Zero-Day Vulnerabilities
What Makes a Flaw a Zero-Day
A zero-day vulnerability is a security flaw that the software's maker does not yet know about or has had no time to fix, so the maker has had zero days to prepare a fix. Such a flaw is often described as a zero-day until a fix is released.
Attackers who find or obtain a way to exploit the flaw, called a zero-day exploit, can use it against websites before a patch is available. Defenders have no official fix to install, so the window of risk stays open for as long as the flaw is unpatched.
Why There Is No Patch Yet
Software is usually fixed through a sequence of steps. Someone discovers the flaw, reports it privately to the vendor, the vendor develops and tests a fix, and then a release is published for site owners to install. Each step takes time, and a flaw can be exploited during any of them.
Not every zero-day is exploited, and some are found by researchers who report them responsibly. Others are discovered by attackers, who may keep them secret and use them against chosen targets. Once a flaw becomes public or widely used, the vendor is under pressure to publish a fix quickly. Until then, sites running the affected software may be exposed even when they keep everything up to date, because no up-to-date version is safe yet.
Limiting the Damage Before a Patch Arrives
Owners cannot remove a flaw they have no fix for, but they can reduce what an attacker can do with it:
- Virtual patching: a web application firewall rule blocks the request patterns that exploit a known flaw. It buys time but may miss variations.
- Isolation: running services with limited permissions and separate accounts restricts what a compromised component can reach.
- Less exposure: removing unused plugins and services shrinks the number of components that could contain a flaw.
- Monitoring: watching access logs and file changes can reveal exploitation attempts or successful intrusions.
Once a fix is released, applying it promptly is the lasting answer. The timing and handling of updates are covered in security updates and patching.
Frequently asked questions
How is a zero-day vulnerability different from a known vulnerability?
A known vulnerability has been publicly identified and usually has an identifier and a fix or workaround. A zero-day has no available fix when it is exploited or disclosed. Once a patch is released, the flaw becomes a known vulnerability, and sites that have not installed the update remain exposed. Identifiers and severity scores are explained in what a CVE is.
Can a small website be targeted by a zero-day attack?
Yes, although attackers usually prefer targets with high value or wide exposure. Small sites are more often breached through known flaws in outdated software, which are easier to find. They can still be affected when a widely used component, such as a popular plugin or server package, has an unpatched flaw. Keeping software current and limiting what is installed reduces that risk.