Four posts in, I keep circling the same idea from new angles: security is a bet about what is scarce and what you are allowed to trust. My first two posts were about boundaries that turned out to be assumptions; the third was about my own telemetry becoming an input an attacker could write to. In the first week of July 2026, two unrelated disclosures landed within a day of each other, and together they broke an assumption I did not know I was still making: that finding a vulnerability is expensive.
On 1 July, Risky Business reported that an anonymous researcher using the handle Bikini had published proof-of-concept exploits and write-ups for more than a dozen zero-days across 15 software projects — a list that reads like an inventory of the internet’s load-bearing code: the Linux kernel, libssh2, FFmpeg, OpenVPN, PHP, 7-Zip, VLC, Gitea, AnyDesk. Nine already carried official CVE IDs; the repository’s own notes listed more. They were published with zero vendor notification, the GitHub repo was taken down twice over one weekend and kept reappearing, and Bikini promised more were coming. The tell was not the exploits. It was the caption. The bugs were surfaced with AI-assisted fuzzing, and in Bikini’s own words, “You do NOT need a SOTA model to help you identify these issues, I promise!”
Everyone read this as “AI finds bugs faster.” The read that stuck with me is colder. Coordinated disclosure, the 90-day truce we treat as professional ethics, has an economic layer underneath it. I want to be careful here, because the norm also exists for a duller reason: writing, testing and shipping a patch takes time, and that does not change when finding bugs gets cheap. What does change is the researcher’s side of the bargain. It worked because vulnerabilities were scarce and expensive to find, so a researcher who found one held leverage, and a grace period was a fair trade for it. Cheapen discovery to a weekend hobby with weekly refills and the truce does not become unethical. It becomes something a researcher can walk away from at no cost. The bottleneck moves. When bugs are effectively infinite, the scarce resource is no longer the bug. It is attention.
Which is exactly what the second disclosure weaponised. The same day, Sekoia and YesWeHack published “Don’t eat the ChocoPoCs”: at least seven GitHub repositories posing as exploits for freshly-hyped CVEs — FortiWeb, PAN-OS, Ivanti Sentry, Check Point VPN, and more. The trick is the part that made me put my coffee down. The malware was not in the exploit file. Reviewing the PoC code, the thing a careful analyst does first, was theatre. The payload rode in the dependency list: the PoC quietly pulled a trojanised PyPI package (frint, which pulled skytext) carrying a compiled native extension, and its command-and-control was a legitimate Mapbox dataset URL that sails through every domain allowlist. In Sekoia’s words, “by hiding malware in transitive dependencies, attackers can keep the visible PoC almost entirely benign.” As I write this, the package is still live on PyPI with a download counter past 2,500. I would not lean on that number. PyPI counts are dominated by mirrors and CI, and 2,500 is close to background noise; it shows the package is still reachable, not that it is spreading.
Put the two together and you get the inversion I cannot stop thinking about. If bugs are infinite and free, the one resource an attacker still cannot manufacture is a defender’s urgency, and a fresh CVE generates it on demand. The people guaranteed to download and run a brand-new exploit within 24 hours of disclosure are not the attackers. It is us. Blue teams, researchers, students like me, racing to “verify exploitability” in a lab because that is what diligence looks like. ChocoPoC did not defeat that diligence; it subscribed to it. The patch-panic loop, the very reflex we train as the mark of a mature security program, became a delivery mechanism. Your vulnerability-management maturity is the exploit.
There is a smaller, sharper version of the same joke hiding in Bikini’s list. Ghidra, 7-Zip, FFmpeg and VLC are not simply popular apps. They are the tools that sit on the malware analyst’s own triage box. The software most likely to be running while someone dissects a fresh drop is the software the drop targets. My last post ended on the realisation that my logs, the thing I read in order to defend, had become an input an attacker could write to. This is the same shape, one level up: the act of defending, meaning analysing and verifying and patching fast, is now the attack surface, and the tools I would reach for to investigate are on the list.
If speed itself is the trap, the answer is not to slow down. Not slow down, which just hands the window to the attackers who did automate. You change what “analyse” means. Treat every PoC as hostile code, not documentation: detonate it in a disposable, network-isolated VM you throw away, never on the workbench, and treat its dependency tree as the real payload, because reading the top-level file proves nothing. Stop trusting “it came from a reputable domain”; ChocoPoC’s command channel was Mapbox, and the confused-deputy lesson from my AutoJack post applies to your allowlist too. And accept the uncomfortable macro-truth: with disclosure economics broken, the window after a fixed “patch Tuesday” is worth more than it used to be. Exploit Wednesday is twenty years old and I am not claiming to have found it. What changed is the supply: the same cadence used to gate a trickle, and now it gates a firehose. Faster, smaller, more automated patching is no longer a nice-to-have; it is the only lever that still moves.
None of this needed a new idea to understand. It needed the willingness to ask which of my assumptions was quietly load-bearing. I had assumed bugs were scarce. AI ended that, and the moment it did, the attacker’s best distribution channel became the security team’s own sense of urgency. Four posts in, the pattern I keep finding is the same: the dangerous thing is never the new capability. It is the old habit the new capability turns inside out.
Sources / Nguồn:
- Risky Business — “Researcher drops giant cache of zero-day exploits” (1 Jul 2026): news.risky.biz
- Sekoia TDR + YesWeHack — “Don’t eat the ChocoPoCs” (1 Jul 2026): sekoia.com
- BleepingComputer — ChocoPoC coverage (1 Jul 2026): bleepingcomputer.com
- “skytext” download stats on PyPI (via pepy.tech): pepy.tech
- Background on prompt-injection & the confused-deputy problem — Simon Willison: simonwillison.net
Note: the two July disclosures are independent; the connection drawn here — that broken disclosure economics turn the defender’s own urgency into the attack surface — is my own reading, not a claim made by either source. Links to the live malicious repositories are deliberately omitted.