Gone in 35 Minutes: Hackers are turning public research into active exploits faster than ever

According to new research published by cyber security firm CrowdStrike overnight, 91 per cent of vulnerabilities with public proof-of-concept code are being exploited within just 48 hours of publication.

“Public vulnerability research (security advisories, technical blogs, scanning templates, and POC and exploit code) is available to everyone, including adversaries,” CrowdStrike said in a blog post.

“The data from the first half of 2026 makes clear how threat actors are using it. Analysing in-the-wild exploitation CrowdStrike has observed between January and July 2026, the median time from when a vulnerability had a public POC to when threat actors exploited it was less than one day, with the fastest observed exploitation after a public POC being 35 minutes.”

By way of example, CrowdStrike outlined the POC-to-exploit path of CVE-2026-41940, an authentication bypass vulnerability in the popular web hosting control panel cPanel, which was disclosed by the company on April 28 this year, and which was later the subject of an ACSC Critical Alert.

By April 29, fellow cyber security firm WatchTowr published a blog outlining exploitation guidance for the vulnerability alongside a detection artifact generator.

“CrowdStrike Counter Adversary Operations analysed the purported detection-artifact generator and determined that it simply requires a minor modification. Attackers need only to un-comment a line of code that changes the root password, and then the attacker can log in to the WHM terminal as the root user, essentially making the purported detection-artifact generator a weaponised exploit,” CrowdStrike said.

VIEW ALL

“On April 30, 2026, CrowdStrike Counter Adversary Operations began to observe widespread and opportunistic exploitation of CVE-2026-41940. Most if not all of the observed exploitation matched the exploitation guidance provided in the technical blog and/or purported detection artifact generator.”

Industry reporting on the vulnerability later in the year was also seen to drive an uptick in its exploitation by multiple threat actors, in some cases with more than one seeking to compromise the same instances.

And while AI is clearly driving skyrocketing disclosure rates, but it’s also aiding the bad guys, CrowdStrike contends. They’re attempting to jailbreak AI safeguards and export controls, modifying open-weight models for malicious purposes, and, relatedly, taking full advantage of the tsunami of vulnerabilities swamping security teams.

“Adversaries will almost certainly continue using public vulnerability research as part of their offensive toolkit through the foreseeable future,” CrowdStrike said.

“As more POC exploits become routinely available within hours of disclosure, at least partially driven by AI-assisted vulnerability research, the number of threat actors using them will almost certainly increase.”

This increase in both speed and capacity, CrowdStrike says, reinforces three key points.

Patch prioritisation is becoming more difficult as disclosures increase, making real-world exploitability, POC availability, and adversary intent more useful indicators than CVSS scores alone.

The window for patching is also shrinking

“Adversaries treat public vulnerability research as the starting gun, and legacy patch cycles measured in weeks or days cannot compete,” CrowdStrike said.

Finally, publicly available exploit research is enabling more threat actors, regardless of technical capability, to weaponise vulnerabilities, often with minimal modification. This is increasing the pool of potential attackers and putting further pressure on organisations to accelerate vulnerability detection and remediation.

“The vulnerability research ecosystem is one of the security community's greatest assets and most significant challenges,” the company said in conclusion.

“Defenders who treat public research as a threat actor's green light, and who build the intelligence, patching timelines, and detection capabilities to match, are the ones who will keep pace.”