Anonymous account mass-drops AI-fuzzed 0-days for libssh2, FFmpeg, c-ares and more

An anonymous GitHub user has consolidated a dozen standalone proof-of-concept repositories into a single archive of vulnerability research, publishing exploits against a broad range of widely used software including libssh2 (CVE-2026-55200), FFmpeg, c-ares, nghttp2, nmap, PHP, Firefox, RustDesk, SystemInformer, and the Floci API gateway. The bug classes span memory-safety issues like out-of-bounds writes and use-after-frees through to remote code execution. The author frames the work as good-faith open disclosure meant to draw newcomers into vulnerability research, credits another researcher who independently found one of the same bugs, and documents the consolidation with Git blob-level verification—96 tracked files across 12 repos, checked for identical object IDs.

The more notable angle is methodology. The researcher says the entire fuzzing pipeline was automated by an AI coding model wrapped in a custom harness, and argues that a state-of-the-art model is only marginally better than a cheaper one when paired with a well-built harness and competent human oversight. They push back on the assumption that this is just an amateur burning API tokens, claiming an academic background and published papers on fuzzing methodology, and stress that the PoCs themselves were hand-written rather than generated—only the README files and some RustDesk work leaned on AI.

The drop highlights two ongoing tensions in security: the wisdom of publicly releasing working exploits with no clear coordinated-disclosure timeline, and the degree to which cheap, AI-driven fuzzing harnesses are lowering the barrier to finding real bugs in mature, heavily audited projects. Whether vendors were notified before publication is unclear, which is the part defenders will care about most.