Exploit Window Collapsing to Hours

CrowdStrike’s 2026 Threat Hunting Report found that 88% of CVEs with published proof-of-concept exploits were used in active attacks within 48 hours. This represents a critical compression in the time defenders have to patch and respond.

State-Sponsored Groups Leading the Charge

China-linked threat groups VAULT PANDA and GENESIS PANDA have reached a 24-hour turnaround on critical web application vulnerabilities, demonstrating organised capability to weaponise disclosures at scale.

UMBRAL BISON, another China-linked group, began exploitation of CVE-2026-31431 within 20 hours of disclosure. Once exploitation began, 94% of attack events related to CVE-2026-31431 were logged within the first day of disclosure.

Real-World Impact: React2Shell and Beyond

The React2Shell vulnerability generated 800 investigation leads and confirmed breaches at more than 80 victim organisations within four days of its disclosure, illustrating the speed and scale of modern attack campaigns.

Threat group SNARKY SPIDER moved from account takeover to confirmed data theft in under five minutes in documented incidents.

ALTERED SPIDER compromised more than 300 software dependencies in a single day.

AI and Detection Amplification

AI-agent-triggered security detections now produce 2.5 times more threat leads than manually driven activity, according to CrowdStrike’s 2026 Threat Hunting Report.

CrowdStrike now tracks 290 named adversary groups, up substantially from prior years.

Emerging Attack Vectors

Voice phishing — where attackers impersonate IT support or executives over phone calls — doubled in H1 2026 versus the previous six months.

Monthly device code phishing attempts have jumped 15-fold over the past six months, exploiting OAuth flows used to authenticate apps on smart TVs and limited-input devices.

A single LLMJacking campaign — where attackers steal AI API credentials and run them for profit — generated 200,000 API requests in two minutes.

Cloud-based eCrime increased 171% year-over-year, attributed partly to the availability of commodity AI tools that lower the barrier for criminal actors.

Slower Median Exploitation Timeline, But Faster Peak Activity

VulnCheck’s State of Exploitation – 1H 2026 report found that roughly 23.4% of vulnerabilities were exploited within one day of CVE publication. This represents a shift from 2025, when 28.9% of all known exploited vulnerabilities were exploited in one day or less. However, the median time from CVE publication to exploitation fell from 120 days to 80 days in the first half of 2026.

Content Management Systems Dominate Exploitation Statistics

Content management systems like WordPress account for one-third of all known exploited vulnerabilities in the first half of 2026. The Australian Cyber Security Centre (ACSC) issued a warning that hackers have launched a global exploitation campaign targeting websites built with CMS platforms including WordPress and Joomla.

Network edge devices — including VPNs, firewalls, and routers from vendors such as Cisco, Palo Alto Networks, Fortinet, and SonicWall — are the second most exploited technology category.

AI-Discovered Vulnerabilities Show Lower Exploitation Rates

Of 1,061 vulnerabilities discovered by AI systems, only 14 (1.3%) have been confirmed to have been exploited in attacks, roughly matching the overall exploitation rate for all vulnerabilities in H1 2026.

VulnCheck concludes that AI technology currently appears to be more of an advantage for defenders than attackers, as it helps find and fix vulnerabilities rather than enabling exploitation of zero-days.

Source: Martin Cid Magazine