Zero-Day Exploit: What AI Changes About Patches

Short answer

• A zero-day is exploited before a patch exists. An n-day is known and fixed, and the update is just not on your systems yet. The second kind is the one a company without a security team can close. In Verizon's Data Breach Investigations Report 2026, 29% of the ransomware victims among companies with fewer than 1,000 employees had unpatched vulnerabilities in devices at the network edge.
• A high-severity vulnerability went from public to exploited in three days on average in the third quarter of 2026, according to the security company Rapid7.
• Cyber authorities and security companies expect AI to shorten the time from a published patch to an attack. AI helps find new gaps too. The security company VulnCheck counted 1,061 vulnerabilities in two collections of such findings, of which it has confirmed 1.3% as exploited.
• An SME without a security team starts by working out what is reachable from the internet, then applies updates automatically, takes software without vendor support off the network, switches on login with a second factor (MFA) and practises restoring its backups. An automated check comes on top, with a clear rule on what a human approves.
• No patch helps against a real zero-day, only damage control, which means a second check behind the first, separated networks and a plan for the day it happens.

How fast an attack follows now

In the third quarter of 2026, a high-severity vulnerability went from public to exploited in three days on average. The figure is from the security company Rapid7's quarterly report of 21 October 2026, which tracked 43 newly exploited high and critical vulnerabilities.

Of those cases, 71% fell in the first seven days after a vulnerability became public, 90% in the first 30. The security company Mandiant, measuring differently in a separate study, saw an average of 63 days for 2018 and 2019.

Of those 43 cases, 34 needed no login and no user action, which is why a service reachable from the internet comes first.

The PHP case

PHP is the scripting language most of the web runs on, 69.2% of sites whose server-side language is known, according to W3Techs. On 21 October 2026 the PHP project released updates against two critical vulnerabilities, both rated 9.2 out of 10 on the usual severity scale and both letting an attacker run code on the server without logging in.

Amazon had seen a first attempt to exploit them on 17 October in a decoy system built to catch attackers, four days before the release. The report does not say whether it succeeded. The US agency CISA added both to its catalogue of actively exploited vulnerabilities five days after the update and set 29 October as the deadline for US federal civilian agencies.

Why exploitation sometimes starts before the patch

Mandiant puts the mean time to exploit at an estimated minus seven days in its M-Trends 2026 report, so exploitation routinely begins before a patch exists, as it did in the PHP case. The public summary gives no method behind the estimate.

Zero-day or n-day: two different problems

Zero-day: exploited before a patch exists

The UK's National Cyber Security Centre (UK NCSC) defines a zero-day exploit as one using a vulnerability for which no security fix is available. Once the vendor issues a fix, the zero-day becomes a known vulnerability, an n-day. Switzerland's National Cyber Security Centre (the Swiss NCSC) draws the line wider and counts gaps that were publicly known before the update.

The Google Threat Intelligence Group (GTIG) counted 90 zero-days actually exploited in 2025, 43 of them, or 48%, in software and appliances built for companies. It attributes nine to confirmed or likely financially motivated groups.

I rarely see a zero-day as an SME's first problem. If one does hit you, there is no patch to apply, only damage to limit.

N-day: the patch exists but not on your systems

Exploiting vulnerabilities is now the most common way into a breach in Verizon's Data Breach Investigations Report 2026, at 31%. Among companies with fewer than 1,000 employees, which Verizon counts as small and medium businesses, 29% of the ransomware victims had unpatched vulnerabilities in devices at the network edge, for example the firewall or the VPN.

Closing them takes time. Only 26% of the vulnerabilities in CISA's catalogue were fully fixed at the organisations Verizon looked at in 2025, and the median time to a full fix came to 43 days. The growth in exploited vulnerabilities from January to August 2026 came mostly from n-days that attackers made usable quickly, in GTIG's reading.

Most vulnerabilities are never exploited. Of everything disclosed in 2026, GTIG has seen only 0.23% in an actual attack, roughly one in 431. So sort them. CISA puts the highest risk on four properties: public exposure, automatable exploitation, full control of the system, and evidence of real-world exploitation.

What AI changes, and what it does not

From patch to working exploit in days

A patch shows where the gap sits. The Swiss NCSC writes that criminals sometimes download patches on release to analyse the differences from the previous version.

Amazon's security team writes in its PHP report that AI-assisted analysis makes it cheaper to turn a patch difference into a working exploit, so more attackers can act within hours once the details are out.

