Security researchers publish exploit code to help defenders understand vulnerabilities. Attackers are reading the same instructions, and some are putting them to work before security teams can finish assessing the risk.
In one case, hackers exploited a vulnerability just 35 minutes after public proof-of-concept (PoC) code became available, according to new research from CrowdStrike.
The cybersecurity company found that 91% of vulnerabilities with public PoCs that it observed being exploited between January and July 2026 were attacked within 48 hours of PoC publication. The median time to exploitation was less than one day.
The findings, published November 5, highlight a growing challenge for security teams: publicly available vulnerability research can accelerate attacks against systems that have not yet been patched.
- CrowdStrike finds exploitation begins within hours
- cPanel flaw shows how public research can accelerate attacks
- Belarus-linked hackers adapted Linux exploit within a day
- Iran-linked actor found with modified Fortinet exploit
- AI could make exploit development faster
- What security teams should do when patch windows shrink
- Public vulnerability research creates a security trade-off
CrowdStrike finds exploitation begins within hours
In its analysis of vulnerability weaponization timelines, CrowdStrike examined exploitation observed by its Counter Adversary Operations team between January and July 2026.
The company reported three key findings:
Finding | CrowdStrike observation |
| Fastest observed exploitation | 35 minutes after public PoC release |
| Median time to exploitation | Less than 24 hours |
| Exploitation within 48 hours | 91% of observed exploited vulnerabilities with public PoCs |
The figures apply to vulnerabilities CrowdStrike observed attackers exploiting and for which public PoCs were available. They do not mean 91% of all disclosed vulnerabilities were exploited.
CrowdStrike's earlier 2026 Threat Hunting Report found that 88% of observed exploited vulnerabilities with public PoCs were attacked within 48 hours during January through June.
The newer analysis extends that observation period through July.
According to CrowdStrike, public security advisories, technical write-ups, scanning tools, and exploit examples can reduce the effort required to develop attacks.
Less experienced attackers can adapt existing code, while more capable groups can use published research to accelerate their operations.
Three cases involving cPanel, Linux, and Fortinet products illustrate how attackers are putting that information to use.
cPanel flaw shows how public research can accelerate attacks
The first case involved CVE-2026-41940, an authentication bypass vulnerability affecting certain versions of cPanel, WebHost Manager (WHM), and WordPress Squared.
The flaw could allow an unauthenticated remote attacker to gain unauthorized access to affected control panels.
CrowdStrike documented the following timeline:
Date | What happened |
| April 3 | Earliest suspected exploitation identified through retrospective investigation |
| April 28 | cPanel publicly disclosed CVE-2026-41940 |
| April 29 | Researchers published technical exploitation guidance and a detection-artifact generator |
| April 30 | CrowdStrike began observing widespread opportunistic exploitation |
CrowdStrike analyzed the publicly released detection-artifact generator and found that a minor code change could turn it into a working exploit.
The modified code could change the root password, allowing an attacker to access the WHM terminal with root privileges.
The company said most, if not all, of the exploitation it subsequently observed followed techniques described in the published research.
However, its retrospective investigation also found evidence that a single attacker had likely been exploiting the vulnerability as a zero-day since at least April 3.
CrowdStrike did not determine how that attacker originally discovered the flaw or obtained an exploit.
The distinction is important. Public disclosure did not necessarily trigger the first attack, but CrowdStrike's findings suggest the subsequent technical publication helped expand exploitation.
The company reported that multiple threat actors sometimes targeted the same vulnerable cPanel systems, creating competition for access.
Belarus-linked hackers adapted Linux exploit within a day
The second case involved CopyFail, tracked as CVE-2026-31431, a Linux local privilege escalation vulnerability.
Researchers published technical details and PoC code on April 29.
Although the flaw had already been patched in the mainline Linux kernel, CrowdStrike said many major Linux distributions had not yet received fixes.
Its researchers confirmed that the exploit worked against an Ubuntu 24.04 system that was fully patched at the time.
By April 30, CrowdStrike observed the Belarus-linked threat actor UMBRAL BISON using a modified version of the public exploit against a Ukrainian government organization.
The attack escalated privileges from the web-server account www-data to root.
With elevated access, the attackers deployed a Poseidon command-and-control agent associated with the Mythic framework.
CrowdStrike said its Falcon sensor terminated the agent when it executed.
The attackers had also modified the original PoC to improve its effectiveness.
According to CrowdStrike, the changes included:
- Runtime execution: Moving the exploit's main logic into a string evaluated during execution, making some static analysis techniques less effective.
- Error handling: Adding structured handling to improve reliability.
- Operational adaptation: Modifying publicly available code for use against real-world targets.
The case demonstrates how attackers can adapt existing research within a day rather than developing an exploit from scratch.
