INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Microsoft Zero-Day Exploit Disclosed

| 2026-05-28 12:00 CRITICAL MEDIUM EXPLOITED VULNERABILITY
JSON
Executive Summary
AI-generated
Microsoft's latest move to silence a prominent researcher has sparked widespread outrage among infosec professionals. The company's decision to threaten criminal prosecution against the individual who published zero-day vulnerabilities on GitHub is seen as an insanely myopic move, especially after all the investment Microsoft has made into presenting a secure and transparent face to the market. This comes hot on the heels of recent exploits by Nightmare-Eclipse, including YellowKey, GreenPlasma, and MiniPlasma, which have already compromised numerous Microsoft repositories. The researcher's post was met with widespread condemnation from within the security community, who argue that non-disclosure is far worse than publishing vulnerabilities themselves.
Technical Mitigations AI-generated
* Implement a robust vulnerability disclosure program that allows researchers to report vulnerabilities without fear of retaliation or criminal prosecution. * Develop and utilize secure communication channels for researcher-disclosure, such as encrypted messaging apps or dedicated bug-bounty platforms. * Establish clear guidelines and protocols for reporting zero-day exploits, including notification procedures for Microsoft's Digital Crimes Unit. * Provide timely patches and fixes for disclosed vulnerabilities to minimize the window of opportunity for threat actors to exploit them. * Consider implementing a "researcher-friendly" approach that prioritizes transparency and cooperation with security researchers over strict enforcement of disclosure policies.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
SparkSparkShai-HuludShai-Hulud CVE-2026-45585CVE-2026-45585 CVE-2026-33825CVE-2026-33825 CVE-2026-45498CVE-2026-45498 CVE-2026-41091CVE-2026-41091
Target & Sectors
NORTH_AMERICA NORTH_AMERICA technologytechnology
Incident Timeline
‎2026/05/21
GitHub took down the researcher's account due to the incident.
organisation GitHub
" The fallout from these disclosures is said to have led GitHub to takedown the researcher's account last week.
‎2026/05/25
The Microsoft Security Response Center disclosed a zero-day vulnerability in the MSRC's own software.
organisation the Microsoft Security Response Center
In a blog post last week, the Microsoft Security Response Center (MSRC) addressed the recent flurry of zero-day vulnerabilities and exploits published by an anonymous researcher who goes by "Chaotic-Eclipse" or "Nightmare-Eclipse."
organisation MSRC
In a blog post last week, the Microsoft Security Response Center (MSRC) addressed the recent flurry of zero-day vulnerabilities and exploits published by an anonymous researcher who goes by "Chaotic-Eclipse" or "Nightmare-Eclipse."
organisation VX-Underground
And VX-Underground, a research community focused on malware analysis, echoed that sentiment in its own X post last week.
‎May 27
Microsoft disclosed six zero-day vulnerabilities before releasing patches.
organisation Microsoft Zero Days
Six Microsoft Zero Days Disclosed Before Patches The statement, published on May 27 , mentioned six vulnerabilities that “were not responsibly disclosed.”
‎May 28, 2026
Microsoft urged the research community to share their findings on a recently discovered zero-day vulnerability.
organisation Microsoft
 Ravie Lakshmanan  May 28, 2026 Zero Day / Vulnerability Disclosure Microsoft has come out strongly in favor of Coordinated Vulnerability Disclosure (CVD), urging the research community to share their findings and give affected vendors an opportunity to better understand the impact and address them before they are publicly disclosed.
organisation CVD
 Ravie Lakshmanan  May 28, 2026 Zero Day / Vulnerability Disclosure Microsoft has come out strongly in favor of Coordinated Vulnerability Disclosure (CVD), urging the research community to share their findings and give affected vendors an opportunity to better understand the impact and address them before they are publicly disclosed.
organisation Coordinated Vulnerability Disclosure
 Ravie Lakshmanan  May 28, 2026 Zero Day / Vulnerability Disclosure Microsoft has come out strongly in favor of Coordinated Vulnerability Disclosure (CVD), urging the research community to share their findings and give affected vendors an opportunity to better understand the impact and address them before they are publicly disclosed.
