What Is a Zero-Day? Vulnerabilities, Exploits and Patches Explained

The vocabulary of software security made plain: what a vulnerability, an exploit and a patch are, why some attacks are called zero-days, what a real security advisory looks like, how researchers and vendors coordinate disclosure, what a severity score does and does not tell you, and what to do when a fix is not ready yet.

0:26 Vulnerability, exploit, patch

A vulnerability is an unintended flaw; an exploit is code that takes advantage of it; a zero-day exploit hits a flaw that has no fix yet.

Sources: Cloudflare Learning Center (original) · Google Project Zero (original)

2:03 Reading a real advisory

A real vendor advisory for an email security appliance: a path traversal flaw letting an attacker with no login write files, reported exploited in the wild, with a workaround and signs of compromise.

Sources: Fortinet PSIRT (original) · MITRE CWE-22 (original)

3:32 When do researchers go public?

Under coordinated disclosure, researchers report flaws privately so the vendor can ship a fix first; Project Zero's deadline is ninety days, or seven if the flaw is under attack.

Sources: Microsoft Security Response Center (original) · Google Project Zero (original)

4:55 What a severity score tells you

CVSS scores a vulnerability from zero to ten; nine to ten is critical, but the base score measures severity, not the risk to you.

Sources: FIRST (original)

6:17 What to do when the fix isn't ready

Patch quickly, use the vendor's workaround when there is no patch yet, look for signs of compromise, and reduce exposure.

Sources: Google Project Zero (original) · Fortinet PSIRT (original) · Cloudflare Learning Center (original)

Follow the show in your podcast app to get each new episode as soon as it is out.

Produced by Juan Pablo.