Zero- and low-fee transactions aren't relayed by default. If you attempt to broadcast one over the Bitcoin peer-to-peer network, most nodes won't pass it along for you (and they might even "ban" you by refusing to relay any of your transactions for a while). However, such transactions are still valid, and it is perfectly legal for a miner to confirm such a transaction by including it in a block, should they choose to do so. So this raises two questions:
How would they get ahold of a zero-fee transaction, if they're not relayed?
The miner might have created the transaction for themselves. For instance, if a mining pool needs to pay its members their earnings, the pool operator could create a transaction and include it in the blocks the pool is attempting to mine. There's no point in including a fee, because the pool would just be paying the fee back to itself.
Some large miners may have alternate ways to receive transactions (e.g. a web site where anyone can paste a transaction and the miner will consider it). This is also useful for people who want to create transactions which can't be relayed because they are not standard.
Why would they confirm it?
Obviously most miners are motivated by profit and so they would prefer to confirm transactions with higher fees. But other than altruism or bugs, here are some reasons why they might choose to confirm a zero-fee transaction.
It's their own transaction, so there is no point in including a fee. See above.
They've been paid in some other way. Some miners have "transaction accelerators" where you can pay that specific miner some amount to "buy" faster confirmation.
"Child pays for parent." If the zero-fee transaction is used as input by another "child" transaction which has a high fee, the two transactions together might have a higher average fee than any other two available transactions. The miner can't confirm the child without also confirming the parent, but it might be worth it to collect the child's fee.