exploit-garbage/0day-rubbishRedefining vulnerability disclosure in the AI era. We mass-produce exploitable 0days and disclose them directly, using event-driven pressure to elevate vendor security standards and advance the field.
0day vulnerabilities have become rubbish in the AI era.
🌐 Official Website: https://0day-rubbish.com/blog
Traditional vulnerability disclosure is broken. It's slow, bureaucratic, and ineffective. In the AI era, we can mass-produce 0days at scale—making individual vulnerabilities less valuable but more impactful when disclosed directly.
We believe event-driven security hardening is the most effective approach: only when vendors face real, exploitable threats do they prioritize fixes.
Our automated AI systems continuously scan for vulnerabilities across real-world software, identifying potential 0-days through pattern analysis, fuzzing, and intelligent code review.
Each finding undergoes manual validation. We develop working proof-of-concept exploits to confirm exploitability and assess real-world impact.
Every week — Monday or Tuesday — we disclose a new batch of verified, exploitable 0-day vulnerabilities we've discovered and validated:
No delays. No bureaucracy. Just facts.
To all vendors: We hope you can complete fixes before hackers exploit these vulnerabilities.
We partner with:
Our automated vulnerability discovery leverages cutting-edge large language models from leading AI providers:
An AI-driven research process (multi-LLM ensemble: Claude, OpenAI, DeepSeek, GLM, Kimi) discovers 0-days in real-world enterprise software. Every advisory below ships a full root-cause analysis plus a working, reproducible exploit script — no detection-only writeups, no withheld details.
Execution surfaces that trust their own operators and their own configuration: a license gate that compares a raw request URI instead of the routed path and then issues an administrative principal to a caller holding no credential, a database that ships its own system password and offers a scripting language to whoever holds it, a render farm whose job manager performs no identity check unless somebody switches one on, a firmware upgrade that is executed without ever being verified, and two appliances whose management forms format one user-supplied field straight into a shell. None of the seven needed a memory-corruption bug or a novel primitive. Each is a product doing precisely what it was written to do, with one check missing.
