A zero-day vulnerability is a security flaw in software that nobody knows about yet, except the people who found it first. The name comes from the fact that the software maker has had zero days to fix it. There is no patch, no update, and no warning. That makes a zero-day one of the most dangerous problems in cybersecurity, because attackers can use it before anyone has a chance to defend themselves. It sounds like a rare, technical problem, but zero-day attacks have affected ordinary people, hospitals, schools, and small businesses, not just governments and large companies.
This guide explains zero-day vulnerabilities in plain English. You will learn what a zero-day is, how attackers find and use these flaws, what a real zero-day attack looks like, and what you can do to protect yourself. You do not need a technical background to follow it, and the steps at the end are simple habits that help against many kinds of attack, not just zero-days.
What Is a Zero-Day Vulnerability?
Every program, app, and operating system is made of millions of lines of code, and it is almost impossible to write that much code without any mistakes. A vulnerability is a mistake in that code that lets someone do something they should not be able to do, such as read private files, run their own program, or take control of a device. Most vulnerabilities are found by researchers or by the software maker, fixed with a security update, and then made public, so users can protect themselves by updating.
A zero-day vulnerability is different because it is secret. It may have been found by a security researcher who reported it privately, by a criminal group, or by a government agency, and the software maker does not know about it yet, or knows about it but has not had time to release a fix. During that window, which can last days, weeks, or even months, there is no official defence. Anyone who knows about the flaw can use it, and the people who might be attacked do not even know they need to be careful.
It helps to compare the three words in the name. Zero refers to the zero days the maker has had to fix the problem. Day is the clock that starts once the flaw is discovered. Vulnerability is the flaw itself. A related term is zero-day exploit, which is the actual method or piece of code an attacker uses to take advantage of the vulnerability. You will often see the two terms used together: the vulnerability is the unlocked door, and the exploit is the act of walking through it.
How Do Attackers Find Zero-Day Flaws?
Attackers find zero-day flaws in several ways. Some are skilled programmers who read code carefully, looking for places where a program trusts input it should not trust, or where it handles memory in an unsafe way. Others use automated tools that feed a program thousands of strange, unexpected inputs and watch for crashes or odd behaviour, a method called fuzzing. A crash often points to a flaw that could be turned into an exploit with more work.
Zero-day vulnerabilities are also bought and sold. A flaw in a popular product such as a web browser, a phone operating system, or an email program can be worth a lot of money. Security companies buy them to protect their customers, governments buy them for intelligence work, and criminal groups buy them to attack victims. There is a legal market for this research, and a hidden market too, which is one reason a flaw can stay secret for a long time after it is found.
Not every zero-day is found by a genius hacker working alone. Sometimes a flaw is discovered by accident, when a program fails in a normal task. Sometimes it is found by a researcher testing a new feature. The important point for ordinary users is that you cannot predict which programs have a hidden flaw. That is why the general habits of updating quickly, using strong passwords, and being careful with links and attachments matter so much: they reduce the damage even when a zero-day is in play.
How a Zero-Day Attack Works
A typical zero-day attack has a simple shape, even if the technical details are complex. First, the attacker learns about the flaw and builds an exploit, which is usually a file, a web page, or a message that triggers the flaw when the victim opens it. Second, the attacker delivers that exploit to the victim, often by email, by a link in a message, or by a hacked website. Third, when the victim opens the file or visits the page, the exploit runs, and the attacker gains access, often without the victim noticing anything wrong.
Once inside, the attacker can do the same things as other hackers: steal passwords and files, install spyware or malware, watch what the victim types, or use the victim’s computer to attack other people. The difference is that normal security software may not stop a zero-day attack, because the software does not know the attack yet. Antivirus programs recognise known threats, and a brand-new exploit does not match any of them. That is why zero-day attacks are often used against high-value targets first, such as journalists, company executives, or government workers, before the method spreads more widely.
Eventually, someone notices the attack. A researcher may spot strange behaviour, a victim may report a problem, or the software maker may find the flaw during its own testing. At that point, the maker rushes to build a patch, and the clock for everyone else starts. Users who update quickly are protected. Users who ignore the update stay exposed, even after the flaw is public, because attackers can now copy the exploit from the public information about the fix.
