Zero-Day Vulnerability

Also Known As

TL;DR

Explanation

A zero-day (0-day) is a vulnerability that the software vendor is unaware of, meaning zero days have passed since they learned of it and zero days have been available for a patch. Zero-days are highly valuable — they are sold on black markets, used by nation-state actors, and exploited before any mitigation exists. Defences against zero-days rely on layered security: network segmentation, least privilege, behaviour-based detection (WAF, EDR), input validation, and patch agility so that when a patch is released, deployment is measured in hours not weeks.

Common Misconception

Why It Matters

Common Mistakes

• Over-relying on signature-based defences (WAF rules, AV) that have no signature for a zero-day.
• No network segmentation — a zero-day in one service provides access to all services on the flat network.
• No anomaly detection — zero-days are invisible to rules-based systems but visible as behavioural anomalies.
• Not subscribing to vendor security advisories — organisations learn about zero-days after exploitation instead of at disclosure.

Avoid When

• Do not delay patching once a zero-day is disclosed and a fix is available — the exploitation window shrinks fast.
• Do not rely on security through obscurity as a zero-day mitigation.

When To Use

• Apply defence-in-depth — WAF, least privilege, network segmentation — to reduce zero-day impact before a patch exists.
• Subscribe to vendor security advisories and CVE feeds to minimise the window between disclosure and patching.

Code Examples

// Over-reliance on signature-based WAF for zero-day protection:
// WAF rules updated weekly from vendor signatures
// Zero-day exploit uses novel payload — no signature exists
// WAF passes request → application exploited
// Defence in depth: WAF + behaviour monitoring + least privilege
// + network segmentation + anomaly detection + rapid patching SLA

# Zero-day: no patch exists yet — layered defence is the only mitigation

# 1. Virtual patching at WAF (ModSecurity / Cloudflare)
#    Blocks known attack patterns before PHP is even reached

# 2. Least privilege — limit blast radius
#    PHP-FPM runs as www-data, can't reach internal services

# 3. Disable dangerous functions proactively
; php.ini
disable_functions = exec,system,shell_exec,passthru,proc_open

# 4. Monitor for anomalies (PHP shouldn't spawn shells or make unusual connections)

# 5. Fast patching — subscribe to PHP security announcements:
#    https://www.php.net/releases/
#    Apply security releases within 24 hours

# 6. Immutable infrastructure — redeploy clean images after any incident

References

• ↗ https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• ↗ https://nvd.nist.gov/

Tags

Related Terms