An exploit is a piece of code, a file or a sequence of commands that takes advantage of a vulnerability to make software do something its developers never intended.
How an exploit works
A vulnerability is only a weakness; the exploit is the tool that uses it. Depending on the bug, an exploit may crash a program, read memory it should not, bypass a login or run the attacker’s own code (remote code execution). It usually delivers a payload – for example a shell, a downloader or a remote access trojan.
- Remote exploits work over the network, while local exploits need existing access and are often used for privilege escalation.
- Proof of concept (PoC) code only demonstrates that a bug is real; a weaponized exploit is reliable and ready for attacks.
- Exploit kits bundle several browser exploits and pick one that fits the victim’s system.
Why exploits matter for security
The time between the publication of a patch and the first attacks keeps shrinking: for popular edge devices it is often days or even hours, because criminals compare patched and unpatched versions to rebuild the exploit. Exploits for unknown flaws (zero-days) are sold for high prices to spyware vendors and state actors. Public frameworks such as Metasploit and databases such as Exploit-DB are used by defenders and penetration testers as well as by attackers.
How to defend
- Install security updates quickly, starting with systems that are reachable from the internet.
- Prioritize flaws that are known to be exploited in the wild rather than relying on severity scores alone.
- Use exploit mitigations: ASLR, DEP, sandboxing, and keep EDR and browser protections enabled.
