I’ve seen “zero day” used in breach headlines, movie trailers, and vendor marketing emails. Almost always it means “scary hack.” That’s not wrong exactly — but it misses the precise thing that makes a zero-day structurally different from every other attack. That precision actually matters when you’re trying to understand your risk.
Three Terms That Are Not the Same I see these used interchangeably constantly. They’re not.
India’s most trusted examination board, CBSE, was rocked by a sweeping cybersecurity scandal in May 2026 when a 19-year-old ethical hacker demonstrated live, unrestricted access to its On-Screen Marking (OSM) evaluation system — including shell access to production servers and free downloads of student answer sheets from an unsecured cloud bucket [1][2]. The breach put the personal and academic data of an estimated 20 lakh (2 million) Class 12 students at risk [5]. This article unpacks every layer of the hack, explains what it means for students and families, and maps out what the government must do to prevent a repeat.