About ZeroDay Times

What we cover

Four desks carry the site. Each one is a beat, not a tag dumped on every story.

• Data Breaches — Disclosed intrusions, stolen datasets, and the identity failures that let them out.
• Bug Bounty — Vulnerability-reward programs, researcher payouts, and the triage that makes them real.
• Zero-Days & CVEs — Newly disclosed vulnerabilities, exposure, and what is actually worth patching first.
• AI & Tech — Copilots, model risk, and the security consequences of software that reads untrusted text.

A story lands on the desk that matches the decision it forces. A stolen-credential incident is a breach story even if a CVE number appears in paragraph twelve. A patched library with no disclosed victim is a zero-day story. An assistant that can send mail because a document told it to is an AI story.

How the desk reports

Briefings are written by the ZeroDay Times Desk. We start from public material: company disclosures, regulatory filings, vendor advisories, standards, and published research. When a number is in dispute, we say whose number it is. When we do not know, we do not invent a precise figure to make the lede tighter.

We do not pretend to have knocked on every door. A briefing is an explanation of the public record and the defensive consequence, not a claim that we witnessed the incident.

We will correct a factual error. We will not quietly rewrite a story and hope nobody notices.

What we will not publish

The line is practical. Defenders need impact and action. Attackers do not need a recipe from us.

• No exploit instructions, weaponized proof-of-concept code, or step-by-step intrusion guides.
• No stolen databases, credential dumps, or personal data taken from a victim.
• No unpublished vulnerability details that the affected party has not had a chance to fix, unless withholding them would leave people exposed and a public advisory already exists.
• No malware samples, builder settings, or guidance on how to hide an intrusion.

Naming a bug class, a CVE, a victim that has already disclosed, or the control that would have mattered is the job. Showing someone how to repeat the attack is not.

Corrections

If a briefing is wrong, email[email protected]with the URL, the sentence, and the source that contradicts it. We aim to acknowledge corrections within two business days. A material fix is noted on the story with an updated date. Typos that do not change meaning may be fixed without a note.

Tips are welcome at the same address. Do not include exploit code, malware, or data taken from a victim. Describe the issue, who is affected, and whether the vendor has been told. We may decline a tip, and sending one is not a contract that we will publish it.

Independence

Vendors do not review copy before publication. A company mentioned in a briefing may send a statement, and we will use it when it adds a fact. Advertising does not buy a headline, a softer verb, or the removal of a disclosed incident.

Staff and regular contributors should not trade in the securities of a company while preparing a story about that company, and should not accept gifts, paid travel, or bug-bounty payouts from an organization they are covering. The desk does not operate a paid vulnerability-reward program of its own.

Advertising

ZeroDay Times may show third-party advertisements, including Google AdSense, to pay for the time it takes to report. Ads are labeled "Advertisement." An ad is not a briefing, and a briefing is not an endorsement of the advertiser.

Google and its partners may use cookies to serve ads based on visits to this site and other sites. That practice is described in theprivacy policy, along with how to opt out of personalized advertising. We do not sell our audience's personal information for money, and we do not let an advertiser approve editorial copy.

Advertising inquiries go to[email protected].

Who operates the site

ZeroDay Times is an online publication. We do not keep a public walk-in newsroom. Reach the desk through the contact page. Privacy requests go to[email protected]. Reports about the security of this website itself — not a product you would like us to write about — go to[email protected].