About the slides

CrowdSec's network sees exploitation from the first attempts: 500,000 servers in 190 countries, sending more than 40 million signals a day from real production servers, not honeypots. At SANS 2026, CrowdSec CEO Philippe Humeau presented what that data shows about how vulnerabilities get exploited today.

The deck has the charts behind the eight lessons: the time from publication to first attack, the React2Shell campaign, the share of residential and data-center IPs, and the weaknesses each sector faces.

What's inside

• The defenders' window is now measured in hours. Of the 332 exploited CVEs CrowdSec tracked from Q4 2024 to Q2 2026, 36% were attacked within a day of publication.
• Monster CVEs run on borrowed cloud IPs. React2Shell (CVE-2025-55182) was hunted by 444,948 distinct IPs. A week after disclosure, around 80% of the exploiting IPs came from hyperscaler ranges, and four in five early hunters' IPs were never seen again after day 1.
• Zero-days get exploited before anyone writes about them. On CVE-2025-2748, five AWS IPs exploited the vulnerability 42 days before the research was published.
• Old vulnerabilities never die. The 50 most exploited CVEs still include flaws from 2002, 2012 and 2013.
• Attacks look like your users. 69% of the IPs CrowdSec sees attacking are residential addresses.
• Your sector has its own threat profile. Finance sees unrestricted file upload 2.7 times more than average; government sees untrusted deserialization 2.1 times more.