TOCTOU - Wikipedia Explanation Silly Question

Hello! I have been reading about this bug that can be abused mainly the Wikipedia page to get a high-level view of it:

[https://en.wikipedia.org/wiki/Time-of-check\_to\_time-of-use](https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use)

*The attacker can do* **"symlink("/etc/passwd", "file");"** *after the access check and before the open.*

**"Although this sequence of events requires precise timing, it is possible for an attacker to arrange such conditions without too much difficulty."**

I am trying to get my head around on how the attacker does this in real time?

The only way …

access attacker bug check cybersecurity etc events file hello high page question toctou wikipedia