7-Zip

An anonymous repo dropped dozens of exploits at once, neatly documented, daring readers to report them for credit. The framing — a flood of fresh 0-days — set off the usual alarm.

Then people who reverse-engineer for a living read the code: most aren't 0-days at all, several aren't even vulnerabilities. One reviewer found a "7-Zip exploit" that only proves the parser is reachable. The unsettling part isn't the bugs — it's who, or what, is generating them at scale.