CYBER-CRIME<\/p>\n
Exploit Wednesday’s back, baby<\/p>\n
Nightmare Eclipse, the serial zero-day hunter who has an axe to grind with Microsoft, published a new Defender zero-day, ShieldBreak, that apparently bypasses Redmond\u2019s RoguePlanet patch (CVE-2026-50656), allowing attackers to gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems.<\/p>\n
According to at least one other researcher, the exploit works. \u201cI’ve tried it, it works on latest Windows 11,\u201d former Microsoft employee and security expert Kevin Beaumont said<\/a>. Beaumont also published three detections and hunting queries for ShieldBreak to help defenders rapidly find any stealthy threats. So until Microsoft fixes this latest zero-day, we\u2019d highly suggest using these queries.<\/p>\n ShieldBreak<\/a> is the 10th zero-day from Nightmare Eclipse since they began their scorched-earth strategy against Microsoft in early April<\/a>.\u00a0The prolific bug finder and exploit developer is suspected to be a former, very disgruntled, Microsoft employee. And in typical fashion, this latest zero-day drop occurred just hours after Redmond\u2019s monthly Patch Tuesday that fixed 421 security problems<\/a> in its products – but ShieldBreak isn’t one of them.<\/p>\n It\u2019s a local privilege-escalation exploit that, according to Nightmare, allows attackers to gain SYSTEM-level privileges.\u00a0<\/p>\n \u201cThe PoC was tested in the latest version of windows 11 25h2 (+Canary channel) and windows server 2025, the PoC also have a 100% success rate. Please note that Windows 10 (and respective server editions) are not currently supported, they are however vulnerable to ShieldBreak as well,\u201d they said<\/a>.<\/p>\n While Nightmare claims that the new exploit is a patch bypass for the earlier RoguePlanet vulnerability, CVE-2026-50656, which Microsoft quietly fixed<\/a> in July, Beaumont pointed out that the two flaws operate very differently.<\/p>\n \u201cRoguePlanet was a filesystem race condition vuln that uses virtual disks and NT native file manipulation to trick quarantine process into overwriting system files,\u201d he posted<\/a>. \u201cShieldBreak user-mode callback hook to change file contents during a Defender cloud-hydration scan via cfapi (Cloud Filter API).\u201d<\/p>\n A Microsoft spokesperson told us the company “is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims.”<\/p>\n The spokesperson added: “Microsoft is committed to investigating security issues and updating impacted products to protect customers as soon as possible. Importantly, we support\u00a0coordinated vulnerability disclosure<\/a>,\u00a0an industry standard that protects customers\u00a0and\u00a0supports the research community by ensuring their findings are thoroughly investigated and addressed before being made public.”\u00a0<\/p>\n This latest zero-day comes a month after Nightmare Eclipse published its previous vulnerability along with partial exploit code. Nightmare\u2019s July drop, called LegacyHive<\/a>, is a local privilege escalation flaw that targets Windows\u2019 user hives<\/a> – the section of the Windows Registry that stores a user’s specific desktop settings, application preferences, and environment configurations. It doesn\u2019t have an official patch.<\/p>\n Neither does a June zero-day called GreatXML<\/a> that Nightmare developed. The researcher claims the flaw allows a local attacker with administrator rights to bypass BitLocker encryption by manipulating the Windows Recovery Environment.<\/p>\n The prolific zero-day hunter\u2019s earlier seven Windows bugs do have patches. These include BlueHammer (CVE-2026-33825)<\/a>, RedSun (CVE-2026-41091)<\/a>, UnDefend (CVE-2026-45498)<\/a>, YellowKey (CVE-2026-45585), GreenPlasma (CVE-2026-45586)<\/a>, MiniPlasma (CVE-2020-17103)<\/a>, and RoguePlanet (CVE-2026-50656)<\/a>.<\/p>\n After threatening legal action<\/a> against Nightmare Eclipse in May, and then facing rapid backlash from just about every other security researcher on the planet, Microsoft walked back its talk<\/a> of siccing its Digital Crimes Unit on people who don\u2019t follow its vulnerability disclosure rules.\u00ae<\/p>\n","protected":false},"excerpt":{"rendered":"CYBER-CRIME Exploit Wednesday’s back, baby Nightmare Eclipse, the serial zero-day hunter who has an axe to grind with…\n","protected":false},"author":2,"featured_media":736390,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[59,86,56,54,55],"class_list":["post-736389","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-gb","tag-technology","tag-uk","tag-united-kingdom","tag-unitedkingdom"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/736389","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=736389"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/736389\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/736390"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=736389"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=736389"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=736389"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}