The patch window has closed: Why public exploit research is now every CIO’s problem
For years, the cybersecurity industry has run on a simple creed: sharing knowledge makes everyone safer. Researchers publish blogs, release proof-of-concept (POC) code and distribute scanning tools so defenders can understand flaws and fix them faster.
New analysis from CrowdStrike’s Counter Adversary Operations team, presented at Day Zero 2026, argues that creed is no longer sufficient. The same research that helps defenders also hands attackers a ready-made playbook, and in 2026 they are using it almost immediately.
The numbers that should worry you
Between January and July 2026, CrowdStrike tracked how quickly attackers exploited vulnerabilities once a public POC appeared.
The findings are stark:
• Less than one day: the median time from POC publication to real-world exploitation.
• 35 minutes: the fastest exploitation observed after a POC went public.
• 91%: the share of exploited vulnerabilities (with a public POC) that were attacked within 48 hours of release.
The...
Copyright of this story solely belongs to www.expresscomputer.in. To see the full text click HERE
