Zero-days

The phrase gets used for three different things: a flaw with no fix available, working exploit code for one, and an attack using it.

The distinction matters more than it sounds, because the three call for different responses. Also worth keeping in proportion: zero-days are rare, expensive and usually spent on targets worth the cost. If your organisation has been compromised, the overwhelmingly likely cause is something long since patched elsewhere rather than a flaw nobody knew about.