Hacker News Reader

How would they know that a zero-day that they discover is being actively exploited?

They have examples of malware that use that exploit?

...perhaps gathered from honeypots or spear-phishing observed in gmail.

Usually because either them or a high profile customer was hacked with it.