Originally it referred to the exploit code for a vulnerability, and not the vulnerability itself. Back in the 1990s information flowed (relatively) slower via

Originally it referred to the exploit code for a vulnerability, and not the vulnerability itself. Back in the 1990s information flowed (relatively) slower via Usenet, mailing lists, and IRC (weblogs came later), and so when a software update or patch was released, there was a race between the announcement day and the day the an exploit was announced. For sysadmins it was a sprint to get things patched as quickly as possible. As the time got shorter and shorter, IT organizations were trying to develop more nimble methods of testing and deploying updates. At some point the term "zero-day" started to apply to the vulnerability instead of the exploit code. Of course there were often exploits floating around for unpatched vulnerabilities as well.