A zero-day exploit is an attack that uses a vulnerability the software vendor does not yet know about or has not yet fixed, so defenders have had “zero days” to prepare.
How zero-day exploits work
The name counts the days since the vendor learned about the flaw. Until a patch is released, every user of the product is exposed, and signature-based tools usually have nothing to detect. Once a fix is published the bug becomes an “n-day”: still dangerous for everyone who has not updated, but now known.
Zero-days are found by independent researchers, bug bounty hunters, criminal groups and state-funded teams. Some are reported responsibly; others are sold on grey and black markets, where a reliable zero-click exploit chain for iOS or Android can fetch millions of dollars.
Why zero-days matter for security
Zero-day exploits are the favourite weapon of advanced persistent threat groups and commercial spyware vendors: Stuxnet used four Windows zero-days in 2010, and NSO Group’s Pegasus infected iPhones through the zero-click FORCEDENTRY exploit in 2021. Google’s Project Zero and threat intelligence teams track dozens of zero-days exploited in the wild every year, with browsers, mobile operating systems and edge devices such as VPN gateways and firewalls as frequent targets.
How to reduce the risk
- Install emergency updates as soon as vendors release them – most victims are hit after a patch exists.
- Reduce the attack surface: disable unused services and keep management interfaces off the internet.
- Rely on behaviour-based detection (EDR) and segmentation, which work even against unknown exploits.
- For high-risk users, enable hardened modes such as Apple’s Lockdown Mode.