‎2026/05/28
Microsoft criticized security researchers for publicly reporting vulnerabilities in the company's products before patches were available and without prior notice.
infrastructure Windows
These are: ‘Red Sun’ (CVE-2026-41091): a privilege escalation vulnerability in Microsoft Defender (CVSS: 7.8) ‘BlueHammer’ (CVE-2026-45498): another privilege escalation vulnerability in Microsoft Defender (CVSS: 7.8) ‘YellowKey’ (CVE-2026-45585): a security feature bypass vulnerability in Windows BitLocker (CVSS: 6.8) ‘Undefend’ (CVE-2026-45498): a denial-of-service vulnerability in Microsoft Defender (CVSS: 4.0) ‘GreenPlasma,’ a privilege escalation vulnerability in Windows BitLocker ‘MiniPlasma,’ a privilege escalation vulnerability in the Windows Cloud Filter driver Because of these uncoordinated disclosures, Microsoft security teams “have been working around the clock” to investigate these vulnerabilities and develop mitigation measures and work on security patches.
Experts argue that these disclosure windows must drastically shrink to adapt to the massive acceleration of vulnerability research driven by advanced AI tools like Anthropic’s Claude Mythos and OpenAI’s
It started in early April, when the researcher published a proof-of-concept (PoC) exploit on GitHub for " BlueHammer, " a privilege-escalation flaw in Windows Defender tracked as CVE-2026-33825.
A researcher dropped 6 Windows zero-days with no warning.
Over the past month, a researcher going by Chaotic Eclipse , also known as Nightmare-Eclipse, publicly released details of six unpatched vulnerabilities in Windows components including Defender and BitLocker.
The development comes after a researcher named Chaotic Eclipse (aka Nightmare-Eclipse) disclosed details of multiple zero-day vulnerabilities affecting multiple Windows components, including Defender and BitLocker, over the past month, citing a breakdown in Microsoft's handling of the vulnerability disclosure process.
organisation Microsoft Defender
These are: ‘Red Sun’ (CVE-2026-41091): a privilege escalation vulnerability in Microsoft Defender (CVSS: 7.8) ‘BlueHammer’ (CVE-2026-45498): another privilege escalation vulnerability in Microsoft Defender (CVSS: 7.8) ‘YellowKey’ (CVE-2026-45585): a security feature bypass vulnerability in Windows BitLocker (CVSS: 6.8) ‘Undefend’ (CVE-2026-45498): a denial-of-service vulnerability in Microsoft Defender (CVSS: 4.0) ‘GreenPlasma,’ a privilege escalation vulnerability in Windows BitLocker ‘MiniPlasma,’ a privilege escalation vulnerability in the Windows Cloud Filter driver Because of these uncoordinated disclosures, Microsoft security teams “have been working around the clock” to investigate these vulnerabilities and develop mitigation measures and work on security patches.
organisation BlueHammer
These are: ‘Red Sun’ (CVE-2026-41091): a privilege escalation vulnerability in Microsoft Defender (CVSS: 7.8) ‘BlueHammer’ (CVE-2026-45498): another privilege escalation vulnerability in Microsoft Defender (CVSS: 7.8) ‘YellowKey’ (CVE-2026-45585): a security feature bypass vulnerability in Windows BitLocker (CVSS: 6.8) ‘Undefend’ (CVE-2026-45498): a denial-of-service vulnerability in Microsoft Defender (CVSS: 4.0) ‘GreenPlasma,’ a privilege escalation vulnerability in Windows BitLocker ‘MiniPlasma,’ a privilege escalation vulnerability in the Windows Cloud Filter driver Because of these uncoordinated disclosures, Microsoft security teams “have been working around the clock” to investigate these vulnerabilities and develop mitigation measures and work on security patches.
" The vulnerabilities include BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), YellowKey (CVE-2026-45585), GreenPlasma , and MiniPlasma .
It started in early April, when the researcher published a proof-of-concept (PoC) exploit on GitHub for " BlueHammer, " a privilege-escalation flaw in Windows Defender tracked as CVE-2026-33825.
Three of those vulnerabilities, BlueHammer , RedSun , and UnDefend , have since been exploited in the wild.
organisation YellowKey
These are: ‘Red Sun’ (CVE-2026-41091): a privilege escalation vulnerability in Microsoft Defender (CVSS: 7.8) ‘BlueHammer’ (CVE-2026-45498): another privilege escalation vulnerability in Microsoft Defender (CVSS: 7.8) ‘YellowKey’ (CVE-2026-45585): a security feature bypass vulnerability in Windows BitLocker (CVSS: 6.8) ‘Undefend’ (CVE-2026-45498): a denial-of-service vulnerability in Microsoft Defender (CVSS: 4.0) ‘GreenPlasma,’ a privilege escalation vulnerability in Windows BitLocker ‘MiniPlasma,’ a privilege escalation vulnerability in the Windows Cloud Filter driver Because of these uncoordinated disclosures, Microsoft security teams “have been working around the clock” to investigate these vulnerabilities and develop mitigation measures and work on security patches.
