How Adversaries Are Turning the Vulnerability Ecosystem Against Defenders

The security community has long operated on a foundational belief: Sharing knowledge makes everyone safer. Researchers publish technical blogs, release proof-of-concept (POC) code, and distribute scanning templates to help defenders understand vulnerabilities, prioritize patching, and build better detections. This belief is not wrong, but it is incomplete. 

The same public research that helps defenders understand a vulnerability also hands adversaries a roadmap to exploit it. Analysis of weaponization timelines that CrowdStrike Counter Adversary Operations observed between January 2026 and July 2026 reinforces that in 2026, adversaries are rapidly adopting public vulnerability research, often within hours. 

The Window Is Closing

Public vulnerability research (security advisories, technical blogs, scanning templates, and POC and exploit code) is available to everyone, including adversaries.

The data from the first half of 2026 makes clear how threat actors are using it. Analyzing in-the-wild exploitation CrowdStrike has observed between January and July 2026, the median time from when a vulnerability had a public POC to when threat actors exploited it was less than one day, with the fastest observed exploitation after a public POC being 35 minutes. Of the vulnerabilities with a public POC that CrowdStrike saw threat actors exploit, 91 percent were exploited within 48 hours of POC release.

POC publication is the race’s green flag. For organizations operating on traditional patch cycles, the window to act before exploitation begins has effectively closed. The question defenders need to ask is whether they are able to patch before exploitation begins. For most organizations operating on traditional patch cycles, the honest answer is no.

Public research benefits threat actors at every skill level. Less-skilled threat actors gain easily or fully weaponized POCs and exploitation guidance that put previously out-of-reach vulnerabilities within their grasp; highly skilled threat actors eliminate redundant development work, reduce costs, and improve operational security by blending in with the broader exploitation noise. 

Regardless of sophistication, the outcome is the same: faster operationalization, broader reach, and significantly reduced investment.

What This Looks Like in Practice

cPanel Authentication Bypass Vulnerability (CVE-2026-41940)

On April 28, 2026, cPanel disclosed the authentication bypass vulnerability CVE-2026-41940, which affects select versions of cPanel and WebHost Manager (WHM) and WordPress Squared (WP2). An unauthenticated remote attacker can leverage CVE-2026-41940 to gain unauthorized access to the control panels for these programs. 

A day later, on April 29, 2026, a well-known industry firm published a technical blog post that provided detailed exploitation guidance for CVE-2026-41940 and a purported detection-artifact generator to detect vulnerable instances.¹ CrowdStrike Counter Adversary Operations analyzed the purported detection-artifact generator and determined that it simply requires a minor modification. Attackers need only to un-comment a line of code that changes the root password, and then the attacker can log in to the WHM terminal as the root user, essentially making the purported detection-artifact generator a weaponized exploit.

On April 30, 2026, CrowdStrike Counter Adversary Operations began to observe widespread and opportunistic exploitation of CVE-2026-41940. Most if not all of the observed exploitation matched the exploitation guidance provided in the technical blog and/or purported detection artifact generator. 

CrowdStrike Counter Adversary Operations retrospective hunting revealed that a single threat actor likely exploited CVE-2026-41940 in-the-wild as a zero-day exploitation since at least April 3, 2026. How the single actor discovered the zero-day vulnerability and obtained a POC exploit remains unknown. The in-the-wild exploitation timeframe aligns with public reports stating this vulnerability had been exploited for over a month.²

Figure 1 highlights how, prior to the industry public reporting, CVE-2026-41940 was exploited as a zero-day with a comparatively targeted and limited scope, and then how the August 29, 2026 industry reporting related to this vulnerability almost certainly drove the immediate uptick in worldwide exploitation by multiple threat actors. In many cases, multiple distinct threat actors exploited the same vulnerable cPanel instances, creating a contested environment. 

