The ongoing saga of Microsoft versus Nightmare Eclipse (aka Chaotic Eclipse), the disgruntled bug hunter with a deep understanding of Windows and an even deeper grudge against Microsoft, reached a fever pitch, with the researcher, who has thus far released six Windows zero-days, promising a \u201cbone shattering\u201d drop on July 14.\u00a0<\/p>\n
Microsoft, for its part, finally responded<\/a>\u00a0to the security researcher and their weaponized Windows flaws with a blog post on (un)coordinated vulnerability disclosure about the now-public bugs: RedSun<\/a>, UnDefend<\/a>, BlueHammer<\/a>, YellowKey<\/a>, GreenPlasma, and MiniPlasma. Redmond says that none of these were reported via its official channels prior to being made public.\u00a0<\/p>\n Attackers began hammering three of the six – BlueHammer, RedSun, and UnDefend<\/a> – soon after Nightmare published working proof-of-concept exploit code<\/a> for each on\u00a0now-banned <\/a>GitHub (owned by Microsoft) and GitLab accounts.\u00a0<\/p>\n YellowKey, GreenPlasma, and MiniPlasma still don\u2019t have fixes, and Microsoft has deemed \u201cexploitation more likely\u201d for YellowKey, aka CVE-2026-45585, citing a working POC.<\/p>\n \u201cWe remain firmly opposed to these actions, and any disclosure outside proper coordination that could harm our customers and the digital ecosystem,\u201d Microsoft wrote<\/a> in a Wednesday blog, and then seemingly threatened legal action against Nightmare:<\/p>\n \u201cUncoordinated disclosures that put proof-of-concept code for unpatched vulnerabilities into the hands of bad actors are never justifiable and have real-world consequences. Our security teams across the company work tirelessly tracking threat actors who look for weaknesses just like these to attack Microsoft and our customers. Our Digital Crimes Unit will continue bringing cases against these actors and those that enable their criminal activity \u2013 coordinating as needed with law enforcement around the world.\u201d<\/p>\n Microsoft did not respond to The Register\u2019s questions, including\u00a0whether its legal team planned to sue Nightmare,\u00a0whether the zero-day researcher is a current or former employee, and\u00a0whether Microsoft axed Nightmare\u2019s MSRC account, meaning that the bug hunter can\u2019t disclose vulnerabilities to the Windows giant.\u00a0<\/p>\n Nightmare, in their latest anti-Microsoft missive, claims Microsoft did just that.<\/p>\n \u201cWhen I actively asked you to communicate with me, you refused, humiliated me and made sure to insult me in front of people,\u201d they wrote<\/a> on Saturday. \u201cYou defame me in public with your CVE-2026-45585 advisory even though you literally deleted the Microsoft account I used to report bugs to you with and I got zero pennies from doing so and I still happily did like an idiot.\u201d<\/p>\n Mark this date July 14th, I will make sure your bones are shattered that day<\/p>\n Nightmare also noted that \u201cMicrosoft still has chains in my hands,\u201d preventing them from releasing \u201cdocuments\u201d yet, or anytime in June, and then warned: \u201cMark this date July 14th, I will make sure your bones are shattered that day.\u201d<\/p>\n Regardless of what does or does not happen on July 14, Nightmare has already caused chaos – and real enterprise-level damage, as systems engineer Muhammad Qasim Shahzad said<\/a> on LinkedIn.\u00a0<\/p>\n \u201cOne person caused more enterprise-level damage in six weeks than most APT groups cause in a year,\u201d Shahzad wrote. \u201cThe gap between disclosure and weaponization is now measured in hours, not days. Your patching window is shrinking fast.\u201d<\/p>\n Zero Day Initiative\u2019s bug hunter-in-chief Dustin Childs, who previously spent about seven years working for Microsoft security and has decades of experience on both sides<\/a> of the coordinated vulnerability disclosure<\/a> (CVD) process, told The Register that Microsoft could have handled this better. And he wondered what happened between the two parties to get to this point.<\/p>\n \u201cCVD is a two-way street,\u201d he said. \u201cThe vendor has some responsibility as well, so to go out publicly stating this person violated CVD without showing any of the correspondence seems bold.\u201d<\/p>\n Microsoft could also improve its communications to customers on \u201cwhat the real risks from these bugs are and how they can defend themselves,\u201d Childs added. \u201cThat clear direction seems to be missing.\u201d<\/p>\n Microsoft’s ‘dumpster fire’<\/p>\n Luta Security founder and CEO Katie Moussouris<\/a>, who pioneered Microsoft\u2019s bug bounty program<\/a> despite execs vowing never to pay<\/a> researchers for bugs, said Redmond\u2019s response to Nightmare sends \u201cmixed messages.\u201d<\/p>\n \u201cIt confusingly claims their program \u2018ensures researchers are compensated and publicly acknowledged\u2019 in a statement answering a researcher who says he got neither,\u201d Moussouris told The Register. \u201cThe language choices are also not deescalating. Microsoft invoked the outdated term \u2018responsible disclosure,\u2019 which I retired years ago at Microsoft <\/a>because it was subjective and judgy.