What is Zero-Day?

The lifecycle runs through a few distinct phases. Discovery happens either by a researcher who reports it privately (responsible disclosure) or by an attacker who finds it first and keeps it secret to preserve its value. If attackers find it first, there's a window, sometimes hours, sometimes years, where the vulnerability is actively exploitable and no detection signature or patch exists anywhere. Once the vendor learns of it, whether through disclosure or by observing exploitation in the wild, they race to build a fix, and once that patch ships the vulnerability is technically no longer a zero-day, though exploitation against unpatched systems, called an n-day attack, often continues for months because patch adoption is never instant.

What makes zero-days hard for defenders is that signature-based tools have nothing to match against; an antivirus engine or an IPS with a known-bad-pattern database is blind to an exploit it has never seen. Detection instead relies on behavioral indicators: a process that shouldn't spawn a shell doing so anyway, memory corruption artifacts, or a known-good application suddenly making unusual network connections. EDR platforms catch a meaningful share of zero-day exploitation this way, not by recognizing the exploit but by recognizing what the exploit does once it runs, process injection into a browser, an Office document spawning PowerShell, unexpected privilege escalation.

Real examples anchor the concept. Log4Shell (CVE-2021-44228) was exploited as a zero-day for a period before public disclosure forced emergency patching across nearly every Java-based service exposed to the internet. Stuxnet chained four separate Windows zero-days to reach and sabotage Iranian centrifuge controllers. Zero-day brokers and exploit markets exist specifically because unpatched, undisclosed vulnerabilities in widely deployed software (browsers, mobile OS, VPN appliances) command high prices from both offensive security vendors and nation-state buyers, which is part of why some vulnerabilities stay zero-days for years before anyone outside a small circle knows they exist.