Zero-day

A zero-day is a vulnerability in software or hardware that is still unknown to the vendor, which means no patch or update exists for it yet. The name refers to the number of days the developer has had to fix the problem: zero.

What it means

Three related terms are often used interchangeably. A zero-day vulnerability is the flaw itself. A zero-day exploit is working attack code that abuses the flaw. A zero-day attack is the actual use of that exploit against a target. Once the vendor knows about the vulnerability and ships a patch, it is no longer called a zero-day, although unpatched systems often remain exposed for months afterwards.

Zero-days are scarce and valuable. They are traded on grey and black markets and used by state actors, ransomware groups and exploit brokers. Researchers who find one ideally report it to the vendor through responsible disclosure, so a patch is ready before the details become public.

Why it matters

Patching, by definition, does not help against a zero-day: there is nothing to install yet, and signature-based detection has nothing to match against. Defence therefore focuses on limiting the damage when an attack succeeds: network segmentation, least privilege, monitoring for anomalous behaviour and a well-rehearsed incident-response process. Patching quickly once a fix appears also shrinks the window in which criminals mass-exploit a vulnerability that has just become public.

Example

In May 2023 the Cl0p ransomware group exploited a previously unknown SQL injection flaw in MOVEit Transfer (CVE-2023-34362). Hundreds of organisations had data stolen before vendor Progress could release a patch, a classic zero-day scenario: the attack was already underway when the world first heard of the vulnerability.