Apple iPhone security update points to growing problem of 'zero days' - NBC News

Such emergency vulnerabilities are called “zero days” — a reference to the fact that they’re such an urgent vulnerability in a program that software engineers have zero days to write a patch for it.

Project Zero, a Google team devoted to identifying and cataloging zero days, has tallied 44 this year alone where hackers had likely discovered them before researchers did.

Katie Moussouris, founder and CEO of Luta Security, a company that connects cybersecurity researchers and companies with vulnerabilities, said that the rise in zero days is thanks to the ad hoc way that software is usually programmed, which often treats security as an afterthought.

But almost paradoxically, the rise in zero days reflects an online world in which certain individuals are more vulnerable, but most are actually safer from hackers.

Because major operating software tends to have better security stopgaps in place, it means hackers often have to acquire and use one or more zero-day exploits to fully gain control of people’s smartphone, Maddie Stone, a Project Zero security researcher, said

“This would feel counterintuitive to most, but seeing the number of zero days rise is actually in response to increased security defenses being deployed at a much larger scale.”