Loading story…
Security researcher Chocapikk has released a curated collection of public exploit repositories targeting a range of unauthenticated remote code execution (RCE) vulnerabilities across various platforms. The collection includes weaponized proof-of-concept (PoC) exploits and Metasploit modules for critical CVEs such as CVE-2025-34152 (Shenzhen Aitemi M300 Wi-Fi Repeater), CVE-2024-31819 (AVideo Platform), CVE-2024-25600 (Bricks), CVE-2023-50917 (MajorDoMo), CVE-2025-32432 (CraftCMS), and others. These tools are designed to facilitate security testing and highlight the risks posed by unpatched systems, with several exploits enabling unauthenticated attackers to gain remote shell access or escalate privileges on vulnerable targets.
The public availability of these exploits increases the urgency for organizations to patch affected systems and monitor for exploitation attempts. Chocapikk's contributions are widely referenced in the security community, with mentions in multiple security news outlets and integration into major exploit frameworks like Metasploit. The release of these tools underscores the ongoing threat posed by rapidly weaponized vulnerabilities and the importance of proactive vulnerability management and detection strategies for enterprise defenders.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Security researchers, including Chocapikk, were credited with discovering and disclosing several of the vulnerabilities referenced in the roundup. The disclosures contributed to public awareness of the affected platforms and associated exploitation risks.
CISA and other organizations warned about active exploitation of some of the vulnerabilities, particularly those affecting Microsoft SharePoint and Atlassian Confluence. These alerts underscored the urgency for organizations to patch and apply mitigations.
During 2024 and 2025, public proof-of-concept exploits and Metasploit modules were released for several of these vulnerabilities, lowering the barrier to exploitation and increasing the likelihood of widespread attacks. The references describe this as accelerating real-world abuse of the flaws.
Throughout 2024 and 2025, multiple critical remote code execution vulnerabilities were discovered and actively exploited in widely used software, including Wing FTP Server, Craft CMS, CyberPanel, Microsoft SharePoint, and Atlassian Confluence. The activity included zero-day exploitation, remote shell access, privilege escalation, and full system compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Public GitHub repositories were flagged for newly published proof-of-concept exploits tied to two high-severity vulnerabilities: **`CVE-2026-34177`**, a VM low-level restriction bypass involving `raw.apparmor` and `raw.qemu.conf`, and **`CVE-2025-7389`**, an unauthorized arbitrary file-read issue via RMI in an AdminServer interface. The monitoring identified repositories advertising exploit code or demonstrations for both flaws, indicating that offensive tradecraft is now publicly accessible. The referenced tracking activity monitors GitHub for exploit and PoC publications, ranks results by most recently updated repositories, and limits visible results to the first 15 entries for performance reasons. For defenders, the appearance of public exploit material raises the urgency of validating exposure to affected virtualization and AdminServer deployments, prioritizing patching or mitigations, and increasing detection coverage for exploitation attempts targeting these CVEs.
Jul 12, 2026
A GitHub repository called **"exploitarium"**, operated by the account **`bikini`**, has published a growing archive of uncoordinated zero-day proof-of-concept exploits affecting dozens of open-source and infrastructure projects before vendors could patch them. Reporting says the archive expanded beyond early public estimates to **35 project folders and 204 tracked files**, with new targets continuing to appear at a pace of roughly two to three projects per week. The exposed attack surface spans libraries, kernel drivers, remote-access tools, web applications, and core infrastructure including **PostgreSQL, Redis, Nextcloud, Discourse, Nmap, curl, AnyDesk, RustDesk, Git,** and some **PHP** builds. Researchers identified **`CVE-2026-55200`** in **libssh2** as one of the most serious issues in the archive: a pre-authentication out-of-bounds write in **`ssh2_transport_read()`** affecting libssh2 through **1.11.1**, with an upstream fix referenced as commit **`97acf3d`**. Because libssh2 is embedded transitively in widely used software such as **curl** and **Git**, the disclosures are being treated as a broader supply-chain exposure rather than a single incident. Assessments describe exploitarium as a lightly moderated multi-contributor clearinghouse that distributes unvetted exploit material at scale, prompting calls for urgent patching, software composition analysis, reachability-based remediation, and sustained monitoring.
Jul 22, 2026
Reports warn of **in-the-wild exploitation** of critical remote code execution vulnerabilities affecting widely deployed enterprise infrastructure. One report describes a purported Cisco Unified Communications zero-day, **CVE-2024-20253**, impacting *Cisco Unified Communications Manager (Unified CM)*, *Cisco Unity Connection*, and *Webex Calling Dedicated Instance*, and claims it enables **unauthenticated command execution** via the web management interface, creating risk of full system compromise and rapid opportunistic scanning of internet-exposed instances. Separately, **CISA added Broadcom VMware vCenter Server CVE-2024-37079** (CVSS 9.8) to the **Known Exploited Vulnerabilities (KEV)** catalog based on evidence of exploitation; the issue is described as a **DCE/RPC heap overflow** that can lead to RCE via specially crafted network packets, and Broadcom updated its advisory to acknowledge observed exploitation. A third item (Rapid7’s Metasploit wrap-up) is not about either of these active-exploitation advisories; it covers new Metasploit modules for unrelated vulnerabilities (e.g., Oracle E-Business Suite **CVE-2025-61882** and Splunk issues), which may increase general exploitation capability but does not substantively corroborate the Cisco or VMware events.
Jun 29, 2026