0day.today

0day.today
Name	0day.today
Type	Forum; Exploit Marketplace; Vulnerability Database
Owner	Undisclosed
Registration	Required for full access
Language	English; Russian
Launch date	2018 (approx.)
Current status	Active

0day.today 0day.today is an online forum and marketplace focused on software vulnerabilities, exploit code, and cybersecurity research. It operates as a repository and trading platform where security researchers, penetration testers, and criminal actors have been reported to exchange information about zero-day vulnerabilities, proof-of-concept code, and proof-of-concept exploits. The site has been noted in reporting alongside other forums and markets involved in vulnerability trading, cybersecurity disclosure, and cybercrime investigations.

Overview

0day.today functions as a hybrid platform combining elements of a bulletin board, vulnerability database, and private marketplace. In format it resembles historical platforms such as Exploit Database, Full-Disclosure, Bugtraq (mailing list), and contemporary closed markets like Zerodium, Hacking Team, SpyCloud, and Endless Horizon. The site lists exploits affecting widely used products from vendors including Microsoft Corporation, Google (company), Apple Inc., Adobe Inc., Oracle Corporation, Cisco Systems, VMware, Inc., and Linux kernel. Its participants have included researchers associated with institutions and projects like MIT, Carnegie Mellon University, Stanford University, University of Cambridge, Kaspersky Lab, ESET, Trend Micro, and independent contractors formerly employed by firms such as CrowdStrike, FireEye, Symantec Corporation, and McAfee.

History and Development

0day.today emerged in the late 2010s amid a proliferating ecosystem of vulnerability markets, preceding or contemporaneous with actors documented in investigations of Equation Group, Shadow Brokers, Vault7, and other major leaks. Its development reflects trends in the commercialization of exploit acquisition traced to firms like VUPEN and Hacking Team, and to bounty programs run by HackerOne and Bugcrowd. Over time the site folded in features seen on bulletin boards such as Wilders Security Forums and Stack Exchange-style Q&A, while adopting marketplace mechanics similar to AlphaBay and Silk Road for membership tiers and escrow-like reputation systems. Reporting by outlets that have covered Krebs on Security, The New York Times, Wired, The Guardian, and BleepingComputer has linked the platform to broader debates around responsible disclosure and clandestine trade.

Services and Features

The platform provides categorized listings of exploits, advisories, and proof-of-concept code for products from vendors such as Microsoft Corporation, Google (company), Apple Inc., Adobe Inc., Oracle Corporation, VMware, Inc., Samsung Electronics, Huawei, Intel Corporation, and AMD. Features include searchable indices, tagging systems akin to Common Vulnerabilities and Exposures, reputation scores, private messaging, and paid access tiers comparable to commercial services like Zerodium and Bishop Fox. Listings frequently reference specific software components associated with projects such as OpenSSL, Apache HTTP Server, nginx, Drupal, WordPress, and Joomla!, and mobile platforms like Android (operating system) and iOS. The site also hosts discussion threads reminiscent of those on Reddit communities and specialist forums such as Stack Overflow for technical exchange, and provides translation and multilingual support intersecting with Russian-language security communities like Kremlin-related media and independent Russian-speaking research groups.

Community and Membership

Membership models mix free accounts with paid subscription tiers granting earlier access to listings or private sections, similar to models used by Zerodium, HackerOne, and commercial threat intelligence providers including Recorded Future and FireEye (company). Community participants range from independent security researchers, bug bounty hunters who have published on platforms like HackerOne and Bugcrowd, to consultants formerly affiliated with firms such as Palo Alto Networks, Check Point Software Technologies, and Cisco Systems. The social structure shows parallels with closed researcher collectives documented in cases involving Equation Group and Shadow Brokers, and moderated threads resemble organization in long-running lists like Full-Disclosure and Bugtraq (mailing list).

Security, Legal Issues, and Controversies

The platform has been embroiled in controversy due to the sale and dissemination of exploits that can be weaponized by criminal or state-aligned actors. Law enforcement agencies including Federal Bureau of Investigation, Europol, and national computer emergency response teams such as US-CERT and CERT-EU have investigated underground markets and vulnerability leakages that involve sites similar to 0day.today. Journalistic exposés in The New York Times, BBC News, Wired, and The Guardian have raised concerns about the ethics of monetizing zero-day vulnerabilities, paralleling debates over disclosures by Edward Snowden and leaks attributed to groups like Anonymous (hacker group). Legal frameworks including United States Computer Fraud and Abuse Act, Council of Europe Convention on Cybercrime, and national export control regimes have shaped enforcement actions against markets trading exploits, though attribution and cross-border jurisdiction remain challenging.

Reception and Impact on Vulnerability Disclosure

Security researchers and vendors have described the presence of markets like this as both a source of risk and a data point in debates over coordinated vulnerability disclosure, as seen in exchanges involving Microsoft Security Response Center, Google Project Zero, Apple Security Bounty, and industry coalitions such as FIRST (organization). Advocacy groups and standards bodies including Electronic Frontier Foundation, Internet Engineering Task Force, and ISO/IEC committees have engaged with policy questions influenced by exploit marketplaces. Critics argue that such platforms undermine vendor patching cycles and incident response efforts at organizations like Target Corporation, Equifax, SolarWinds, Yahoo!, and Sony Pictures Entertainment. Proponents of tighter regulation point to cooperative programs run by HackerOne, Bugcrowd, and corporate security teams to reduce reliance on clandestine markets for vulnerability discovery.

Category:Computer security