Linux Local Privilege Escalation Vulnerability CopyFail (CVE-2026-31431)

On April 29, 2026, an industry source released a POC exploit and technical details for a recently disclosed Linux LPE vulnerability (CVE-2026-31431), dubbed CopyFail.³ At the time the industry source published its research, the vulnerability was patched in the Linux mainline but remained unpatched in many of the major Linux distributions, meaning it was essentially a zero-day at that time. CrowdStrike Counter Adversary Operations tested the exploit and confirmed it was reliable and effective on an at-the-time fully patched Ubuntu 24.04 host.

In addition to its reliability, driven by the fact that it does not require winning a race condition, kernel offsets, or special privileges, CopyFail's main advantages are its ease of distribution, as it consists of a very small Python script, and its ability to execute without user namespace creation.

On April 30, 2026, CrowdStrike Counter Adversary Operations identified the Belarus-nexus adversary UMBRAL BISON leveraging a modified CopyFail exploit (SHA256 hash: de8d1b25e8965dc98c62d675ee7c451ed12502194890f6cc691322ad66f3abf4) at a Ukrainian government entity to perform LPE from the default web user www-data to root. Using the escalated access, UMBRAL BISON deployed a MythicC2 Poseidon C2 agent, which the CrowdStrike Falcon® sensor terminated upon execution.

The adversary likely modified the public POC in a bid to evade detection and improve overall effectiveness against real-world targets. Specifically, it uses the exec() function to pass the exploit’s main logic as a string to be evaluated at runtime rather than being defined as normal code, which makes it harder for static analysis tools to detect, and it added structured error handling to improve its effectiveness and reliability. The result is that the public POC exploit served as a base that the adversary quickly modified into a harder-to-detect and more resilient exploit. 

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability  (CVE-2024-55591)

In February 2026, CrowdStrike Counter Adversary Operations identified an open directory controlled by the Iran-nexus adversary STATIC KITTEN on IP address 157.20.182[.]49 containing 1.9 GB of data and more than 20,000 files. Among them was a modified version (SHA256 hash: fd6b46d148af22da6163f18ce43b35ebb827cc6e140f03f0f514bc2a6f548743) of a public POC exploit for a FortiOS and FortiProxy authentication bypass vulnerability (CVE-2024-55591) first released by a well-known industry source on January 27, 2025.⁴

Where the public POC exploit executed a single user-provided command, the modified version contained 13 hardcoded payloads designed to enumerate targets, create users, and establish persistence. The modifications reflect a systematic approach to turning a demonstration tool into a more comprehensive exploit.

Whether STATIC KITTEN modified the public CVE-2024-55591 exploit themselves or obtained this modified version from another source remains unknown. However, as of this writing, CrowdStrike Counter Adversary Operations has not observed any other adversaries using this modified POC or infrastructure hosting it. 

AI’s Impact on the Vulnerability Research Ecosystem

AI advancements are undoubtedly accelerating the speed and scope of how vulnerabilities are discovered and weaponized.⁵ One only has to look at the substantial increase in the number of vulnerabilities in recent Microsoft Patch Tuesdays compared to prior to the advent of frontier models earlier this year.⁶

Detecting and attributing adversaries’ direct use of AI for vulnerability research purposes remains hard to identify due to inherent visibility gaps and the fact there is no single identifier that distinguishes AI-generated exploit code. Complicating things further, is that the patterns suggesting AI assistance (such as well-commented code, improvements to existing POCs, or structured code organization) are also consistent with the output of someone with high technical capabilities. 

