CrowdStrike finds 91% of exploited vulnerabilities weaponised within 48 hours of public disclosure

Attackers are increasingly using publicly available security research to accelerate cyberattacks, with 91% of vulnerabilities for which CrowdStrike observed exploitation of public proof-of-concept (PoC) code being weaponised within 48 hours of publication. The fastest case took just 35 minutes, according to new research by the cybersecurity firm.

The findings highlight how tools and research released to help defenders can quickly be repurposed by attackers. In one instance, a publicly released tool designed to detect a cPanel vulnerability required only minor code changes to become an exploit, before being used in widespread attacks.

CrowdStrike also identified nation-state-linked groups exploiting publicly available code. Belarus-linked UMBRAL BISON modified a Linux exploit and deployed it against a Ukrainian government entity within a day of its publication. Iran-linked STATIC KITTEN was found using a modified public exploit containing 13 payloads designed to identify targets, create accounts and establish persistence.

The trend lowers the time, cost and technical expertise needed to develop attacks. While less sophisticated actors can use existing research to mount exploits, advanced adversaries can adapt it to accelerate operations and increase their scale.

The findings underline the shrinking window between vulnerability disclosure and exploitation, putting pressure on organisations to prioritise patching, exposure management and continuous monitoring.