Zero-day
0-day · zero-day vulnerability · zero-day exploit · unpatched vulnerability · faille zero-day
A vulnerability exploited by attackers before the vendor knows about it or has released a patch, leaving defenders with “zero days” to prepare.
In practice
A zero-day is valuable: it is used first by state-backed attackers or well-funded criminal groups, often against internet-facing equipment (VPNs, firewalls, mail servers). With no patch available, defence relies on reducing exposure, segmenting networks, detecting abnormal behaviour and applying published workarounds at once. Once the patch is out, the flaw becomes an “n-day” and mass exploitation often begins.
In January 2024, flaws in Ivanti Connect Secure VPN gateways were being exploited before any patch existed. CISA ordered US federal agencies to apply emergency mitigations, then to disconnect the devices by 2 February 2024 at the latest.
How to protect yourself
- Limit what is exposed to the internet, starting with administration interfaces.
- Apply vendor or national CERT workarounds without delay, rather than waiting for the patch.
- Centralise logs and deploy behaviour-based detection (EDR) to spot exploitation.
- Segment the network so that one compromised device does not open up everything.
