The Changelog — How a CVE Becomes a Weapon, and Never Stops Being One

TI-2026-069C · Series: 🧰 The Open Armory · TLP:WHITE · 2026-07-09

069A: the password list is public. 069B: the web scanner is public. This closes the trilogy on the last shelf — the exploit proofs themselves — and the timeline they write: a changelog that only ever grows, and never deletes a line.

📋 The Short Version

An exploit is not an idea. It is a file. Exploit-DB — held in our OSINT library beside the attacker's copy — is a corpus of dated, CVE-tagged, copy-paste-runnable proof-of-concept scripts. exploit-0009 is the Log4Shell RCE (CVE-2021-44228), a Python program. Not a description of Log4Shell. Log4Shell.

Those proofs are one stage of a pipeline: a CVE gets a number, a PoC proves it (Exploit-DB), a template scales it (Nuclei, 069B), and then everyone fires it. Each stage removes skill from the requirement until the last one is a single command.

And the changelog that pipeline writes is cumulative. The scanning we catch spans a decade at once — Shellshock (2014), Struts (2017), Drupalgeddon (2018), a dominant ProxyShell/Log4Shell cluster (2021), and current-year templates — all fired in parallel. A patched CVE is never a closed chapter. It is a permanent line in a changelog that is read forever.

Confidence: HIGH on the library holdings and the decade-spanning scan distribution. MEDIUM on the finer pipeline-timing generalizations.

1. The Proof Is the Weapon

Open the Exploit-DB shelf in our library and you are not reading analysis. You are reading ammunition:

Each entry has a title, a date, an author, a CVE — and working code. The gap between "this vulnerability exists" and "a working exploit exists" is not months of research. It is a public download. For any CVE with an Exploit-DB entry, the correct assumption is that a functioning exploit is already in every attacker's hands.

2. Four Stages, and Skill Falls Off at Each One

The three shelves of this series are not three separate things. They are stages of one pipeline, and the whole point of the pipeline is that competence is required only at the top:

CVE-List        →   Exploit-DB     →   Nuclei template   →   commodity scan
(the index)         (the proof)        (the mass detector)    (everyone)

needs: a           needs: a            needs: one            needs: nothing
researcher         developer           command               but a target list

Writing the exploit takes a researcher. Running the published PoC takes a developer. Firing the templated version (069B, ranked by EPSS) takes nuclei -u. By the final stage the skill requirement is zero and the capability is universal.

This reframes what "dangerous" means. The perilous moment for a CVE is not when a nation-state can exploit it — it is when it reaches the template stage and everyone can. Track the pipeline position, not just the CVSS.

3. The Changelog Only Grows

Here is what actually arrived at the edge, sorted by the disclosure year of the vulnerability being probed:

An eleven-year-old vulnerability is being scanned in the same breath as a current-year one. Nothing is retired. Once a CVE is templated, it stays in the public corpus and keeps being fired at every host that might still be unpatched — and across the whole internet, some always are.

This is the deep structure behind the Steady State (067A): the web surface is saturated partly because the exploit corpus is cumulative and permanent. It never shrinks; every year adds a layer and removes none.

4. The Peak Lags — and That's the Lesson

Notice the shape: the 2021 cluster dominates (116 IPs), not the newest CVEs. That is not attackers being behind. It is the exploitation sweet spot.

A 2021-era CVE is old enough to be fully templated, documented, and ubiquitous in every scanner — and still new enough that a meaningful population of unpatched hosts survives. Exploitation volume lags disclosure by a few years, peaks in that window, then decays slowly without ever reaching zero.

The practical read: the heaviest scanning is not aimed at zero-days. It is aimed at the two-to-four-year-old CVEs you meant to patch and didn't. Patch currency on middle-aged vulnerabilities buys more safety than racing every fresh disclosure.

5. The Window Collapsed; the Tail Is Infinite

Two things are true at once, and together they are the whole threat:

• The front has collapsed. A 2025 CVE (Vite, CVE-2025-32395) is already a Nuclei template in our library. Disclosure-to-mass-scanning is now days to weeks.
• The tail is endless. Shellshock (2014) is still fired in 2026.

So a vulnerability's danger begins almost immediately and effectively never ends. There is no quiet period after disclosure and no safe period after it ages. The exposure window is the entire lifetime of the software.

6. The Honest Limit — and the Defender's Inversion

The limit, stated plainly. Exploit-DB and the CVE catalog are legitimate, essential resources for researchers and defenders. A PoC is neutral. Running one against your own estate is good hygiene. Holding the corpus — as we do — is normal security practice. Nothing in the artifact implies malice.

What is hostile is executing the proof against a stranger's production host. The artifact is symmetric; only the aim is not.

The inversion — this is the gift. The exploit changelog, read from the defender's side, is your work queue. It is your patch-priority backlog (weighted by the scanning we just measured), your detection ruleset (the same templates, run inward), and your exposure inventory. The identical public corpus that arms the attacker arms you — first, if you read it first, on yourself.

Closing the Armory

Three shelves, one conclusion. The credential dictionary (069A, SecLists), the web template corpus (069B, Nuclei), and the exploit proofs (069C, Exploit-DB/CVE) are a single, open, downloadable toolchain. The attacker's entire kit — the passwords, the paths, the proofs, even the exploitability ranking — is public, catalogued, and sitting in our own library.

Which means the only thing the attacker owns that we cannot read is intent. Not the wordlist, not the template, not the exploit — those are all ours too. The one private variable is whether the hand firing the public armory is aimed at its own estate or at someone else's.

That is why every road in this corpus ends at the same sentence, and why the Open Armory ends there too: judge the behavior, not the artifact. The tools were never the secret. The aim is.

Investigation Metadata

Cross-references: TI-2026-069A (The Open Armory — credentials) · TI-2026-069B (The Template and the Target — Nuclei) · TI-2026-067A (The Steady State — why the cumulative corpus saturates the surface) · TI-2026-068D (The Same Hand — judge the behavior, not the artifact).