Attackers dig into zero-day flaw