" The vulnerabilities include BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), YellowKey (CVE-2026-45585), GreenPlasma , and MiniPlasma .
Related: Miasma Supply Chain Worm Burrows Into 73 Microsoft Repositories Nightmare-Eclipse continued publishing zero-days this month too, with exploits for vulnerabilities known as "YellowKey," "GreenPlasma," and "MiniPlasma."
Related: Agentic AI Isn't Risky; the Way Orgs Deploy It Is Nightmare-Eclipse continued publishing zero-days this month too, with exploits for vulnerabilities known as "YellowKey," "GreenPlasma," and "MiniPlasma."
“The vulnerabilities known as  RedSun ,  UnDefend ,  BlueHammer ,  YellowKey , GreenPlasma, and MiniPlasma were not responsibly disclosed.”
organisation GreenPlasma
These are: ‘Red Sun’ (CVE-2026-41091): a privilege escalation vulnerability in Microsoft Defender (CVSS: 7.8) ‘BlueHammer’ (CVE-2026-45498): another privilege escalation vulnerability in Microsoft Defender (CVSS: 7.8) ‘YellowKey’ (CVE-2026-45585): a security feature bypass vulnerability in Windows BitLocker (CVSS: 6.8) ‘Undefend’ (CVE-2026-45498): a denial-of-service vulnerability in Microsoft Defender (CVSS: 4.0) ‘GreenPlasma,’ a privilege escalation vulnerability in Windows BitLocker ‘MiniPlasma,’ a privilege escalation vulnerability in the Windows Cloud Filter driver Because of these uncoordinated disclosures, Microsoft security teams “have been working around the clock” to investigate these vulnerabilities and develop mitigation measures and work on security patches.
" The vulnerabilities include BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), YellowKey (CVE-2026-45585), GreenPlasma , and MiniPlasma .
Related: Miasma Supply Chain Worm Burrows Into 73 Microsoft Repositories Nightmare-Eclipse continued publishing zero-days this month too, with exploits for vulnerabilities known as "YellowKey," "GreenPlasma," and "MiniPlasma."
Related: Agentic AI Isn't Risky; the Way Orgs Deploy It Is Nightmare-Eclipse continued publishing zero-days this month too, with exploits for vulnerabilities known as "YellowKey," "GreenPlasma," and "MiniPlasma."
“The vulnerabilities known as  RedSun ,  UnDefend ,  BlueHammer ,  YellowKey , GreenPlasma, and MiniPlasma were not responsibly disclosed.”
organisation CVE-2026-33825
" The vulnerabilities include BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), YellowKey (CVE-2026-45585), GreenPlasma , and MiniPlasma .
organisation PoC
It started in early April, when the researcher published a proof-of-concept (PoC) exploit on GitHub for " BlueHammer, " a privilege-escalation flaw in Windows Defender tracked as CVE-2026-33825.
organisation GitHub
It started in early April, when the researcher published a proof-of-concept (PoC) exploit on GitHub for " BlueHammer, " a privilege-escalation flaw in Windows Defender tracked as CVE-2026-33825.
GitHub took down the account.
organisation Nightmare-Eclipse
Over the past month, a researcher going by Chaotic Eclipse , also known as Nightmare-Eclipse, publicly released details of six unpatched vulnerabilities in Windows components including Defender and BitLocker.
The development comes after a researcher named Chaotic Eclipse (aka Nightmare-Eclipse) disclosed details of multiple zero-day vulnerabilities affecting multiple Windows components, including Defender and BitLocker, over the past month, citing a breakdown in Microsoft's handling of the vulnerability disclosure process.
" That last part was widely viewed by infosec professionals across the board as Microsoft threatening to pursue criminal charges against Nightmare-Eclipse, as well as other researchers who publish zero-days.
organisation BitLocker
Over the past month, a researcher going by Chaotic Eclipse , also known as Nightmare-Eclipse, publicly released details of six unpatched vulnerabilities in Windows components including Defender and BitLocker.
