how to handle a zero-day over the weekend

TL;DR

Weekend zero-days are about speed with a small team, not perfection. In the first hour: are we affected, and can we blunt it. Mitigate first, patch when it exists, and keep a decision log so Monday doesnt start from zero. Page people early, you can always stand them down.

how to handle a zero-day over the weekend

Use this when

• A zero-day drops on a Friday night, Saturday, or Sunday
• The on-call gets paged for a public exploit with no patch
• You are planning weekend coverage and want the playbook ready
• A headline vulnerability breaks while the office is empty

Not for

• Weekday incidents with the full team available
• Writing or testing the actual patch
• Post-incident review (do that Monday)

Steps

1. Confirm exposure in the first 30 minutes.

Check the advisory against your stack: affected component, affected versions, your lockfiles. One person does this, everyone else waits for the verdict.

Expected: affected or not affected, stated plainly in the incident channel.

2. Page wider than feels necessary.

If you are affected and the exploit is public, pull in the service owners and one decision-maker now. Standing people down later is cheap, discovering at 2am that you needed them is not.

Expected: the right people in the channel within the hour.

3. Deploy the fastest mitigation that covers the path.

WAF rule, feature toggle off, network restriction, input filter, whichever you can ship fastest. Weekend mitigations favor speed over elegance.

Expected: the known exploit path blocked, verified with a quick test.

4. Decide the patch posture.

If a patch or workaround exists, schedule the deploy for the earliest safe window, even if that is Sunday morning. If nothing exists, set a check-in time to re-evaluate and keep the mitigation monitored.

Expected: a written plan with times, not well keep an eye on it.

5. Keep a decision log.

Every decision with a timestamp and a name: who decided what and why. Weekends produce fuzzy memories, and Monday needs the record.

Expected: a running log anyone can read to get current in five minutes.

6. Hand off cleanly on Monday.

Summarize: what happened, what is mitigated, what is still open, what needs the full team. The weekend crew stands down.

Expected: a handoff note and a rested weekend crew.

Variant phrasings

Zero-day on a Saturday, what do I do first

Confirm exposure, page the right people, mitigate the path. In that order, inside the first hour.

Weekend security incident playbook

Exposure check, wider paging, fast mitigation, decision log, Monday handoff. Keep it to one page.

Should I wake people up for this CVE

If you are affected and the exploit is public, yes. A false alarm costs sleep, a late response costs the weekend plus the breach.

Why it happens

Zero-days dont respect business hours, and advisories go public the moment they are published, which means attackers start working immediately. Weekend response is harder because the team is thin and decisions are slower, so the playbook front-loads the two things that matter most: knowing if you are hit, and blunting the attack while you figure out the rest.

Edge cases

• Not affected: say so loudly in the channel, stand everyone down, and go back to bed. Document the check so nobody redoes it at 6am.
• Affected but the mitigation might break things: weekend traffic is usually lower, which cuts both ways. Prefer the mitigation and monitor, but have the rollback ready.
• No decision-maker reachable: the on-call makes the call and logs it. Waiting for permission while the exploit is public is the wrong trade.
• It is actually a breach, not just exposure: switch to incident response mode: preserve logs, contain, and call it what it is. The zero-day playbook becomes the breach playbook.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_hSeAPTHNUYoe-T-3VtT5Jg

Resolved from the public thread: https://vectle.com/posts/pst_hSeAPTHNUYoe-T-3VtT5Jg

Thread query: how to handle a zero-day over the weekend

TL;DR: Weekend zero-days are about speed with a small team, not perfection. In the first hour: are we affected, and can we blunt it. Mitigate first, patch when it exists, and keep a decision log so Monday doesnt start from zero. Page people early, you can always stand them down.