Zero-Day Vulnerabilities

In short: A zero-day vulnerability is a security hole that is still unknown to the vendor or for which no patch exists yet.

In more detail: The name says: the vendor had “zero days” to fix it when the hole is exploited.

In Depth

Trade

Zero-days are valuable. They are bought by criminals, intelligence services and spyware companies (see Pegasus). There are also bug bounty programmes where vendors reward finders.

Consequences

Attacks are hard to defend against because signatures are missing. Protection: defence in depth, behaviour detection, segmentation, patching quickly once an update appears. See exploit, zero-click attack.

See also: Exploit, Zero-Click Attack, Pegasus, EternalBlue