Zero-day

Zero-day describes a vulnerability that the responsible maintainer does not yet know about, or for which no fix is available. The “zero” refers to the defender’s patching time. A zero-day exploit is the technique that abuses the flaw, while a zero-day attack is the real-world operation that deploys that exploit.

The label is about the defender’s knowledge and preparation, not necessarily the age of the bug. A flaw may have existed for years before discovery and still become a zero-day when an attacker finds it first. Once a vendor has a patch or public disclosure has moved the issue into ordinary remediation, the vulnerability is no longer a zero-day, although unpatched systems may remain exposed.

Defenders look for unusual behavior, exploit traces, privilege escalation, and traffic patterns that signatures cannot yet recognize. In AI infrastructure, the same risk can appear in model-serving software, orchestration layers, plugins, dependencies, and exposed APIs. Machine learning can help detect anomalies or discover bugs through fuzzing, but it does not remove the need for patching and containment.