Hacker News Reader

The way I understand it a zero-day vulnerability is actively being abused, thus you have zero days to fix it. But I can be wrong

It doesn't need to be actively used. It just needs to have the potential to be actively used, and still need to fix it right away in case it is.