What is a zero-day vulnerability?
Any security flaw or vulnerability in a computer system that its owners or developers don’t know about.
Why are they a problem?
Because the owner might not find out about them until a hacker takes advantage of the oversight. And since hackers catch developers unaware, they could do a lot of damage before it is fixed. When this happens, it’s called a zero-day exploit or zero-day attack.
How big of a problem are they?
Google’s Threat Analysis Group observed 97 instances of zero-day exploits last year — a 50% increase from 2022, though slightly behind the record of 106 set in 2021. Among the attacks, 61 impacted end-user systems (think phones, operating systems, and browsers), with the rest hitting enterprise (like security systems and data storage).
Who is doing them?
Google could figure out motivations for only 58 of the attacks, but 10 of those were financially motivated hackers and scammers, while 48 were espionage actors (yes, we mean spies).
How can I protect myself?
A lot of that is on the companies to discover and fix a zero-day, but you have your part to play too. Once a security patch comes, it’s up to you to update your device/browser/software, otherwise you’re still a sitting duck.