Zero-day 0-day
A security flaw attackers know about but the vendor doesn't — "zero days" to fix before the first attack.
Valuable on the dark web (millions of $ for the right 0-day against iOS/Chrome). Nation-state actors and NSO-like vendors drive the market. Defences: patch fast, defense in depth.