Case Studies
Theory only gets you so far. These five incidents show how zero-days actually play out in the real world — from industrial sabotage to a bug that leaked passwords out of a third of the internet's servers.
Stuxnet
Stuxnet is widely considered the first cyberweapon to cause physical destruction. Discovered in 2010, the worm was designed to target Siemens industrial control systems used to run the centrifuges at Iran's Natanz nuclear facility. It chained together four separate Windows zero-day vulnerabilities to spread undetected, then subtly altered the centrifuges' spin speed — physically destroying equipment while feeding operators falsified readings that showed everything running normally.
Why It Mattered
- The first known malware to cause physical damage to hardware, not just data.
- Used four zero-days at once — an extraordinary "budget" for a single operation.
- Demonstrated that air-gapped, offline systems aren't immune — it spread via infected USB drives.
- Widely attributed to a joint US-Israeli operation, though never officially confirmed.
WannaCry & EternalBlue
EternalBlue was an exploit for a flaw in Windows' SMBv1 file-sharing protocol, originally developed by the NSA. It was leaked online in April 2017 by a group calling themselves the Shadow Brokers — Microsoft had already patched the underlying bug a month earlier, but countless systems hadn't updated. In May 2017, the WannaCry ransomware worm weaponized the leaked exploit, spreading automatically between unpatched machines with no user interaction required at all.
Why It Mattered
- Crippled the UK's National Health Service, forcing hospitals to divert ambulances and cancel appointments.
- Spread as a self-propagating worm — one infected machine could compromise an entire network within minutes.
- A security researcher accidentally halted the outbreak by registering an unregistered domain the malware checked as a kill switch.
- Proved that a patched vulnerability is only safe once it's actually applied — the fix existed for two months before the attack.
Heartbleed
Heartbleed wasn't an attack someone launched — it was a two-year-old bug quietly waiting in OpenSSL, the encryption library securing a huge share of the web. A missing bounds check in the "heartbeat" feature let an attacker request more data than they should've been able to see, leaking up to 64KB of a server's private memory per request — including private encryption keys, passwords, and session cookies. Worse, exploiting it left no trace in server logs.
Why It Mattered
- Affected roughly one in six of all HTTPS-secured websites on the internet at the time.
- Because exploitation was invisible, nobody could be sure what had already been stolen before the fix shipped.
- Forced a mass, coordinated event: certificate revocation and password resets across the industry.
- Became a textbook case for why memory-safety bugs in widely-shared libraries are so dangerous.
Log4Shell
Log4j is a logging library used inside an enormous share of enterprise Java software — the kind of invisible dependency almost nobody thinks about. In December 2021, researchers found that a specially crafted log message could trick Log4j into fetching and executing remote code, handing an attacker full control of the server with almost no effort. Because logging is everywhere, so was the vulnerability.
Why It Mattered
- Rated the maximum possible CVSS severity score of 10.0.
- Exploitable with a single line of text — attackers didn't need to write custom malware, just the right log message.
- Affected an almost uncountable range of downstream software, since Log4j is a dependency of dependencies.
- Triggered a mass, industry-wide scramble to inventory which applications even used Log4j in the first place.
Pegasus & FORCEDENTRY
NSO Group's Pegasus spyware became infamous for targeting journalists, activists, and dissidents. Its most alarming delivery method, FORCEDENTRY, discovered by Citizen Lab, was a zero-click exploit — it required no interaction from the victim at all. A maliciously crafted image file processed silently by iMessage was enough to compromise a fully patched iPhone and install spyware capable of reading messages, tracking location, and activating the camera and microphone.
Why It Mattered
- Google's Project Zero called it one of the most technically sophisticated exploits they had ever analyzed.
- Zero-click exploits remove the human element entirely — there's no phishing link to avoid, no attachment to not open.
- Exposed the commercial spyware industry, where private companies sell nation-states access to zero-days like these.
- Led Apple to sue NSO Group and to introduce Lockdown Mode, a hardened device state for high-risk users.
The Common Thread
Every one of these incidents came down to the same gap: a difference between what software was supposed to do and what it actually did under the right — or wrong — conditions. Defense in depth, fast patch cycles, and treating every dependency as a potential attack surface are what make the next one survivable.