bikini

bikini is an anonymous security researcher persona associated with the uncoordinated public release of working zero-day exploit code affecting multiple software products and open-source projects. The activity is notable for publishing exploit material without prior vendor or maintainer notification, increasing immediate defensive pressure on exposed organizations. Reported disclosures included high-risk vulnerabilities such as a pre-authentication remote code execution flaw in libssh2 and an authentication bypass affecting self-hosted Docker deployments of Gitea, both described as under active exploitation at the time. The activity aligns with exploitation of public-facing applications and related vulnerability research and weaponization workflows. Reported capabilities evidenced by the disclosures include initial access through exploitation, privilege-escalation-related exploit publication, and credential- or identity-compromise-related exploit publication via authentication bypass. The persona has also been discussed in connection with potentially automated fuzzing and vulnerability discovery, although automation details are not established at high confidence. Available information supports characterization of bikini as an anonymous exploit publisher or researcher persona rather than a clearly established intrusion set, ransomware operation, or nation-state threat actor. Attribution to any country, operational cluster, or enduring sub-group is not currently available at high confidence. The label "Nightmare Eclipse" appears in the broader reporting context, but a confirmed alias or organizational relationship is not established at high confidence.