What 500,000 servers saw: 8 lessons on exploitation from SANS 2026
At SANS in Brussels, I presented what CrowdSec’s network sees when vulnerabilities get exploited: 500,000 servers in 190 countries and 7,000 autonomous systems, sending more than 40 million signals a day from real production servers, not honeypots. The short version: defenders’ window is shrinking to hours, attackers borrow the infrastructure they need and throw it away, and the IP (the vector) tells you more than the payload or the name behind it.
Here are the eight lessons, with the numbers behind them.
Where the data comes from
The CrowdSec Security Engine is free and open source. Each instance detects attacks locally (IDS, WAF, bot detection) and shares the metadata: which detection rule fired, when, and the attacking IP. When a new CVE gets a virtual patch, it goes out to hundreds of thousands of real servers, so we capture the exploitation momentum from the first attempts.
That’s also why VulnCheck’s State of Exploitation 2026 report, which counted 118 sources that were first to report exploitation in 2025, wrote that “the most notable increases in sources that were first to report KEVs included CrowdSec, which was onboarded as a new source and scaled significantly in 2025” (source).
1. The defenders’ window is now measured in hours
Of the 332 exploited CVEs we tracked from Q4 2024 to Q2 2026, 36% (121) were attacked within a day of publication, and 27% more within a week.
332 may look small next to the 9,000 to 15,000 new CVEs the NVD receives every month this year (NVD dashboard, October 2026). These are only the ones we saw actually exploited, and only those an attacker can reach on a server exposed to the internet: no Photoshop flaws, printer bugs, or obscure Windows local privilege escalations. That’s the short list that matters for anything you expose.
Since June 2026, CISA’s Binding Operational Directive 26-04 gives US federal agencies 72 hours to fix publicly exposed, highest-risk exploited vulnerabilities. Do the math: for more than a third of these vulnerabilities, the attack starts before the deadline clock has meaningfully run.
Early attackers are the most dangerous ones, because they hit before patches, signatures or blocklists exist.
2. More CVEs get exploited, and faster
Of the newly announced CVEs we track, the share exploited within 90 days of their announcement climbed from 8% in Q4 2024 to 67% in Q2 2026 (42 CVEs). CVE publication keeps accelerating, and so does the noise around it: scoring every CVE as urgent has stopped working.
3. CVE-geddon is not (yet) upon us
AI-driven vulnerability discovery makes headlines, but discovery is not exploitation. After Project Glasswing, VulnCheck’s Patrick Garrity looked at a sample: only 14 of 1,061 CVEs identified by Berkeley researchers had been exploited in the wild. His comparison also showed AI-rated severities running much hotter than maintainers’ ratings: 74% “high” for the model against 40% for maintainers. More findings, more scary scores, a small fraction actually used by attackers.
4. AI is making exploitation cheap, more than smart
AI got better at reconnaissance and exploitation, but token costs kept it for targeted attacks: only worth the money against a valuable victim. That’s changing. Local models plus better tooling make tokens effectively free, and a free weapon gets used like a machine gun, against everyone but with a high level of “personalization”. Actually, scratch that machine gun image; it’s more like industrializing sniper rifles.
5. Monster CVEs run on borrowed cloud IPs
React2Shell (CVE-2025-55182) is the behemoth of the year: 444,948 distinct IPs hunted it between 5 December 2025 and 8 September 2026, with a peak of 10,674 IPs on a single day, eight days after publication.
Two patterns stand out:
- Attackers move to the cloud. In the week of disclosure, 3% of the exploiting IPs came from hyperscaler ranges. A week later, around 80% did.
- The infrastructure is disposable. Four in five of the early hunters’ IPs were never seen again after day 1. Of that early cohort, only 5.3% were still reported a week later, and 0.2% after twelve weeks.
The lesson for defenders: block fast, and make sure what you block expires. A blocklist that never forgets ends up blocking a cloud IP your next customer will use.
6. Zero-days get exploited weeks before anyone writes about them
On CVE-2025-2748, our network saw 5 AWS IPs exploiting the vulnerability 42 days before watchTowr published their findings. We’ve seen similar patterns on SAP NetWeaver and Fortinet products. When a vulnerability is announced, assume someone has already used it.
7. Old vulnerabilities never die
The 50 most exploited CVEs still include vulnerabilities from 2002, 2012, and 2013, and CVEs from 2021 and 2022 make up 19 of them. PHPUnit’s CVE-2017-9841 was still hunted by 88,428 IPs, and Apache’s CVE-2021-41773 by 89,127. Patching last year’s backlog is still a security strategy.
8. Residential proxies, CGNAT, VPNs and cloud IPs blur the lines
Of the IPs we see attacking, 69% are residential addresses, and 25% are in data centers, with proxies/VPNs, AI services, and Tor making up the rest. Most attacks don’t come from “bad hosting providers” anymore: they come from addresses that look like your users. Telling them apart needs behavior and history per IP, beyond a hosting-provider list.
Bonus: attribution? Really?
A network of 500,000 servers in 190 countries and 7,000 autonomous systems saw five disposable IPs exploit CVE-2025-2748 about 40 days before disclosure. For our friends who love attribution: who was it? And if you could tell, what would you do differently: let them in because they come from South Africa instead of North Korea?
Attribution matters for intelligence agencies and for reports. For the SOC on call, it changes nothing about the decision to block.
Your sector has its own threat profile
The weaknesses attackers go after aren’t spread evenly. In our data, organizations in industry see expression-language injection 3.8 times more than average, finance sees unrestricted file upload 2.7 times more, and government sees untrusted deserialization 2.1 times more. Prioritizing by “what’s exploited against organizations like mine” beats prioritizing by CVSS alone, and it’s why we build blocklists by industry and country.
What to do with this
The common thread: concentrate on the vector, not the payload.
- Prioritize patching by live exploitation (is it exploited now, how targeted, growing or fading), with CVSS as a tie-breaker.
- Block the IPs exploiting the CVEs you can’t patch yet, at the edge, with lists that expire.
- Check the IPs hitting you against behavior and history, beyond a yes/no reputation.
- Stop waiting for attribution before acting.
Want the slides? Download the SANS 2026 deck. Want to check IPs you’ve seen? Run them through IPDEX. Want to track CVE exploitation live? Ask us for a Live Exploit Tracker demo.
