A zero-day exploit is a cyberattack that targets a software vulnerability the software's developer doesn't yet know about. Because the developer has had zero days to patch the problem, defenders are left completely exposed. Zero-day exploits sit at the top end of the threat spectrum in cybersecurity, and they're the kind of weapon that both criminal groups and nation-state intelligence agencies spend serious money to acquire.
What makes a vulnerability "zero-day"?
Every piece of software has bugs. Most bugs are harmless quirks, but some create security holes that attackers can push through. A vulnerability becomes "zero-day" the moment a researcher or criminal finds it before the software maker does. From that point, the vendor has had zero days of warning. The clock doesn't start for the developer until they're told the flaw exists.
Once the vendor learns about the vulnerability and releases a patch, the exploit is no longer technically a zero-day. It becomes a known vulnerability. Most users are still at risk if they haven't updated their software, but the "zero-day" label specifically describes that window of ignorance.
How a zero-day attack actually unfolds
The process follows a consistent pattern. A researcher or attacker discovers the flaw first. This might happen through manual code review, fuzzing tools that throw random inputs at a program until it breaks, or reverse-engineering a software update to find what the previous version was hiding.
The attacker then writes exploit code designed to trigger the vulnerability. That code gets delivered to a target through phishing emails, a compromised website, or a malicious file attachment. When the victim opens the file or visits the page, the exploit runs. The attacker gains access, often without the victim seeing anything unusual at all.
Speed matters enormously here. The gap between discovery and patch can last days, weeks, or in some cases years. During that window, every unpatched system running the vulnerable software is a target.
Who finds and uses zero-days?
Zero-days are found by three main groups, and their intentions couldn't be more different.
- Security researchers: Independent researchers and teams working inside companies like Google's Project Zero find vulnerabilities and report them responsibly to the vendor, giving developers time to patch before publishing details.
- Criminal groups: Organised cybercrime operations hunt for zero-days to deploy ransomware, steal financial credentials, or sell access to compromised systems.
- Government agencies: Intelligence organisations in countries including the United States, Russia, China, and Israel develop or purchase zero-day exploits for espionage and offensive operations. The US Cybersecurity and Infrastructure Security Agency publishes advisories when known exploits are actively being used in attacks.
There's also a legal grey market for zero-days. Brokers sell verified exploits to buyers willing to pay, with prices ranging from tens of thousands to millions of dollars depending on the software affected and the reliability of the exploit.
Real-world examples that changed everything
Stuxnet is the most famous zero-day attack in history. Discovered in 2010, Stuxnet used four separate zero-day vulnerabilities in Windows to target industrial control systems inside Iranian nuclear facilities. It physically damaged centrifuges by making them spin at incorrect speeds while reporting normal operation to operators. The attack is widely attributed to US and Israeli intelligence agencies.
In 2021, attackers exploited four zero-days in Microsoft Exchange Server to compromise at least 250,000 servers globally before Microsoft issued emergency patches. Small businesses, law firms, and local councils were among the victims. The attack exposed just how quickly a single unpatched flaw can scale into a global incident.
Australia hasn't been immune. The Australian Cyber Security Centre has warned on multiple occasions about zero-day exploits being used in attacks on Australian government and critical infrastructure networks.
How zero-days differ from other attacks
A brute force attack works by grinding through possibilities until something gives way. Zero-days are the opposite: surgical, quiet, and often invisible to standard defences. Traditional antivirus software looks for known signatures of malicious code. A zero-day exploit has no known signature yet, so antivirus tools frequently miss it entirely.
Firewalls and network monitoring tools can sometimes catch unusual behaviour after an exploit runs, but they're not designed to block a threat nobody knew to look for. This is what makes zero-days particularly dangerous for organisations that rely on perimeter security alone.
What individuals and organisations can do
No defence is complete against a genuine zero-day, but several practices cut risk significantly.
Patching quickly is the single most effective step. The moment a vendor releases a security update, the vulnerability becomes public knowledge. Attackers immediately pivot to targeting systems that haven't been patched yet. Delaying an update by even a week dramatically increases exposure.
Network segmentation limits damage when a breach does occur. If an attacker gains access to one system, segmentation stops lateral movement through the rest of the network. Strong endpoint detection tools that watch for abnormal behaviour, rather than just known malware signatures, also help catch exploitation in progress.
For individuals, keeping operating systems and apps updated automatically removes much of the risk. Software companies issue patches in direct response to discovered vulnerabilities. An unpatched phone or laptop from two years ago carries known weaknesses that attackers actively scan for.
The responsible disclosure debate
When a researcher finds a zero-day, the ethical path is "responsible disclosure": report the flaw privately to the vendor and give them a reasonable window (typically 90 days) to patch before going public. Google Project Zero popularised this standard, and most major vendors now operate bug bounty programs that pay researchers for submitting valid vulnerabilities. Microsoft, Apple, and Google each run bounty programs paying up to $1 million or more for critical flaws in their core platforms.
The debate sharpens when governments stockpile zero-days rather than disclose them. Security researchers argue that hoarded exploits eventually leak, as happened with the NSA's EternalBlue exploit in 2017. EternalBlue was stolen from the NSA and later weaponised in the WannaCry ransomware attack, which hit hospitals, telcos, and banks across 150 countries inside 48 hours.
Zero-day exploits aren't going away. The financial value of a working exploit against widely deployed software keeps growing, which means the search for undiscovered flaws keeps intensifying.