PATCH//NOTES Open the interactive version
← All lessons
Threats · Intermediate · 3 min

Zero-days

A bug the vendor has had zero days to fix.

What it is

A zero-day is a vulnerability attackers know about before the vendor does, so there's no patch yet. When it's being used in real attacks it's an 'in-the-wild zero-day'. They're rare and valuable, often used by nation-states or spyware vendors. Once a patch ships, it becomes an 'n-day', and the race is on: attackers reverse-engineer the patch while defenders try to install it.

Real case · 2021

Log4Shell

A flaw in Log4j, a logging library inside thousands of Java apps, let attackers run code just by getting a server to log a crafted string. It was exploited within hours of going public, and teams spent weeks just finding where Log4j was hiding.

Source: Wikipedia: Log4Shell

How defenders stop it

  • Know what software you run (an asset inventory and SBOM)
  • Layered defences so one bug isn't game over
  • Apply vendor mitigations quickly, before a patch exists
  • Monitor for unusual behaviour, not only known signatures

Try it yourself

Browse Google Project Zero's in-the-wild tracker

Check yourself

1. When does a zero-day stop being a zero-day?

  1. After 24 hours
  2. When the vendor releases a patch
  3. When it gets a CVSS score
  4. Never
Show answer

When the vendor releases a patch. Once a fix exists it's an n-day, but unpatched systems are still vulnerable.

2. What is an 'n-day'?

  1. A bug nobody has found yet
  2. A vulnerability with no CVE ID
  3. A bug found by AI
  4. A known vulnerability that already has a patch
Show answer

A known vulnerability that already has a patch. Once a patch ships, a zero-day becomes an n-day: attackers study the patch while defenders race to install it.

3. There's no patch yet for a zero-day in software you run. What helps most right now?

  1. Change your Wi-Fi password
  2. Apply the vendor's mitigations and watch for unusual behaviour
  3. Uninstall every program
  4. Wait quietly for the patch
Show answer

Apply the vendor's mitigations and watch for unusual behaviour. Vendors often publish workarounds before a fix, and behaviour monitoring catches attacks that signatures miss.

Answer them in the app to earn XP.

Next: Vulnerabilities & patching →