Nonetheless, threat actors are leveraging AI to augment their vulnerability research. CrowdStrike Intelligence assesses they will almost certainly continue to do so through at least three vectors:

• Direct interaction with frontier models by trying to “jailbreak” AI safeguards and bypass any export control restrictions
• Modifying open-weight proprietary models for malicious use by extracting safeguards; these are not/less monitored for abuse by frontier AI companies
• Adopting AI-led/assisted public vulnerability research published by industry sources

The third point, while not a direct use, is the easiest to detect. One only has to look at the CopyFail vulnerability detailed in this blog post, whose discovery was allegedly facilitated by AI.⁷ Or the mass exploitation of wp2shell in July 2026, which is the first critical unauthenticated WordPress Core remote code execution (RCE) purportedly discovered in nearly a decade and was allegedly discovered using GPT5.6 Sol Ultra and $25 USD worth of tokens.⁸

Outlook

Adversaries will almost certainly continue using public vulnerability research as part of their offensive toolkit through the foreseeable future. As more POC exploits become routinely available within hours of disclosure, at least partially driven by AI-assisted vulnerability research, the number of threat actors using them will almost certainly increase. Over the next year, this will likely manifest itself in the rise of widespread exploitation campaigns resulting in contested environments, like the cPanel CVE-2026-41940 exploitation example covered in this blog post. 

This expanding pool of adversaries leveraging public vulnerability research, combined with the rapid speed at which adversaries are operationalizing public research, reinforces three key points. 

The first is that patch prioritization is harder than ever. As vulnerability disclosures continue to increase in volume, predicting which ones will attract public research (and therefore adversary attention) becomes a genuine intelligence challenge. Because adversaries have access to the same advisories and public exploits that defenders do, organizations that rely solely on CVSS scores to drive patching decisions are relying on the wrong signal. Real-world exploitability, ease of exploitation (i.e., if there is a public exploit or exploitation guidance), and adversary intent are what separate the vulnerabilities that matter from the ones that do not.

The second is that the time to patch is effectively zero. The data from the first half of 2026 shows this: 91% of vulnerabilities with POCs that CrowdStrike has seen exploited were weaponized and used in the wild within 48 hours, with the fastest observation occurring just 35 minutes after a POC became available. Adversaries treat public vulnerability research as the starting gun, and legacy patch cycles measured in weeks or days cannot compete.

Lastly, more threat actors can participate in exploitation. As the case studies show, adversaries across skill and resource levels are operationalizing public research, some using POCs with minimal modification and others refining them (as UMBRAL BISON and STATIC KITTEN both demonstrated). When motivation and intent are the only remaining barriers to exploitation, the volume of participating adversaries significantly increases.

The vulnerability research ecosystem is one of the security community's greatest assets and most significant challenges. Defenders who treat public research as a threat actor's green light, and who build the intelligence, patching timelines, and detection capabilities to match, are the ones who will keep pace.

Jaime Duque and Lacie Blythe are Senior Intelligence Analysts at CrowdStrike. This research was presented at Day Zero 2026.

Additional Resources

• Learn more about CrowdStrike Counter Adversary Operations threat intelligence and threat hunting, or request a demo.
• Tune in to the Adversary Universe podcast, where CrowdStrike reveals the threat actors behind the latest cyberattacks.

¹ https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/ || https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py

² https://www.reddit.com/r/cpanel/comments/1syyajp/comment/oiyg0fr/

³ https://xint.io/blog/copy-fail-linux-distributions || https://github.com/theori-io/copy-fail-CVE-2026-31431

⁴ https://labs.watchtowr.com/get-fortirekt-i-am-the-super_admin-now-fortios-authentication-bypass-cve-2024-55591/ || https://github.com/watchtowrlabs/fortios-auth-bypass-poc-CVE-2024-55591

⁵ https://www.crowdstrike.com/en-us/blog/tune-in-future-of-ai-powered-vulnerability-discovery/

⁶ https://www.microsoft.com/en-us/security/blog/2026/10/06/ciso-perspectives-on-managing-vulnerability-risks-in-the-age-of-ai/

⁷ https://xint.io/blog/copy-fail-linux-distributions

⁸ https://www.wordfence.com/blog/2026/07/wp2shell-aftermath-the-first-critical-unauthenticated-wordpress-core-rce-in-nearly-a-decade/ || https://www.slcyber.io/research/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6#the-story-of-wp2shell