A zero-day is a security weakness that attackers use before the maker has released a fix, so there were zero days to prepare. The word is about timing, not severity: the weakness is already in use, or known to attackers, while no official fix exists yet.
What is a zero-day?
The moment that matters is the gap before an official security patchA security patch is a software update that closes one known security weakness and adds nothing else, so installing it protects you against that problem. exists to close the weakness.
A normal flaw follows a sequence. Someone finds it, reports it to the maker, the maker builds a fix, publishes an advisory and site owners install the update. Most flaws never leave that orderly route. A zero-day breaks the sequence: attackers find or buy the flaw first and use it while the maker does not know about it, or knows but has no fix yet.
You will often see the phrase “zero-day exploit”. That means the exploitAn exploit is a piece of code or a method that turns a software weakness into a real attack. A proof of concept only shows that the attack works. for an unfixed vulnerabilityA vulnerability is a weakness in software that an attacker can use to do something the software was never meant to allow, such as reading private data.. Once a fix is released, the same flaw is no longer a zero-day. It becomes an ordinary known vulnerability, and the question changes from “can it be stopped” to “have you installed the update”.
Why the word is overused
Headlines like to call every serious flaw a zero-day, because it sounds urgent. That is not accurate and it makes people anxious for no good reason. If a flaw was announced together with a fix, and no one reports use before that point, it is not a zero-day, however severe it is. Check the facts: who says it was used, and since when?
What it means for a PHP or WordPress site
For most site owners, the realistic risk is not a mysterious unfixed flaw, but a known flaw with a fix that has not been installed. An old WordPress pluginA WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop. with a public update waiting is a far more common entry point than a true zero-day.
That is good news, because it is in your hands. Keeping PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it., the CMSA content management system (CMS) is software that lets you edit the pages, texts and images of your website by logging in, without writing any code. and plugins up to date, removing what you do not use and having a tested backupA backup is a separate copy of your website's files and database, so you can bring the site back after a mistake, a hack or a failed update. beats worrying about unknown flaws. The CISA KEVCISA KEV is a list kept by the US cybersecurity agency CISA of security weaknesses that attackers are known to have used in real attacks. catalog is one of the places where use of a flaw in the real world is recorded, which helps separate real zero-days from headlines.
A concrete example
For the two PHP vulnerabilities fixed on 21 October 2026, the PHP project released fixed versions on that date. php.net and CISA do not report exploitation in the wild, and the CISA catalog did not list the flaws at our last check. That does not prove nobody is exploiting them, but it means the usual zero-day situation does not apply: there is no wait for a fix. A fix exists, and the sensible step is to install it. Our PHP2Shell page keeps the status with sources.
When to act
With a real zero-day, follow the maker’s interim advice: a setting, a disabled feature or a rule at your host, until the fix arrives. Then install the fix quickly. If you see signs of misuse such as unknown files, strange redirects or new admin users, ask us to fix your WordPress website right away.
Between incidents, the best investment is a calm routine: a security advisoryA security advisory is an official notice from a software maker about a security weakness: what it is, which versions are affected and how to fix it. check for the software you run, and a short path from advisory to update. If that path is slow because the site is old, we can help you update PHP in WordPress.
Frequently asked questions
Why is it called a zero-day?
Because the maker and everyone defending systems had zero days to prepare. The flaw is already being used, or is known to attackers, before a fix exists.
Is every serious vulnerability a zero-day?
No. Most serious flaws are found and fixed before anyone uses them. The word describes use before a fix, not how severe the flaw is.
Can I protect my site against a zero-day?
Not completely, because no fix exists yet. You can reduce the damage by keeping software minimal, removing unused plugins, limiting logins and keeping tested backups. When the fix arrives, install it quickly.
Is a newly announced flaw a zero-day?
Not by itself. A flaw announced together with a fix is not a zero-day. It becomes one only if there is evidence that attackers used it before the fix was available.