The development comes after a researcher named Chaotic Eclipse (aka Nightmare-Eclipse) disclosed details of multiple zero-day vulnerabilities affecting multiple Windows components, including Defender and BitLocker, over the past month, citing a breakdown in Microsoft's handling of the vulnerability disclosure process.
organisation Chaotic Eclipse
The development comes after a researcher named Chaotic Eclipse (aka Nightmare-Eclipse) disclosed details of multiple zero-day vulnerabilities affecting multiple Windows components, including Defender and BitLocker, over the past month, citing a breakdown in Microsoft's handling of the vulnerability disclosure process.
organisation Miasma Supply Chain Worm Burrows Into
Related: Miasma Supply Chain Worm Burrows Into 73 Microsoft Repositories Nightmare-Eclipse continued publishing zero-days this month too, with exploits for vulnerabilities known as "YellowKey," "GreenPlasma," and "MiniPlasma."
organisation Microsoft Repositories
Related: Miasma Supply Chain Worm Burrows Into 73 Microsoft Repositories Nightmare-Eclipse continued publishing zero-days this month too, with exploits for vulnerabilities known as "YellowKey," "GreenPlasma," and "MiniPlasma."
organisation MiniPlasma
“The vulnerabilities known as  RedSun ,  UnDefend ,  BlueHammer ,  YellowKey , GreenPlasma, and MiniPlasma were not responsibly disclosed.”
organisation Microsoft Condemns
Microsoft Condemns "Uncoordinated" Zero Day Disclosures.
organisation Microsoft
In a new bulletin, Microsoft has criticized security researchers for publicly reporting vulnerabilities in the company’s products before patches were available and without prior notice.
Microsoft's Zero-Day Legal Threats Spark Backlash.
Microsoft is angry.
organisation Microsoft Urges Responsible Disclosures
Microsoft Urges Responsible Disclosures The company encouraged security researchers to follow industry standard coordinated vulnerability disclosure (CVD) procedures, where a vulnerability finder and the owner of the vulnerable products convene an embargo period – typically 90 days – to allow the latter to develop patches before the vulnerability is made public.
organisation CVD
Microsoft Urges Responsible Disclosures The company encouraged security researchers to follow industry standard coordinated vulnerability disclosure (CVD) procedures, where a vulnerability finder and the owner of the vulnerable products convene an embargo period – typically 90 days – to allow the latter to develop patches before the vulnerability is made public.
organisation AI Boom Puts
AI Boom Puts 90-Day Disclosure Rule Under Pressure Recently, however, prominent voices in the cybersecurity industry have started to warn that the traditional CVD model must be reimagined, with some declaring that the standard 90-day embargo is effectively dead .
“We realize that we will not always agree on everything, but we are committed to transparency and continue to create opportunities for dialogue.” AI Boom Puts 90-Day Disclosure Rule Under Pressure Recently, however, prominent voices in the cybersecurity industry have started to warn that the traditional CVD model must be reimagined, with some declaring that the standard 90-day embargo is effectively dead .
organisation VulnCheck
For Patrick Garrity, vulnerability researcher at VulnCheck, the CVD procedure is still valuable and necessary and the 90-day window can still be relevant in many cases, but  in some situations, like “when exploitation is already occurring in the wild or is highly likely,” timelines may need to accelerate significantly.
organisation GPT
Read now: What Fronter AI Models Like Mythos and GPT-Cyber Mean for Modern Cybersecurity
organisation Cybersecurity Experts Take Issue
Cybersecurity Experts Take Issue With MSRC Post Many infosec professionals took to social media to call out Microsoft's response to Nightmare-Eclipse.
organisation MSRC Post
Cybersecurity Experts Take Issue With MSRC Post Many infosec professionals took to social media to call out Microsoft's response to Nightmare-Eclipse.
organisation Luta Security
Katie Moussouris, founder and CEO of Luta Security and pioneer in vulnerability disclosure programs, said in a post on social media platform BlueSky that publishing zero-days "isn't the worst thing a researcher can do," and that non-disclosure of vulnerabilities is far worse.
organisation BlueSky
Katie Moussouris, founder and CEO of Luta Security and pioneer in vulnerability disclosure programs, said in a post on social media platform BlueSky that publishing zero-days "isn't the worst thing a researcher can do," and that non-disclosure of vulnerabilities is far worse.
infrastructure Microsoft 365
Coding Gaffe Exposes Microsoft 365 Accounts to Widespread Takeover Infosec professionals also took to social media to vent about their own negative experiences with MSRC in the past.
organisation Widespread Takeover Infosec
Coding Gaffe Exposes Microsoft 365 Accounts to Widespread Takeover Infosec professionals also took to social media to vent about their own negative experiences with MSRC in the past.
organisation Infosec
Infosec professionals also took to social media to vent about their own negative experiences with MSRC in the past.
organisation Nightmare
In a series of blog posts, Nightmare-Eclipse slammed MSRC's response to the reported bugs, claiming Microsoft refused to address them.
organisation Digital Crimes Unit
"Our Digital Crimes Unit will continue bringing cases against these actors and those that enable their criminal activity — coordinating as needed with law enforcement around the world.
