For years, the cybersecurity industry has run on a simple creed: sharing knowledge makes everyone safer. Researchers publish blogs, release proof-of-concept (POC) code and distribute scanning tools so defenders can understand flaws and fix them faster.
New analysis from CrowdStrike’s Counter Adversary Operations team, presented at Day Zero 2026, argues that creed is no longer sufficient. The same research that helps defenders also hands attackers a ready-made playbook, and in 2026 they are using it almost immediately.
The numbers that should worry you
Between January and July 2026, CrowdStrike tracked how quickly attackers exploited vulnerabilities once a public POC appeared.
The findings are stark:
• Less than one day: the median time from POC publication to real-world exploitation.
• 35 minutes: the fastest exploitation observed after a POC went public.
• 91%: the share of exploited vulnerabilities (with a public POC) that were attacked within 48 hours of release.
The authors put it bluntly: publication of a POC is the starting gun. For organizations still patching on weekly or monthly cycles, the race is over before it begins.
Cases that show how it plays out
cPanel: from quiet zero-day to global free-for-all. On April 28, cPanel disclosed an authentication bypass flaw (CVE-2026-41940) that let unauthenticated attackers take over web hosting control panels. A day later, a well-known industry firm published a technical write-up with exploitation guidance and a tool billed as a vulnerability detector. CrowdStrike found that the tool needed only a one-line change to become a working exploit that could grant root access.
Exploitation exploded the next day. CrowdStrike’s retrospective hunting showed that a single attacker had likely been quietly abusing the flaw since at least April 3. Once the public research landed, multiple groups piled in, often hitting the same servers and creating what analysts call a contested environment, with rival attackers competing for the same victims.
CopyFail: a public exploit, quickly upgraded. Also on April 29, an industry source released exploit code for CopyFail (CVE-2026-31431), a Linux flaw that lets an attacker with limited access escalate to full control. The bug was fixed in the core Linux code but still unpatched in many major distributions, making it effectively a zero-day for many users. CrowdStrike confirmed the exploit worked reliably on a fully patched Ubuntu 24.04 server.
Within a day, a Belarus-linked group, UMBRAL BISON, was using a modified version against a Ukrainian government entity. The attackers reworked the public code to make it harder for security tools to spot and more dependable in the field. CrowdStrike’s endpoint sensor stopped the follow-on malware, but the lesson stands: attackers treat public code as a foundation, not a finished product.
AI is pouring fuel on the fire
The report also points to artificial intelligence as an accelerant. Attackers are expected to keep exploiting AI through three routes: trying to jailbreak commercial AI models, stripping safeguards from open-weight models that face less monitoring, and, most easily spotted, simply adopting vulnerability research that AI helped discover.
CopyFail’s discovery was reportedly AI-assisted. So was a critical WordPress core flaw mass-exploited in July, allegedly found for about $25 in AI usage costs. The authors also note a visible rise in vulnerabilities in recent Microsoft Patch Tuesday releases since frontier AI models arrived earlier this year. Proving that attackers themselves used AI is hard, because well-organized code looks the same whether a skilled human or a model wrote it. But the direction of travel is clear: more flaws found, faster, by more people.
What this means for CIOs
CrowdStrike’s outlook boils down to three uncomfortable truths, each with practical implications for technology leaders.
1. Severity scores are the wrong compass. With disclosures rising, relying on CVSS ratings alone to decide what to fix first is a losing strategy. What matters is whether a public exploit exists, how easy it is to use, and whether attackers are showing interest. Patch queues should be driven by threat intelligence, not just a number.
2. Time-to-patch is effectively zero. If 91% of exploited bugs fall within 48 hours, patch cycles measured in weeks are a governance gap, not a schedule. Leaders should ask which internet-facing systems can be updated within a day, and what compensating controls (isolating or restricting access, virtual patching, tighter monitoring) cover everything else until then.
3. The attacker pool is widening. Public research lets low-skill actors do what once required elite talent, while sophisticated groups save money and hide in the noise. When motivation is the only barrier, more adversaries show up, and contested, multi-attacker compromises become normal. Detection and incident response must assume you may not be the only intruder.
The bottom line
The vulnerability research community isn’t going away, nor should it. Open research remains one of security’s greatest strengths. But the CrowdStrike authors argue defenders must stop treating publication as a courtesy notice and start treating it as the moment the clock hits zero. Organizations that build intelligence-led prioritization, rapid patching and strong detection will keep pace. Those on traditional cycles are, in the report’s words, asking the wrong question: the issue is no longer whether you can patch before exploitation, but what protects you when you can’t.
Source: CrowdStrike Counter Adversary Operations research by Lacie Blythe and Jaime Duque, published November 5, 2026.