Can anyone explain what a zero-day vulnerability is? What's the difference between zero-day and non-zero-day vulnerabilities? I'm not getting much out of wikipedia.
A zero day vulnerability is one the manufacturer doesn’t know about or has had zero days of notice on (“zero days to fix”). An n-day vulnerability means the manufacturer has had that much time to deal with it before it goes public.
I believe this is the correct usage of the term, but it seems that articles now use it to mean any vulnerability of any kind regardless of disclosure/patch turnaround, which can add a lot of confusion when reading.
The way I understand it a zero-day vulnerability is actively being abused, thus you have zero days to fix it. But I can be wrong
It doesn't need to be actively used. It just needs to have the potential to be actively used, and still need to fix it right away in case it is.