A vulnerability is the flaw; an exploit is a method for using it; an attack is an attempt against a target. NIST defines a zero-day attack around exploiting a previously unknown vulnerability (NIST, zero-day attack). A discovery or proof of concept does not, by itself, establish that anyone successfully attacked your service. Keep those facts separate when reading an incident report.
Consider a hypothetical dependency flaw reported privately to its maintainer on Monday. The researcher has found a vulnerability. A working script demonstrates an exploit. Evidence that the script was used against a production service is another event to investigate. Record the vendor-notification, public-disclosure, patch and observed-exploitation dates separately instead of collapsing them into one clock.
Using disclosure as the milestone in the show’s discussion, Dan Lorenc says, “Zero day is something that’s exploited before it’s disclosed.” (episode 68, 3:42).
That framing explains the episode’s argument about exploitation happening before disclosure. It does not tell you whether your particular deployment is affected. For builders, map an advisory to your installed versions, reachable code and available mitigations. Time to exploit defines the timing comparison, and the AI security hub connects the conversation to prompt attacks and agent permissions.
Sources
- NIST, zero-day attack — Primary source for the explanation and distinctions in this entry.
