zeroday

Zeroday, or zero-day vulnerability, refers to a software flaw that is unknown to the vendor and to the public at the time it is discovered. The term reflects the idea that developers have zero days to prepare a fix before attackers may exploit the flaw. If a patch exists, the vulnerability is no longer a zero-day.

Discovery and exploitation: Zero-days can be found by security researchers, attackers, or through automated testing. If privately reported, vendors may develop a patch; if disclosed publicly, attackers and defense teams may race to respond, and exploit code may appear in the wild.

Lifecycle and disclosure: After discovery, many researchers pursue responsible disclosure, notifying the vendor and releasing a patch before public exposure. Alternatively, full public disclosure can occur, potentially increasing urgency and risk for users until a fix is deployed.

Impact: Zero-days can undermine confidentiality, integrity, and availability. They may affect operating systems, browsers, applications, or network devices, and can enable remote code execution, privilege escalation, or data exfiltration. The risk depends on exploitability and the value of the target.

Defense: Effective defense relies on timely patch management, defense in depth, principle of least privilege, network segmentation, and continuous monitoring for suspicious activity. Vendors issue security advisories; users should apply updates promptly and adopt security best practices to reduce exposure.

Limitations and scope: The term covers both vulnerabilities and exploits and does not guarantee that every zero-day will be exploited in the wild. Public awareness can drive faster fixes but may also increase the salience of the threat for attackers.