Microsoft’s post mentions its Digital Crimes Unit will “continue bringing cases” against actors who harm customers, which may or may not be a signal about what comes next.
organisation BugCrowd
BugCrowd founder Casey John Ellis tells Dark Reading that while the situation with Nightmare-Eclipse is complicated, Microsoft's decision to threaten a researcher with criminal prosecution was "an insanely myopic move, especially after all of the investment they've made into presenting a secure, transparent, and research-friendly face to the market." Andrew Case, director of threat research at Volexity, said in an X post that by publishing the blog post, MSRC "decided to kill off all the goodwill it has built up over the last decade."
organisation Volexity
BugCrowd founder Casey John Ellis tells Dark Reading that while the situation with Nightmare-Eclipse is complicated, Microsoft's decision to threaten a researcher with criminal prosecution was "an insanely myopic move, especially after all of the investment they've made into presenting a secure, transparent, and research-friendly face to the market." Andrew Case, director of threat research at Volexity, said in an X post that by publishing the blog post, MSRC "decided to kill off all the goodwill it has built up over the last decade."
organisation Elastic
For example, Gabriel Landau, security researcher and former principal software engineer at Elastic, wrote a lengthy post on X about a frustrating encounter in which he reported a Microsoft Device Guard bypass.
organisation Microsoft Device Guard
For example, Gabriel Landau, security researcher and former principal software engineer at Elastic, wrote a lengthy post on X about a frustrating encounter in which he reported a Microsoft Device Guard bypass.
organisation Coordinated Vulnerability Disclosure
The post is essentially a public defense of Coordinated Vulnerability Disclosure, the standard practice where a researcher notifies a vendor privately, gives them time to fix the issue, and then goes public.
organisation Microsoft Calls
Microsoft Calls the Zero-Day Dumps Irresponsible.
organisation Microsoft’s Security Response Center
Microsoft’s Security Response Center responded on Tuesday with a blog post that was polite in tone and unambiguous in message.
organisation CVE
In a blog post published over the weekend, Chaotic Eclipse described a pattern of ignored reports, deleted accounts, and what they perceived as public humiliation by Microsoft in a CVE advisory.
organisation GitLab
The exploit code was then uploaded to GitLab, where the newly created account has also since been blocked.
Although the exploit code for the six vulnerabilities was subsequently uploaded to GitLab, the newly created account has since been blocked.
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, Zero-Day)
organisation Microsoft Slams Public Zero-Day
Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal.
organisation RedSun
Following disclosure, BlueHammer, RedSun, and UnDefend have all come under active exploitation in the wild.
‎this date July 14th
Researchers publicly disclosed a previously unknown zero-day exploit in Microsoft software on July 14th.
‎July 14, 2026
Researchers announced plans to release a zero-day exploit on July 14, 2026.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
…vulnerability in Microsoft Defender (CVSS: 7.8) ‘YellowKey’ (CVE-2026-45585): a security feature bypass vulnerability in Windows BitLocker (CVSS: 6.8) ‘Undefend’ (CVE-2026-45498): a denial-of-service vulnerability in Microsoft Defender (CVSS:…
Experts argue that these disclosure windows must drastically shrink to adapt to the massive acceleration of vulnerability research driven by advanced AI tools like Anthropic’s Claude Mythos and OpenAI’s
It started in early April, when the researcher published a proof-of-concept (PoC) exploit on GitHub for " BlueHammer, " a privilege-escalation flaw in Windows Defender tracked as CVE-2026-33825.
A researcher dropped 6 Windows zero-days with no warning.
Over the past month, a researcher going by Chaotic Eclipse , also known as Nightmare-Eclipse, publicly released details of six unpatched vulnerabilities in Windows components including Defender and BitLocker.
…her named Chaotic Eclipse (aka Nightmare-Eclipse) disclosed details of multiple zero-day vulnerabilities affecting multiple Windows components, including Defender and BitLocker, over the past month, citing a breakdown in Microsoft's handling of the…
Metrics
infrastructure
‎Microsoft 365
Affected Product
Coding Gaffe Exposes Microsoft 365 Accounts to Widespread Takeover Infosec professionals also took to social media to vent about their own negative experiences with MSRC in the past.
Intelligence Sources
Infosecurity-Magazine 2026-05-28
Security Affairs 2026-05-29
The Hacker News 2026-05-28
Dark Reading 2026-06-01
Dark Reading 2026-06-01
Infosecurity-Magazine 2026-05-28