[gsands]

It is called a "zero-day" because the programmer has had zero days to fix the flaw (in other words, a patch is not available).[0]

[0] http://en.wikipedia.org/wiki/Zero-day_attack

[gojomo]

Note that parenthetical contradicts the "zero days to fix" definition. (No patch available is not zero days to fix "in other words".) That suggests the term as commonly understood is a bit fuzzy.

Personally, I've noticed more use of "zero-day" to mean "exploits are now public but no patch is yet available" than to mean literally "programmers just learned of the bug today".