Public Exploit Code Now Weaponised Within Hours, CrowdStrike Finds: 91% Exploited Within 48 Hours

On April 30, 2026, CrowdStrike's Counter Adversary Operations team began seeing widespread, opportunistic attacks against a flaw in cPanel, the popular web hosting control panel. The vulnerability, tracked as CVE-2026-41940, is an authentication bypass. It had been disclosed only two days earlier, on April 28. Most of the attacks, if not all, followed the same guidance that had been published in public the day before.

That sequence is the centrepiece of new research CrowdStrike released overnight. Looking at exploitation it observed in the wild between January and July 2026, the company found that 91 per cent of vulnerabilities with public proof-of-concept code were exploited within 48 hours of publication. The median time from a public proof of concept to exploitation was under one day. The fastest case CrowdStrike recorded took 35 minutes.

The cPanel flaw, which later became the subject of a Critical Alert from the Australian Cyber Security Centre, shows how that compression happens. On April 29, the security firm WatchTowr published a blog post with exploitation guidance for the vulnerability, along with a detection artifact generator. CrowdStrike analysed the tool and concluded that it needed only a minor change to become a working weapon. An attacker had to un-comment a single line of code that changes the root password. After that, the attacker could log in to the WHM terminal as root. In CrowdStrike's assessment, the purported detection tool was in effect a weaponised exploit.

The attacks did not stop there. CrowdStrike says industry reporting on the vulnerability later in the year drove a further rise in exploitation by multiple threat actors, in some cases with more than one group trying to compromise the same instances.

CrowdStrike places this against a wider backdrop in which artificial intelligence is pushing up the rate of vulnerability disclosure while also helping attackers. It says adversaries are trying to jailbreak AI safeguards and export controls, modifying open-weight models for malicious purposes, and exploiting the flood of vulnerabilities that is swamping security teams. The company writes that adversaries will almost certainly keep using public vulnerability research as part of their toolkit for the foreseeable future. As proof-of-concept exploits become routinely available within hours of disclosure, partly because of AI-assisted research, it expects the number of threat actors using them to rise.

From this, CrowdStrike draws three conclusions. First, patch prioritisation is getting harder as disclosures multiply, and real-world exploitability, proof-of-concept availability and adversary intent are becoming more useful indicators than CVSS scores alone. Second, the patching window is shrinking: the company says adversaries treat public research as the starting gun, and patch cycles measured in weeks or days cannot compete. Third, public exploit research lets more attackers, whatever their technical skill, weaponise vulnerabilities, often with minimal modification. That enlarges the pool of potential attackers and adds pressure on organisations to detect and fix flaws faster.

CrowdStrike closes by calling the vulnerability research ecosystem one of the security community's greatest assets and most significant challenges. Defenders who treat public research as a green light for attackers, it says, and who build intelligence, patching timelines and detection capabilities to match, are the ones who will keep pace. The thing to watch is whether organisations start ranking patches by exploitability and adversary intent rather than by severity score alone.