Microsoft Condemns Uncoordinated Windows Zero-Day Releases
Summary
Microsoft condemned pseudonymous researcher Nightmare Eclipse’s releases of six Windows zero-days with proof-of-concept code. Three have been exploited, while three remain unpatched with no confirmed exploitation; Microsoft says its Digital Crimes Unit will pursue enab現
Key points
- Nightmare Eclipse released six Windows vulnerabilities with proof-of-concept code; the researcher remains unidentified.
- Microsoft advisories say BlueHammer, UnDefend, and RedSun have been exploited in live intrusions; all three are listed in CISA’s known exploited vulnerabilities catalog.
- YellowKey, GreenPlasma, and MiniPlasma remain unpatched, with no confirmed exploitation reported as of publication.
- Microsoft called uncoordinated releases of proof-of-concept code for unpatched vulnerabilities unjustifiable and said its Digital Crimes Unit will continue bringing cases against actors who enable cybercrime.
- The researcher alleged Microsoft deleted their response-center account, withheld bounty payments, and removed attribution; those complaints have not been verified.
- Security professionals cited in the article have raised other concerns about Microsoft’s vulnerability handling and the balance of responsibilities in coordinated disclosure.
Article Details
- Event Type
- Uncoordinated disclosure of six Windows zero-day vulnerabilities with proof-of-concept code.
- Impact
- Microsoft patch advisories report that BlueHammer, UnDefend, and RedSun have been exploited in live intrusions; all three are also listed in CISA’s known exploited vulnerabilities catalog. YellowKey, GreenPlasma, and MiniPlasma were disclosed without patches and had no confirmed exploitation as of publication.
People
Haifei LiCheck Point researcher who said Microsoft patched a bug he reported without notifying him and criticized coordinated disclosure as one-sided.Katie MoussourisFounder of Luta Security and architect of Microsoft’s original bug bounty program; commented on Microsoft’s disclosure language and researcher disclosure practices.Nightmare EclipsePseudonymous researcher who released six Windows vulnerabilities with proof-of-concept code; the article reports that the first three were exploited in live intrusions.
Vendors
Products
GitHubEach was published with working proof-of-concept code to the Microsoft-owned code repository GitHub, making them immediately available to both attackers and security professionals.Microsoft WindowsMicrosoft condemned a wave of uncoordinated Windows zero-day disclosures by the pseudonymous researcher Nightmare Eclipse, saying that publishing proof-of-concept code for unpatched flaws is “never justifiable.” Several