Threat video1:00
CVE-2026-96951 Qualys Time-to-Exploit: Detection & IOCs
Qualys says AI shrank the window to exploit old exposures. Hunt it with 15 IOCs, 9 detection rules and a free Splunk SPL rule.
Read the full threat intel for AI-accelerated exploitation of pre-existing exposures: collapsed… →
Chapters
- 0:00The hookQualys cites exploits caused 32% of intrusions.
- 0:04The storyAI changed how fast attackers exploit.
- 0:11Attack pathEntry came via a worker flaw.
- 0:25AttributionNo threat actor is attributed.
- 0:30Indicators of compromise10 indicators to hunt: 1 IP, 1 domain and 1 URL, and more.
- 0:37MITRE ATT&CK techniques15 ATT&CK techniques, from initial access to command and control.
- 0:42Remediation5 steps now: Apply Microsoft October and November 2026 updates.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Qualys cites exploits caused 32% of intrusions.
0:05AI changed how fast attackers exploit.
0:07Most began with existing exposures.
0:11Entry came via a worker flaw.
0:13Cloud credentials gave cluster access.
0:16A privileged pod reached the node.
0:18Traffic hid on a Tailscale tunnel.
0:20Qualys mapped it in August.
0:26No threat actor is attributed. Confidence: low.
0:3010 indicators to hunt: 1 IP, 1 domain and 1 URL, and more.
0:3715 ATT&CK techniques, from initial access to command and control.
0:435 steps now: Apply Microsoft October and November 2026 updates.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.