How Many Zero-Days Hit You Today?
Summary: Research by NSS Labs' Stefan Frei, drawing on reports from boutique exploit vendors including Endgame Systems, Exodus Intelligence, Netragard, ReVuln and VUPEN, concluded these firms alone can sell more than 100 zero-day exploits per year. Applying Symantec's estimate that a zero-day persists about 312 days before detection, Frei calculated these vendors probably provide access to at least 85 zero-day exploits on any given day.
What you should know: Leaked Snowden documents cited in the piece show the NSA spent more than $25 million in one year buying vulnerabilities, and the boutique firms selling them expressly do not share flaw information with the affected software vendors - so the defenders patching your stack may never learn what is circulating.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026