Skip to content
audiotale.net
Sign in
GuidesExplainer

Zero-day vs n-day exploits: what they mean and how to keep your phone safe

A zero-day is exploited before a fix exists, an n-day after it. A November 2026 campaign built only from patched bugs shows why updates matter.

audiotale.net team

· 6 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. In short
  2. Zero-day and n-day: what the words mean
  3. Why n-days still work
  4. A real timeline
  5. How to protect yourself
  6. Questions people ask
  7. What to remember
  8. Sources

In short

A zero-day is a security flaw that attackers exploit before the vendor has released a fix, so defenders have had "zero days" to prepare. An n-day is a flaw that already has a fix; attacks that use one only work on devices that have not installed it. A report published on 4 November 2026 shows why the difference matters: Sekoia says a Russia-linked group infected phones with exploit chains made entirely of n-days, the oldest fixed more than two years earlier. The practical rule is simple. Installing updates stops n-day attacks, and for the rare zero-day, extra protections such as Apple's Lockdown Mode reduce the risk.

Zero-day and n-day: what the words mean

Security people count from the day a fix becomes available. Before that day, anyone exploiting the flaw has a "zero-day" advantage: nothing can be installed to stop it. After the vendor ships a patch, the flaw becomes an "n-day", where n is the number of days since the fix. Sekoia uses the term in exactly this sense when it says all vulnerabilities in the campaign it studied "were n-days", meaning they "had already been patched and attacks worked only on outdated versions", as Ars Technica summarised it.

Two other terms help:

  • CVE (Common Vulnerabilities and Exposures): a public ID such as CVE-2025-43529 that lets everyone refer to the same flaw. The US National Vulnerability Database (NVD) lists each entry with a description and the versions that fix it.
  • Exploit chain: a sequence of flaws used together. A web page might first run code inside the browser, then escape the browser's sandbox, then take over the operating system. Modern phones are hard to attack, so real-world attacks usually need several flaws in a row.

A flaw can move from one label to the other. Apple's iOS 26.3 security notes describe the dyld bug CVE-2026-20700 as one that "may have been exploited in an extremely sophisticated attack against specific targeted individuals" on iOS versions before iOS 26. At that point it was a zero-day, used before a fix. Once iOS 26.3 shipped, it turned into an n-day.

Why n-days still work

Patching is not instant. People postpone updates, some devices stop receiving them, and businesses delay rollouts. Attackers know this and keep working exploits for flaws that have been fixed, because a fix helps only the devices that have received it.

Cost is the other reason. Google's Threat Intelligence Group (GTIG) reported in March 2026 on DarkSword, an iOS exploit chain that used several zero-days when it was first seen, and found it in use by more than one surveillance vendor and suspected state actor. Sekoia's November report says the same kit has since been reused by a suspected Russian intelligence group, and argues that packaged exploit chains lower the cost and skill needed for advanced mobile attacks. Once a chain exists, it can be pointed at every outdated phone that visits a page.

A real timeline

Sekoia's report is a useful case study because it lists the flaws and the versions they target. We checked the public NVD entries for each. The chart shows how long before Sekoia's 4 November 2026 report each flaw had been public in NVD (publication dates are approximate stand-ins for patch dates, and some fixes shipped earlier).

Months between a flaw's NVD publication and Sekoia's report (4 Nov 2026)months
Months between a flaw's NVD publication and Sekoia's report (4 Nov 2026) (months)
months
CVE-2024-27834 (iOS PAC bypass)29.7
CVE-2025-27038 (Adreno GPU, Android)17.0
CVE-2025-43529 (WebKit, iOS)10.6
CVE-2026-20700 (dyld, iOS)8.7
CVE-2026-3910 (Chrome V8)7.8

Source: NVD entries for each CVE; Sekoia TDR report of 4 November 2026

The oldest flaw in the campaign, CVE-2024-27834, was published in May 2024 and is listed as fixed in iOS 16.7.8 and 17.5. The newest, CVE-2026-3910 in Chrome, was published on 13 March 2026 and fixed in Chrome 146.0.7680.75. Every one of them had a fix available well before the campaign Sekoia found in mid-October 2026. A phone that installed those updates in time was not a target for these chains. For the full story, see our report on the campaign.

How to protect yourself

1. Install updates, and turn on automatic ones. This is the single step that defeats n-day attacks. On an iPhone or iPad, Apple's guide says to open Settings, tap General, then Software Update, and follow the prompts. On Android, install the monthly security update and keep Chrome current: the Adreno driver flaw CVE-2025-27038 was patched in Android's August 2025 update, according to SecurityWeek, and CVE-2026-3910 in Chrome 146.

2. Replace devices that can no longer be updated. A phone that does not get security fixes stays exposed to every n-day, forever. Check your device manufacturer's published support period. Sekoia's first chain targets iOS 16.7, and NVD's entry for CVE-2025-43529 lists fixes only for iOS 18.7.3 and 26.2 and later, with no iOS 16 release listed. We could not confirm whether older iPhones got a fix, so verify in Apple's notes for your model.

3. Use Lockdown Mode if you are at higher risk. Apple describes it as "optional, extreme protection" for the very few people who might be personally targeted by sophisticated threats, and notes that most people are never targeted that way. It limits message attachments, some web technologies, incoming FaceTime calls from unknown people and more, so some sites and features work differently. Apple advises updating to the latest software before turning it on. GTIG also recommends it where an update isn't possible.

4. Treat third-party scripts as part of your attack surface. In Sekoia's report, one of three infection routes was a compromised analytics script, Plerdy, altered for a week between 27 August and 3 September 2026. If you run a website, review which external scripts load on your pages, remove ones you don't need, and watch for unexpected changes.

5. Log out and rotate sessions after a suspected infection. Sekoia says the payloads steal browser cookies, which can allow an attacker to reuse a logged-in session. Changing a password does not always end an existing session, so also sign out of other devices where the service allows it.

Questions people ask

Is a zero-day worse than an n-day? For the individual, a zero-day is harder to defend against because there is nothing to install. For most people, n-days are the more common risk, because they are reused widely and cheaply. Both are stopped by updates, once an update exists.

How do I know whether I'm affected by a flaw? Look up the CVE in the NVD or the vendor's security notes. Both list the fixed versions. If you run that version or newer, you are covered for that flaw.

What is the CISA catalog? The US Cybersecurity and Infrastructure Security Agency keeps a Known Exploited Vulnerabilities (KEV) catalog of flaws seen exploited in real attacks. NVD links to it from entries such as CVE-2025-43529 and CVE-2026-3910. We could not open the catalog page from our tools for this guide, so check the live list yourself on CISA's site.

Does visiting a website really put a phone at risk? In the campaign Sekoia describes, the attacks were "zero-click", meaning that a visit to an infected page was enough on an unpatched device, with no download or tap needed. On a fully updated device, the chains named in the report do not work.

What to remember

  • A zero-day is exploited before a fix exists; an n-day is exploited after.
  • A fix only protects devices that install it, so attackers keep using old flaws.
  • Sekoia's November 2026 report found three exploit chains, all built from fixed flaws, the oldest fixed more than two years earlier.
  • Update phones and browsers promptly, retire devices that no longer receive fixes, and consider Lockdown Mode if you could be a target.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next