u/Active_Sea4060

Ran into this recently:

CVE-2026-31431 was weaponized in about 9 days, then added to CISA KEV.

That’s a tight turnaround if you’re relying on CVSS, vendor advisories or regular patch cycles

By the time it’s clearly “urgent,” it’s already moving.

Been testing a way to track when CVEs actually start getting used instead of just when they’re published.

Main goal is cutting noise and catching what actually matters earlier. Interested in what workflows people trust here.

▲ 4 r/blueteamsec+2 crossposts

CVE-2026-31431 showed up in the wild roughly 9 days after disclosure, then landed in KEV.

That lag is interesting from a detection standpoint.

Are you relying on:

Or trying to catch earlier signals?

Been looking at correlating:

Not trying to replace existing tooling, just focusing on that gap between disclosure and confirmed exploitation.

Curious how others are handling this operationally.