Anonymous GitHub account mass-dropping undisclosed 0-days

Original Article ↗ Hacker News Discussion ↗

Scope and quality of the exploits

  • Many readers inspect specific PoCs (Ghidra, Docker, VLC, c-ares, libssh2, FFmpeg, PHP, nmap, Gitea) and find a wide mix:
    • Some appear genuinely serious (e.g., c-ares UAF, libssh2, FFmpeg RCE, some nmap parsing issues, certain Rustdesk / logic bugs).
    • Others are trivial, misclassified, or require already-dangerous conditions (overwriting binaries on disk, having PHP code execution already, test-only code, crash-only cases).
  • Several note that “RCE” is sometimes used loosely (e.g., SSH root session, or “code execution leads to code execution”), and that many items look more like generic bugs than high-impact vulns.

What counts as a “0‑day”

  • Disagreement over definition:
    • One camp: “0‑day” means “exploited in the wild before vendor or public knew.”
    • Another: “0‑day exploit” refers to an exploit available while the vendor has had zero days to patch; “0‑day vulnerability” is then any vuln affected by such an exploit.
  • Some argue the term is being inflated and overused to mean “any unpublished bug.”

LLMs, fuzzing, and automation

  • Strong suspicion that an LLM or automated harness generated many of the findings, given the volume, style, and mixture of good and bad results.
  • Some claim current strong models can already find large numbers of real bugs; others complain AI-driven reports often overstate severity or flag non-issues.
  • The repo’s updated README (per discussion) claims a custom fuzzing workflow automated by an AI model under a strict harness.

Open source vs security through obscurity

  • One side worries that open code plus LLMs makes mass exploit discovery too easy and revives interest in “security through obscurity.”
  • Others counter:
    • Attackers can reverse-engineer binaries anyway.
    • Open source benefits from many eyes and AI-assisted auditing.
    • Only one party needs a strong model to harden OSS, while proprietary code pits a single vendor’s tools vs all attackers’ tools.

Disclosure ethics and defender burden

  • Some see mass public dropping of PoCs without vendor notice as irresponsible, arguing users—not maintainers—bear the risk.
  • Others say:
    • Responsible disclosure is too slow, often unrewarded, and sometimes met with legal threats.
    • Public dumps avoid exclusive government/black‑market use and may force better practices (e.g., AI red-teaming before release).
  • Security engineers complain about “noise” from low-severity or AI‑manufactured reports, but acknowledge small bugs can sometimes chain into serious exploit paths.

Broader security context

  • Side discussions cover:
    • Fragility of U.S. SSN/bank-number–based identity and fraud via ACH.
    • Kidnapping/physical risks around crypto holdings.
    • The need to sandbox high-risk parsers (media players, AV engines, network analyzers, CI runners) and to assume tools like nmap, VLC, and Wireshark are high-value targets.