The Google Threat Intelligence Group thinks it possible that attackers use AI tools to compare versions and patches automatically, to make n-days usable quickly rather than to find new zero-days. Its own measurement shows a rise from 10.5 exploited vulnerabilities a month on average in 2025 to 18 from January to August 2026. The Swiss NCSC expects in its assessment of May 2026 that vulnerabilities will be exploited more quickly and more frequently.

Finding new gaps with AI

In May 2026 GTIG reported for the first time an attacker using a zero-day exploit it believes was developed with AI, aimed at the two-factor login of a widely used open-source tool for system administration. The signs pointing to AI included a severity score the exploit had invented.

The security company VulnCheck counted across two collections of AI-assisted findings, where 1,061 vulnerabilities had added up by July 2026, of which 14, or 1.3%, have been confirmed as exploited in the wild. It calls the effect real but modest, and says AI mainly raises the number of vulnerabilities that get found, which gives defenders the chance to fix them first.

What stays the same

The Swiss NCSC calls AI primarily an accelerator of existing threats. The Five Eyes cyber security agencies write in their joint statement of June 2026 that success will come from getting the basics right and acting quickly.

My own case: seven advisories and one morning

I have been building my own photo app since April 2026 and wrote most of its changes with AI help.

On the morning of 7 October an automated check reported that the app was running versions of its web framework and login component with seven security advisories against them, two of them rated critical. The update waited until I approved it. The updated version went live the same morning, checked and tested, and the third-party package check then reported no critical gap. A remainder, mostly in a development tool, I accept deliberately.

I had the update itself reviewed before it went live. The review found that my own tests had run on old package versions, so they had not tested what was about to ship.

The second check behind the gate

Several of the seven advisories described ways around the login check that sits like a gate in front of the app's interfaces. Another check went through every interface the same day. Of the 80 protected interfaces, 79 checked the caller themselves instead of relying only on the gate in front. I secured the one exception that day.

No security advisory appears for a gap in your own code. You have to look for that yourself. Since that day an automatic test fires as soon as a new interface does not check its own caller. I check my blog texts the same way, with a second independent check before publishing. AI Blog Writing: How I Check Every Claim describes it.

What an SME without a security team actually does

Know what is reachable from the internet

A system inventory is the first measure in the Swiss NCSC's assessment, and the Five Eyes agencies advise asking whether a system needs to be reachable at all. The study SME cyber security in 2026 surveyed 507 managers of Swiss SMEs with 1 to 49 employees, and only 34% say they keep a complete inventory of their systems, devices, software and cloud services.

Start with the firewall, the VPN, remote access, the website and the web shop. The Swiss NCSC's semi-annual report for the first half of 2026 says ransomware groups got in through vulnerabilities in internet-facing systems, above all VPNs and firewalls, a third of all ransomware incidents in international observations.

Updates by default, exceptions with a deadline

The Swiss NCSC says to install security updates as soon as they are available. The UK NCSC recommends updating by default, as soon as possible and ideally automatically, and otherwise starting with the systems reachable from outside. In the Swiss SME study, 83% of the companies say they update regularly.

An update can break something. A fixed order of systems and a way back to the previous version handle that, and every exception gets a deadline and an owner.

Software without vendor support belongs off the network. The Swiss NCSC advises dropping it or cutting it off from the network, and the Five Eyes agencies call such systems easy targets. An old machine that has to stay for a special program gets walled off from the internet and the rest of your network.

The basics: MFA, backups, separated networks

Login with a second factor (MFA) is in place at 55% of the SMEs surveyed, a separated network at 15%. The Swiss NCSC advises not keeping the backup permanently connected to the computer, out of reach of an attack. Nine in ten of them back up regularly, and only a quarter routinely test a restore.

Those measures are the actual defence against a zero-day, together with a second check behind the first. What counts then is how far an attacker gets and how quickly you are working again.

Automatic checks, with a rule on what a human approves

Three days is too short for me to work by hand. I recommend a daily check that compares the versions in use against the published advisories and tests your own software against your own rules. Routine updates run automatically, a human approves what can change how the business runs, and every fix gets a second check.

The Five Eyes agencies note that attackers already use AI to move faster, and defenders have to do the same. Only 7% of the SMEs surveyed use AI against cyber attacks. Automation stops an update from sitting there until somebody looks. In AI Agents in an SME: Uses, Limits, Guardrails I go into where a human should approve and where a machine may act alone.

Start with the systems reachable from outside

For every system reachable from the internet, write down the version and the person or company that updates it. My website check takes a first look at your site from outside. If you want automated checks in your own company, write to me through the contact page.

Frequently asked questions