Real Examples of Zero-Day Attacks
One of the best-known cases is Stuxnet, a piece of malware discovered in 2010 that used several zero-day flaws in Windows to attack industrial equipment. It was designed to damage machinery used in nuclear work, and it showed the world that zero-day attacks could cause physical damage, not just steal data. Another famous case is the Pegasus spyware, which used zero-day flaws in phones to install spying software without the owner clicking anything. The victim only had to receive a message, and the phone was infected silently.
More recent examples are closer to everyday life. In 2021, attackers used zero-day flaws in Microsoft Exchange email servers to break into thousands of organisations, including small businesses and schools, and steal emails. In 2023, a zero-day in a popular file-transfer tool called MOVEit was used to steal data from hundreds of companies and government departments around the world. In both cases, the software maker released a patch as soon as it knew about the flaw, but many users had not installed it yet, and attackers moved quickly to exploit the delay.
These examples show a pattern. Zero-day attacks are often discovered only after they have been used, the patch comes later, and the people who update fastest are the safest. They also show that a zero-day in a single popular product can affect millions of people at once, because so many people use the same browsers, email programs, and operating systems.
Can You Protect Yourself From a Zero-Day Attack?
You cannot prevent zero-day vulnerabilities from existing, and you cannot know about a flaw before the maker does. That does not mean you are helpless. Most of the damage from a zero-day attack can be limited by the same habits that protect you from other attacks, and those habits are worth building now.
- Update fast: install security updates for your operating system, browser, and apps as soon as they appear. This closes the flaw once a patch exists.
- Turn on automatic updates: so you do not have to remember to check, and so patches arrive even when you are busy.
- Use a modern browser: it can block many malicious pages and files before they reach your computer.
- Be careful with links and attachments: do not open unexpected files, even from people you know, without checking first.
- Use two-factor authentication: so a stolen password alone is not enough for an attacker to get into your accounts.
- Back up your files: so you can recover if an attack damages or encrypts your data.
For businesses, extra steps help. Keep a list of the software you use, so you can check quickly whether a new zero-day affects you. Use different accounts with different levels of access, so an attacker who gets into one account cannot reach everything. Keep important systems separate from the internet where possible, and make sure your backups are tested, not just created. If you think your information may have been exposed in a breach, follow the steps in our guide to what a data breach is and what to do if your information leaks.
What Should You Do When a Zero-Day Is Announced?
When a major zero-day is announced in the news, do not panic, but do act quickly. First, check whether the affected software is something you use. The news report or the software maker’s website will usually name the product and the versions affected. Second, look for an official patch or update from the maker, and install it straight away. Do not download a fix from a random website or a link in an email, because attackers often send fake fixes during a real incident.
Third, if the maker has suggested a temporary workaround, such as turning off a feature until the patch is ready, follow it. Fourth, change your passwords for the affected service if the advice says to do so, and check your accounts for unusual activity. Finally, if you run a website or a business, tell your team what to watch for, and check your systems for signs of the attack. Acting in the first few hours after a patch is released is the best protection you have, because attackers know that many people delay updates.
Conclusion
A zero-day vulnerability is a hidden flaw with no fix yet, and a zero-day attack uses that flaw before anyone can defend against it. You cannot stop these flaws from existing, but you can make yourself a much harder target. Update your software quickly, turn on automatic updates, use two-factor authentication, be careful with links and attachments, and back up your files. Those simple habits will not make you invincible, but they will protect you from most attacks, including many zero-days, once a patch is available.
Frequently Asked Questions
What does zero-day mean?
Zero-day means the software maker has had zero days to fix a flaw, because it was only just discovered. There is no patch yet, so the flaw can be used by attackers before a defence exists.
Is a zero-day attack the same as a virus?
No. A zero-day is a flaw in software, and an attack uses that flaw to get in. A virus or malware is the harmful software that may be installed once the attacker is inside. A zero-day is the way in, not the harmful program itself.
Can antivirus software stop a zero-day attack?
Not always. Antivirus software recognises known threats, and a new zero-day exploit may not match anything it knows about. Modern security software can sometimes spot suspicious behaviour, but the best defence is to install the official patch as soon as it is released.
How common are zero-day attacks?
They are rarer than phishing and ordinary malware, but they happen regularly. Dozens of zero-day flaws are found in major products every year, and a single flaw in a popular product can affect millions of users.
Should I worry about zero-day attacks as an ordinary user?
You should be aware of them, but not afraid of them. Most ordinary users are not the first target of a zero-day attack. The best response is to keep your software updated, use two-factor authentication, and be careful with links and attachments.