Hackers Now Exploit Public Vulnerability Research Within Hours, Not Weeks

The security community has long believed that sharing knowledge makes everyone safer. Researchers publish technical blogs, proof-of-concept (POC) code and scanning templates so defenders can understand flaws, prioritise patching and build better detections. CrowdStrike argues this belief is not wrong, but it is incomplete, because the same public research also gives attackers a roadmap to exploit a vulnerability.

CrowdStrike Counter Adversary Operations analysed exploitation it observed between January and July 2026. The median time from a public POC appearing to threat actors exploiting the vulnerability was less than one day, and the fastest case was just 35 minutes. Of the vulnerabilities with a public POC that CrowdStrike saw exploited, 91 percent were exploited within 48 hours of the POC being released. CrowdStrike says that for organisations on traditional patch cycles, the window to act before exploitation begins has effectively closed.

Public research helps attackers of every skill level. Less-skilled actors gain ready-made or fully weaponised POCs and guidance that put harder vulnerabilities within reach. Highly skilled actors save development work, cut costs and improve their operational security by blending in with the wider exploitation activity. Either way, the result is faster operationalisation, broader reach and much lower investment for the attacker.