It may seem pedantic, but since this vulnerability is publicly known since months back, and furthermore has been exploited in the wild (according to description in the target article), is it not per definition not a 0day.
This wasn't discovered by a security researcher looking for holes. This was discovered by a virus scanning company that realized people were actively being attacked using this method.
Everyone else has known about it for exactly 2 hours.
0day means no patch is available, whether the vulnerability is known privately/publicly or not
I’m a fan of letting context infer meaning. And letting certain words just naturally grow to whatever the culture wants it to. It’s always hard to fight back against it.
There’s a million examples of this on the internet where people try to be pedantic about slang or word usage. All that matters is “we know what you mean”. I like to assume enough people here know the real difference zero days vs existing vulnerabilities are. But in practice it matters less.
I still think that your usage of "0-day" breaks down precisely in the case we're in currently, where the vulnerability has been exploited in the wild and Microsoft has known about it for some time, but there is not a patch available, and the general public (everyone who has to defend against the exploit) found out about it today.
The most valuable time of an exploit is not the time of discovery, but the time of resolution.
Sorry my reply came so late.
like "We need to control the optics of the situation"
"I flashed my cellphone but it failed and now it's bricked."
but the unsophisticated public gets it wrong and now here we are, every recent unpatched exploit is now 0day
It doesn't sound wrong to me, both "flash" and "brick" are correct in an appropriate context. It's not "updating the system" but "flashing" if the process uses some low-level recovery mode, and it would be "bricked" if can no longer be recovered by usual means.
I guess the definition varies, it was what I meant by "an appropriate context".
The difference is that the recovery is almost a full blown operating system. It can mount filesystems, has various shell utilities installed, and there's a user interface (through ADB and on-screen). This in contrast to fastboot which has noneof those things, and only allows you to flash/erase partitions with the help of a computer.
And for a number of years I only thought a zero-day defect was something that had existed since that version of DOS or Windows was issued, regardless of when or whether it was discovered, patched, exploited or not.
Eventually I got the idea that people just don't want to count back that far.
An alternative title could include "actively used" or similar to maybe be more clear.
The exploit was a 0-day at one point in time. Furthermore, I'd argue that the perspective of the one talking also matters. If Microsoft etc know about it, but haven't patched it or made anything public, it's definitely a 0-day if used against me, as I haven't had any opportunity to defend against it.
0-day versus "publicly disclosed unpatched vulnerability" doesnt help anyway
If you want to use the "day" framing, the appropriate headline is "90-day exploit still not fixed". The entire point is that it's an old exploit that is still unpatched, and not some new discovery.
"A zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to those who should be interested in mitigating the vulnerability (including the vendor of the target software)."
Personally I have always used it as "there is not mitigation / patch available". Thanks for pointing me in the proper direction.
Edit: I am old and stubborn, I still use 'hacker' as a compliment.