Photo: Markus Spiske on Unsplash
What is a zero-day? Security flaws explained
In short: A zero-day is a security flaw that attackers exploit before the maker has released a fix, so defenders have had "zero days" to patch. Google counted 90 zero-days used in attacks in 2025, about half against business systems such as VPNs and firewalls. You cannot patch a zero-day yourself, but quick updates, strong sign-in and good habits limit the damage.
What the name means
Software contains mistakes. Some are vulnerabilities: weaknesses that let an attacker do something they should not, such as run their own code. Usually a vulnerability is found by a researcher or the maker, fixed and then announced. A zero-day is different: attackers discover and use it before a fix exists, so the maker has had zero days to respond.
The tool or technique that takes advantage of the flaw is called an exploit. Once a fix is released, the flaw is no longer a zero-day, but it becomes an "n-day": a known flaw that is dangerous on any device that has not been updated.
How common are they?
Google's Threat Intelligence Group tracked 90 zero-days exploited in attacks during 2025, up from 78 in 2024. About half targeted business products, especially security appliances, networking equipment, VPNs and virtualisation platforms. The rest targeted end-user platforms such as phones, browsers and operating systems. Microsoft, Google and Apple products were the most affected by number.
Who uses zero-days?
- Commercial spyware companies and their government customers, which Google found were the largest users in 2025.
- State-backed espionage groups targeting governments, defence and technology companies.
- Criminal groups, including ransomware gangs, though they more often rely on flaws that already have fixes.
Zero-days are expensive to find and lose their value once discovered, so they are usually used carefully against specific targets rather than everyone.
Why ordinary users still need to care
Most people will never be the target of a zero-day. But once a fix is released, details often spread quickly and wider attacks follow within days. Our article Plex2Shell is a recent example. The gap between "fixed" and "installed" is where most real-world damage happens.
What you can do
- Install updates quickly, especially ones described as fixing actively exploited flaws. See Keeping your devices updated.
- Restart your browser and phone regularly so updates take effect.
- Use strong sign-in: passkeys or 2-step verification limit what an attacker can do even after a break-in.
- Turn on extra protection modes if you are at higher risk, for example as a journalist or activist. Apple's Lockdown Mode and Android's Advanced Protection reduce the ways attackers can reach your phone.
- Keep backups so you can recover if something goes wrong.
Tip: When an update note says a flaw "may have been actively exploited", treat it as urgent and install it the same day.
See also CISA's Known Exploited Vulnerabilities list explained, and our technical note on CVE, CVSS and EPSS.
Why fixes sometimes take time
Once a maker learns about a zero-day, it has to understand the flaw, write a fix, test it on many device models and release it without breaking anything. That can take days or weeks. In the meantime, makers and security agencies often publish temporary workarounds, such as switching off a vulnerable feature. Following those instructions can matter as much as the final update.
Key takeaways
- A zero-day is a flaw attackers use before a fix exists.
- Google tracked 90 exploited zero-days in 2025, about half against business systems.
- Spyware vendors and state groups are the main users; criminals favour already-fixed flaws.
- Install updates fast, especially for actively exploited flaws, and use strong sign-in.
Sources and further reading
© 2026 FM TecHub. Original content written for FM TecHub. Share the link freely; please don't copy the text elsewhere without permission.