# Zero-Day A **software vulnerability that the vendor does not yet know about** — so no patch exists and defenders have had "zero days" to prepare. The term stretches across three related ideas: the **zero-day vulnerability** (the unknown flaw), the **zero-day exploit** (the code that weaponizes it), and the **zero-day attack** (its use in the wild). Because the target has no fix and frequently no way to detect the intrusion, zero-days are the most valuable and feared category of flaw — and the building block of the most consequential cyberattacks. ## Why zero-days are special Most attacks reuse *known* vulnerabilities that victims simply failed to patch. A zero-day is different: it works against fully-updated, well-defended systems, because the defense for it does not exist yet. That gives whoever holds one a window of near-guaranteed access. The value scales with the target — a reliable zero-day "exploit chain" against an up-to-date iPhone or Android can be worth **millions of dollars**. Zero-days are also typically *single-use in spirit*: once an exploit is observed and analyzed, the vendor patches it and its value collapses, so holders hoard them and deploy them sparingly against high-value targets. ## The market and the stockpiling dilemma Zero-days sustain a lucrative, murky **exploit market**. Legitimate "bug bounty" programs pay researchers to disclose flaws so they can be fixed; a parallel **gray market** of brokers (Zerodium being the best-known) buys exploits and resells them to governments and other clients, often for offensive use. This creates the **vulnerabilities-equities dilemma** that runs through the [[Cyberweapon]] story: when a government discovers a zero-day, it must choose between *disclosing* it (so everyone, including its own citizens, gets protected) and *hoarding* it for espionage or attack (leaving everyone exposed in the meantime). The U.S. formalized the trade-off as the Vulnerabilities Equities Process; the NSA's "NOBUS" ("nobody but us") doctrine is the bet that a hoarded flaw will stay exclusive — a bet the leaked **EternalBlue** exploit lost when it escaped and powered the NotPetya and WannaCry outbreaks. ## Right-wing-KB relevance Zero-days are the **raw material of state cyber power** and a recurring thread in this vault's security coverage. Stuxnet (see [[Stuxnet and Cyber Warfare Origins]]) chained together several zero-days to sabotage Iran's centrifuges; [[Commercial Spyware]] like Pegasus relies on zero-click zero-days to compromise the phones of journalists and dissidents; and the EternalBlue saga shows the public-accountability stakes of governments quietly stockpiling flaws in software that ordinary people depend on. The zero-day debate is, at bottom, a debate about whether the state's offensive appetite should override everyone's collective defense. ## Distinct from neighbors - **Known vulnerability / n-day** — a flaw the vendor has disclosed/patched; an "n-day" attack exploits users who haven't updated. The opposite of a zero-day. - **[[Cyberweapon]]** — the engineered tool; a zero-day is the *unpatched flaw* it exploits. - **Exploit** — the code that takes advantage of a vulnerability; "zero-day exploit" specifies that the underlying flaw is still unknown to the vendor. - **Bug bounty** — the *defensive* market that pays for disclosure; the gray exploit market pays for *offense*. ## See Also - [[Cybersecurity Lexicon]] - [[Cyberweapon]] - [[Stuxnet and Cyber Warfare Origins]] - [[Commercial Spyware]] - [[Supply-Chain Attack]]