This is the flourishing gray market of digital arms dealers—defense contractors and private marketeers—whose government customers have driven up the price of zero days and enticed sellers away from the vendor bounty programs where the holes will be fixed and into the arms of people who only want to exploit them. The market is “gray” only because the buyers and sellers are presumed to be the good guys, acting in the interest of public safety and national security.