\u201d<\/p>\n This phrase, Moussouris added, \u201cgot in the way of coordination\u201d when the two sides disagreed about how to best protect end users.<\/p>\n \u201cThe mention of the Digital Crimes Unit in a post discussing vulnerability disclosure makes the post vaguely threatening, which seems intentional, but then they wrap up the post saying they welcome reports regardless of disclosure history,\u201d she said. \u201cNo one except the parties involved can know for sure what happened between this researcher and Microsoft. Whatever the facts, it’s hard to imagine why Microsoft would not try to deescalate, if for no other reason than avoiding the chilling effect on other researchers.\u201d <\/p>\n Security sleuth Kevin Beaumont, in his blog on the ongoing Microsoft-Nightmare Eclipse saga, called it a “dumpster fire<\/a> of [Microsoft\u2019s] own making.\u201d\u00a0<\/p>\n Beaumont also used to work at Microsoft, and he noted that the Windows company previously hired a hacker called SandboxEscaper<\/a> after she published zero-day POC exploits for Microsoft products – something that Redmond\u2019s blog now describes as criminal.<\/p>\n \u201cIf Microsoft\u2019s tactic is to try to criminalise not following often arbitrary \u2018responsible disclosure\u2019 frameworks, good luck defending that in court – because there\u2019s a whole clown car of prior decision making within Microsoft and facts which would emerge in that process,\u201d Beaumont said.<\/p>\n To be clear: neither Beaumont nor the researchers that The Reg spoke to support Nightmare\u2019s zero-day antics. Childs called the \u201cJuly 14\u201d post \u201ctroubling\u201d and Moussouris said the date plus \u201cincendiary language \u2026 doesn’t help organizations trying to make sense of the technical risk.\u201d\u00a0<\/p>\n ‘David and Goliath dynamic’\u00a0<\/p>\n Moussouris did add that this latest missive, taken in context with the earlier blog posts, \u201cpaint[s] a picture of someone who believes they have been pushed to this extreme. It is the sound of someone who believes every legitimate channel was closed to them: GitHub account deleted, payments withheld, credit stripped, then publicly accused of violating CVD after Microsoft cut off their ability to coordinate. The researcher’s grievances are serious and specific.\u201d\u00a0<\/p>\n Ultimately, \u201cthe bugs are Microsoft’s,\u201d Moussouris said. \u201cThey wrote the code and they own the risk to customers. Often researchers who previously work with a vendor respond in the extreme only when they feel there is no other choice. The power they hold is not at all proportionate to the vendor. This is a David and Goliath dynamic we don’t like to see play out, especially since it\u2019s users who lose when coordination negotiations fail.”<\/p>\n While it\u2019s a very extreme – perhaps the most extreme – example of coordinated disclosure gone wrong, it\u2019s not an isolated problem. Researchers have been complaining about CVD<\/a>, and specifically Redmond\u2019s bug disclosure habits<\/a>, for years.\u00a0<\/p>\n \u201cWhile some companies have improved, Microsoft has not,\u201d Childs said. \u201cIf anything, they are seen as difficult to work with, especially if your bug is Moderate instead of Critical. I\u2019ve had researchers tell me that they stopped looking at Microsoft altogether because they were too difficult to work with.\u201d<\/p>\n Plus, these types of disagreements between researchers and bug bounty programs<\/a> will likely increase, as AI-assisted bug reports<\/a> become the norm<\/a> and vulnerabilities skyrocket.<\/p>\n \u201cWe as an industry need to take a breath, remember there are real people involved, and that poor interactions could lead to real customer risk,\u201d Childs said. \u201cReal-world impact is lost far too often when disclosure goes wrong.\u201d\u00a0\u00ae<\/p>\n","protected":false},"excerpt":{"rendered":"The ongoing saga of Microsoft versus Nightmare Eclipse (aka Chaotic Eclipse), the disgruntled bug hunter with a deep…\n","protected":false},"author":2,"featured_media":700367,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[49,48,61],"class_list":["post-700366","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-ca","tag-canada","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/700366","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/comments?post=700366"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/700366\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media\/700367"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media?parent=700366"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/categories?post=700366"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/tags?post=700366"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}