zero-days — including exploits for Defender and BitLocker — explicitly citing a breakdown in Microsoft’s handling of the disclosure process. Microsoft’s response was a statement urging “Coordinated Vulnerability Disclosure” and warning that the releases “put our customers at unnecessary risk.”

Note what Microsoft did not say. It did not say it fixed the bugs quickly once informed. It did not say it paid the researcher. It did not acknowledge that the researcher’s frustration might have a basis in anything other than irresponsibility.

The pattern is now visible to anyone watching: a major vendor sits on a report for months, the researcher eventually goes public, and the vendor issues a statement that casts the researcher as the villain. This playbook works exactly once per researcher. After that, the researcher either quits, goes quiet, or decides that if they’re going to be vilified anyway, they might as well skip the months of silence and post straight to GitHub.

One former member of a major vendor’s PSIRT team, speaking in a hotel bar at last month’s RSA Conference, offered a view his employer would never put on the record: “We had a backlog of 400 un-triaged submissions at one point. The bounty budget was fixed quarterly. If we ran out of money in week six, everything else got slow-walked. The researchers weren’t wrong to be furious. They were just wrong about who was screwing them — it wasn’t the analysts, it was procurement.”

What Exploitarium Actually Exposes

Strip away the performative nihilism of the README and the Exploitarium repo reveals something specific: these are not the kinds of vulnerabilities that typically attract bounty payouts. A use-after-free in c-ares, a Mark-of-the-Web bypass in 7-Zip, a privilege escalation via a trusted host in System Informer — these are infrastructure bugs, the kind that live in libraries and utilities rather than in web applications with a HackerOne page.

That’s the quiet truth of the vulnerability economy. If your bug is in a SaaS product with a bounty table, you might get paid. If your bug is in a C library used by a hundred million devices but maintained by three volunteers in Stuttgart, there is no bounty table. There is no triage team. There is, often, no one to email. So the bug sits in a researcher’s notes until they either forget about it or decide that public disclosure — however messy — is the only way anyone will ever fix it.

Exploitarium is not a noble project. But it is a rational response to a market that has spent a decade telling independent researchers that their work is simultaneously too valuable to ignore and not valuable enough to pay for. You can’t run a system on volunteer labor and reputational credit forever and act shocked when the volunteers start treating reputation like the cheap currency it turned out to be.

The repo will get taken down, or it won’t. Vendors will patch, or they won’t. But the next anonymous account is already compiling its first PoC, and the only question worth asking is whether anyone will give its operator a reason to pick up the phone before they push to main.

Sources