Microsoft Dispute With Researcher Reignites Coordinated Disclosure Debate
Summary
Microsoft’s dispute with researcher Nightmare Eclipse over public zero-day disclosures has renewed debate about coordinated vulnerability disclosure. The article says three of six flaws were exploited before patching and describes competing accounts of the disclosure.
Key points
- Microsoft threatened criminal legal action after Nightmare Eclipse publicly disclosed six zero-day vulnerabilities.
- Microsoft said it received no vulnerability details before disclosure and that the release put customers at risk; the researcher claimed Microsoft ignored disclosure efforts and removed their MSRC account.
- Three of the six vulnerabilities were reportedly exploited before Microsoft patched them.
- Experts criticized both the researcher’s disclosure approach and Microsoft’s response, emphasizing that trust and communication are essential to coordinated disclosure.
- Researcher Ammar Askar separately said he would publicly disclose future VS Code bugs after a poor interaction with Microsoft; he released a flaw and exploit code that could steal GitHub tokens.
- Experts warned that growing vulnerability volumes and AI-assisted discovery are straining the disclosure ecosystem, while describing coordinated disclosure as the most practical current approach.
Article Details
- Event Type
- Dispute over coordinated vulnerability disclosure after researcher Nightmare Eclipse publicly released six zero-day vulnerabilities and proof-of-concept exploits, prompting Microsoft to threaten legal action.
- Impact
- Attackers reportedly exploited three of the six vulnerabilities before Microsoft patched them, creating risk for affected customers. Separately, security researcher Ammar Askar disclosed a VS Code vulnerability that he said could allow attackers to steal GitHub tokens. The dispute has renewed concerns about trust between vendors and researchers and the effectiveness of coordinated disclosure.
People
Ammar AskarSecurity researcher who claimed his last interaction with Microsoft’s security team was poor and publicly disclosed a VS Code vulnerability and exploit code that could allow attackers to steal GitHub tokens.Andrew MorrisFounder and chief architect of GreyNoise who commented on the responsibilities of vendors and researchers in vulnerability disclosure.Katie MoussourisFounder and CEO of Luta Security who commented on the Microsoft–Nightmare Eclipse dispute and coordinated vulnerability disclosure.Nightmare EclipseResearcher who publicly disclosed six zero-day vulnerabilities with proof-of-concept exploits after a dispute with Microsoft; the article says the researcher could not be identified or reached for comment.
Vendors
Products
GitHubthe Microsoft Security Response Center account they used to disclose vulnerabilities and flagged their GitHub account for removal.VS CodeEarlier this week, security researcher Ammar Askar claimed his last interaction with Microsoft’s security team was so poor that he decided to publicly disclose any bugs he finds in VS Code going forward.