Vulnerabilities

A zero-day is a security flaw that is unknown to the software vendor — meaning they have had zero days to create a patch. Attackers who discover zero-days can exploit systems freely until the vendor learns about the issue and releases a fix. Nation-state hacking groups and criminal organisations actively discover and trade zero-days, sometimes paying millions of dollars for critical ones targeting widely used software.

Yes, especially for critical and high-severity patches. The most common real-world attacks exploit known vulnerabilities that already have patches available — attackers count on users delaying updates. Enable automatic updates for your operating system, browser, and security software. If you want to avoid rare first-day bugs in major updates, wait 24-48 hours, but then install without further delay.

CVE (Common Vulnerabilities and Exposures) is a public database that assigns a unique ID to each documented security flaw (e.g., CVE-2024-12345). Each CVE has a CVSS severity score from 0 to 10 — anything 9.0 or above is critical. When a patch is released for a specific CVE, it means attackers know the details and exploitation attempts often increase immediately after disclosure.

Remote code execution (RCE) vulnerabilities are considered the most dangerous — they allow an attacker to run arbitrary commands on your system without any interaction from you. Memory corruption flaws like buffer overflows and use-after-free bugs are common RCE vectors. SQL injection and authentication bypass vulnerabilities are also high-impact as they give direct access to databases and accounts.

Check the National Vulnerability Database (NVD) at nvd.nist.gov and search the software name. Subscribe to security advisories from vendors you use (Microsoft Patch Tuesday, Apple Security Updates, etc.). For open source software, watch the project's GitHub security advisories. Tools like Snyk or OWASP Dependency-Check can automatically scan your software dependencies for known vulnerabilities.