What Is a Zero-Day Exploit?

The most dangerous kind of cyberattack — a vulnerability the vendor does not even know exists.

↓

Lifecycle

The Zero-Day Lifecycle: 6 Stages

From discovery to patch — the window of maximum danger.

🔍

1. Discovery (Bug Found)

Tap to flip

A previously unknown vulnerability is discovered — either by a security researcher (white hat), a hacker (black hat), or a nation-state. It could be a bug in an OS, browser, VPN, router, or any software. The vendor has zero days of notice — hence the name.

⚙️

2. Weaponisation (Exploit Built)

Tap to flip

The discoverer writes code that takes advantage of the bug — the exploit itself. This could allow remote code execution, privilege escalation, or data theft. At this stage, only the discoverer knows about it. No patch exists.

🎯

3. Deployment (Attack Launched)

Tap to flip

The exploit is deployed against targets. This could be a broad spray (email campaigns) or a surgical strike (specific company, government). In 2024–2025, edge devices like VPNs and firewalls were the most common zero-day targets. ^[1]

⚠️

4. Discovery by Vendor (Detected)

Tap to flip

The vendor learns of the exploit — either from their own monitoring, a researcher report, or public evidence of attacks. A scramble begins to develop a patch. This is the "day zero" the name refers to: the moment the vendor finds out.

🛠️

5. Patch Development (The Race)

Tap to flip

Engineers work around the clock to develop, test, and ship a security patch. For critical vulnerabilities (like Log4Shell or CitrixBleed), CISA may issue a 24-hour deadline for federal agencies to patch. Meanwhile, attackers race to exploit as many unpatched systems as possible.

🛡️

6. Patch Deployed (Window Closes)

Tap to flip

The patch is released and systems are updated. The vulnerability is no longer "zero-day" — it is now a known, patched vulnerability. But unpatched systems remain vulnerable for years. In 2025, organisations were often exposed for months before vendors released patches. ^[2]

Famous Attacks

5 Devastating Zero-Day Exploits

Real-world attacks that exploited unknown vulnerabilities.

🛡️

Stuxnet (2010)

Tap to flip

The most famous zero-day. A US-Israeli operation that used 4 zero-day exploits to destroy Iranian nuclear centrifuges. It was the first known cyberattack to cause physical damage. Changed how the world thinks about cyber warfare.

🔥

Log4Shell (2021)

Tap to flip

A zero-day in the Log4j Java logging library — used by millions of servers worldwide. Remote code execution via a single line of text. Max severity (CVSS 10.0). Took months to fully patch. One of the worst vulnerabilities ever discovered.

📶

Pegasus (2016–2023)

Tap to flip

NSO Group’s Pegasus spyware used zero-day exploits in iOS and Android to remotely compromise phones — no user interaction needed. Targeted journalists, activists, and politicians worldwide. Led to international sanctions against NSO Group.

🛠️

CitrixBleed (2025)

Tap to flip

A zero-day in Citrix networking appliances (CVE-2025-5777). Widely exploited before a patch existed. CISA issued an unusually short 24-hour deadline for federal agencies to patch affected systems. Edge devices accounted for over half of enterprise zero-days in 2025. ^[3]

🌐

Kaseya VSA (2021)

Tap to flip

Russian REvil gang exploited a zero-day in Kaseya’s IT management software to push ransomware to 1,500+ businesses through a single supply-chain attack. Attackers demanded $70 million. Led to emergency shutdowns across 17 countries.

📈

2025 Zero-Day Stats

Tap to flip

In 2024–2025: edge devices (VPNs, firewalls) were the #1 target. North Korea tied with China for most zero-days exploited in the wild (5 each). Finance sector was the most targeted industry (17% of zero-day investigations). ^[1]

Quiz

Zero-Day Knowledge Check

6 statements. TRUE or FALSE?

About the term "zero-day":

A "zero-day" vulnerability is one that the software vendor has zero days of notice to fix.

About how they are found:

Zero-day vulnerabilities are always discovered by malicious hackers.

About patching:

Once a patch is released, the vulnerability is no longer a zero-day.

About the impact:

Zero-day exploits are only used by nation-state actors against governments.

About Stuxnet:

The Stuxnet attack used multiple zero-day exploits to cause physical damage.

About the most targeted sector:

The healthcare sector was the most targeted by zero-day exploits in 2024–2025.

Risk Level

How Dangerous Is a Zero-Day?

Not all zero-days are equal — from minor annoyance to global crisis.

050100

Slide to assess

Protect Yourself

How to Defend Against Zero-Days

You cannot prevent zero-days from existing. But you can minimise their impact.

Patch everything, especially edge devices

VPNs, firewalls, and routers were the #1 zero-day target in 2024–2025. Patch them FIRST. Enable auto-updates for all network equipment.

Use endpoint detection and response (EDR)

EDR tools (CrowdStrike, SentinelOne, MS Defender) detect exploit behaviour, not just known signatures. They can block attempts even against unknown vulnerabilities.

Principle of least privilege

Do not run as admin unless necessary. A zero-day exploit that gains user-level access is far less dangerous than one that gains admin/root access immediately.

Network segmentation

If the exploit hits one system, segmentation prevents it from spreading to the rest of the network. Separate critical systems from general purpose machines.

Application allowlisting

Only allow authorised software to run. Many zero-day exploits drop executable files that allowlisting would block by default.

Monitor CISA KEV catalog

CISA maintains a Known Exploited Vulnerabilities catalog. Subscribe to alerts. If an exploit hits software you use, you know within hours, not weeks.

Assume breach, plan accordingly

The most effective mindset: assume a zero-day will eventually compromise something. Have backups, incident response plans, and offline recovery procedures ready.