Iran-linked actor found with modified Fortinet exploit
CrowdStrike also identified a modified exploit targeting CVE-2024-55591, an authentication bypass vulnerability affecting Fortinet FortiOS and FortiProxy.
In February 2026, researchers discovered an exposed directory controlled by the Iran-linked threat actor STATIC KITTEN.
The directory contained approximately 1.9GB of data across more than 20,000 files, including a modified version of a publicly released exploit for the Fortinet vulnerability.
The original PoC, published in January 2025, was designed to execute a single command supplied by the user.
The modified version contained 13 hardcoded payloads designed to perform additional actions, including:
- Enumerating user accounts and groups.
- Creating administrative accounts.
- Modifying access permissions.
- Establishing persistent access through backdoor accounts.
Some payloads created accounts with elevated privileges, potentially allowing attackers to maintain access to compromised systems.
However, CrowdStrike could not determine whether STATIC KITTEN modified the exploit itself or obtained the modified code elsewhere.
The company also said it had not observed other threat actors using that specific modified exploit or the infrastructure hosting it.
Unlike the cPanel and CopyFail cases, the Fortinet discovery does not establish that the modified code was deployed in a confirmed intrusion.
It does show how a public exploit can be expanded from a demonstration tool into code containing multiple capabilities associated with unauthorized access and persistence.
AI could make exploit development faster
CrowdStrike also examined how artificial intelligence could accelerate vulnerability discovery and exploitation.
The company expects attackers to increasingly use AI tools to analyze vulnerabilities, adapt exploit code, and incorporate AI-assisted security research published by others.
It identified three potential approaches:
- Attempting to bypass safeguards in advanced AI models to obtain offensive assistance.
- Modifying open-weight models to weaken or remove safeguards.
- Reusing vulnerability research developed with AI assistance and published by security researchers.
However, CrowdStrike acknowledged that identifying AI's direct involvement in a specific exploit remains difficult.
Well-organized code, extensive comments, and improvements to existing PoCs can suggest AI assistance, but experienced human developers can produce similar results.
The company cited CopyFail and the WordPress vulnerability known as wp2shell as examples of research reportedly involving AI assistance.
Those reports do not establish that the attackers in CrowdStrike's case studies directly used AI during their intrusions.
The more immediate concern is that increasingly accessible vulnerability research, whether developed by humans or with AI assistance, can reduce the time needed to produce working exploits.
What security teams should do when patch windows shrink
CrowdStrike's findings raise questions about vulnerability management strategies that rely primarily on severity scores and scheduled patch cycles.
A high Common Vulnerability Scoring System (CVSS) score indicates technical severity, but it does not necessarily establish whether attackers are actively exploiting a vulnerability.
Organizations also need to consider public exploit availability, exposure, ease of exploitation, and evidence of attacker activity.
For defenders, the research points to several priorities:
Priority | Recommended action |
| Identify exposed systems | Maintain an accurate inventory of internet-facing assets and affected software |
| Monitor public exploits | Track newly released PoCs, exploitation guidance, and relevant threat intelligence |
| Prioritize by actual risk | Consider active exploitation, exploit availability, exposure, and business impact alongside CVSS |
| Apply temporary protections | Use vendor-supported mitigations, access restrictions, or isolation when immediate patching is not possible |
| Investigate possible compromise | Review suspicious activity when exploitation may have begun before remediation |
| Verify remediation | Confirm patches and compensating controls are working as intended |
These measures cannot guarantee protection against attacks that begin minutes after exploit code becomes public.
They can help organizations identify high-risk exposures more quickly and reduce opportunities for attackers while permanent fixes are deployed.
Detection and response capabilities are also important when exploitation begins before a patch can be applied.
Public vulnerability research creates a security trade-off
Public vulnerability research remains essential for helping defenders understand software weaknesses, validate protections, and develop fixes.
But the same technical details can also provide attackers with reusable code and exploitation guidance.
CrowdStrike's findings illustrate both sides of that problem.
The cPanel case suggests public research can accelerate exploitation already underway. The CopyFail incident shows how quickly attackers can modify a newly published PoC, while the Fortinet discovery demonstrates how existing exploit code can be expanded with additional capabilities.
The findings do not establish that researchers should stop publishing vulnerability information. Instead, they reinforce the importance of coordinated disclosure, timely remediation, and detection capabilities that account for rapid exploitation.
For security teams, the central lesson is that a newly published PoC should be treated as an urgent signal to assess exposure.
By the time an organization begins its next scheduled patching cycle, attackers may already be using that code.
In other news: Hackers manipulated refrigeration settings at three French blood bank facilities through a third-party supplier breach, but monitoring systems detected the changes before any blood products were damaged.