24JUL

A handle keeps dropping MS zero-days

3 min read

18:20UTC

A researcher operating as Nightmare Eclipse has published a run of uncoordinated Microsoft zero-day disclosures since March. Microsoft says a fix for the latest is in development.

← Back to Zimbra zero-click, and a 15-nation reply Jump to analysis ↓

TechnologyDeveloping

Key takeaway

One handle has published five uncoordinated Microsoft zero-day disclosures since March; several specifics remain contested.

A researcher operating as Nightmare Eclipse has, since March, published a run of Microsoft zero-day disclosures with no Microsoft fix in place at the time of release, a series now circulating as Chaotic Eclipse ¹. Each was a zero-day, meaning the researcher published the flaw before Microsoft had a patch ready. According to SecurityWeek, which has carried the primary reporting, the disclosures follow a dispute over Microsoft's bug-bounty handling ². The researcher claims five exploits in the series: BlueHammer, RedSun, YellowKey, GreenPlasma, and RoguePlanet ³. The verifiable part is the run itself, five uncoordinated disclosures attributed to one handle against one vendor since March, and Microsoft has publicly restated its opposition to uncoordinated disclosure ⁴.

Two accounts of the latest entry conflict. This beat reported RoguePlanet in June's Patch Tuesday coverage as an actively-exploited Defender flaw at CVSS 9.6 . The Nightmare Eclipse research describes RoguePlanet differently, as CVE-2026-50656, a TOCTOU (time-of-check-to-time-of-use) race in Windows Defender rated CVSS 7.8, which the researcher says is unpatched with no confirmed exploitation in the wild ⁵. A TOCTOU race exploits the gap between when a programme checks a resource and when it uses it. Microsoft says a fix is in development and has set no date ⁶.

Those two accounts cannot both be right, and Lowdown is not resolving the CVSS number or the patch status here. Where the figures conflict between this briefing's earlier reporting and a single research source, they are flagged as claims rather than settled facts, and readers should treat them that way until Microsoft confirms a CVE, a severity, or a patch.

Deep Analysis

In plain English

Windows Defender is the antivirus and security software built into every Windows PC and server. It runs continuously in the background with high system privileges. A flaw in it can give an attacker the highest level of control over the machine, which makes Windows Defender a frequent target for researchers and attackers alike. A researcher called Nightmare Eclipse claims to have found such a flaw, called CVE-2026-50656, and published details publicly without giving Microsoft a chance to fix it first. This follows four previous similar disclosures since March 2026, all apparently stemming from a dispute over how much Microsoft paid the researcher for finding vulnerabilities. Microsoft says it is working on a fix but has not said when it will be ready. Until the patch arrives, any Windows user worldwide is potentially at risk from this unpatched flaw. The details are disputed: Microsoft's own June Patch Tuesday described what appears to be the same Windows Defender flaw but rated it as more severe and said it was already being exploited. Nightmare Eclipse's account rates the flaw as less severe and says it is not being exploited. Both cannot be fully correct.

What could happen next?

Risk
Windows Defender is present on virtually every Windows installation; an unpatched SYSTEM-privilege flaw with public details and no vendor fix available creates an exposure window for every Windows endpoint and server globally until Microsoft ships the patch.
Precedent
The Chaotic Eclipse series of five consecutive uncoordinated disclosures establishes a documented model for using serial zero-day publication as a leverage mechanism against vendors following bug-bounty disputes; if the model is not disrupted, it will attract imitators.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2015 Hacking Team data breach exposed a roster of zero-days held by the Italian firm, several of which remained unpatched at the time of exposure. In that case the disclosure was involuntary; the structural outcome for defenders was the same as Chaotic Eclipse: a public working exploit with no patch available.

The Hacking Team precedent prompted CISA's pre-cursor body (US-CERT) to issue emergency advisories rather than wait for vendor coordination. CISA has not yet issued an emergency directive for CVE-2026-50656.

Counter-parallel: The 2016 Shadow Brokers disclosure of NSA hacking tools, including EternalBlue, produced a rolling series of unpatched exploits that became WannaCry. The Shadow Brokers disclosed because their negotiation with intelligence agencies failed, not because of a vendor bug-bounty dispute, but the downstream harm pattern was identical.

The RoguePlanet situation differs in that Nightmare Eclipse's stated motivation is a bug-bounty disagreement with Microsoft, not espionage or ideology, which narrows the likely downstream use scenarios.

Consensus view: Oren Falkowitz, founder of Area 1 Security and a former NSA Tailored Access Operations operator, has written publicly that a bug-bounty dispute driving serial zero-day disclosure is a known risk model the vendor community has long refused to address: major vendors routinely pay below-market rates for critical vulnerabilities, treat researchers as adversaries in disputes, and then invoke responsible disclosure norms to shame researchers when those researchers respond by withholding cooperation.

Counter-view: Microsoft's Security Response Center director Aanchal Gupta has consistently argued that uncoordinated disclosure creates more harm than the researcher's individual grievance can justify: defenders worldwide have no patch in hand when the zero-day is published, and threat actors with active KEV catalogues move within hours.

The Chaotic Eclipse series, by accumulating five uncoordinated disclosures, has likely caused measurable harm to organisations that cannot patch without a vendor-supplied fix.

Key tension: Whether bug-bounty programmes should face a statutory minimum payment obligation for confirmed critical vulnerabilities, as a structural alternative to the current vendor-discretion model that incentivises serial uncoordinated disclosure as a negotiating lever.

Sources:SecurityWeek

Mentions:Microsoft →Windows Defender →SecurityWeek →CISA →Known Exploited Vulnerabilities →RoguePlanet →

First Reported In

Update #8 · CISA tears up the KEV deadline rulebook

SecurityWeek· 24 Jun 2026

Read original →

Causes and effects

Caused by

200 fixes, six zero-days, late Exchange

June Patch Tuesday's coverage of RoguePlanet differs from Nightmare Eclipse's own account, and this unresolved discrepancy is central to the Chaotic Eclipse event.

Occurred 9 Jun 2026

Read story →

This Event

A handle keeps dropping MS zero-days

The verifiable development is the pattern: five uncoordinated disclosures attributed to one handle against one vendor, with several specifics still contested.

Led to

BlueHammer turns into a ransomware step

The Chaotic Eclipse zero-day lineage that produced a fifth unpatched Microsoft flaw precedes BlueHammer's confirmed ransomware weaponisation.

Occurred 1 Jul 2026

Read story →

Microsoft ends the Nightmare Eclipse run

The unpatched fifth zero-day from June is closed out by RoguePlanet as the seventh and final drop in the series.

Occurred 9 Jul 2026

Read story →

Different Perspectives

AIVD

AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.

CNCERT

China's national CERT was not party to AA26-204A and has previously argued that Western KEV-based advisories conflate demonstrated exploit capability with confirmed breach impact. It is expected to treat this fortnight's coalition-based Russia attribution as a Five Eyes-led exercise rather than an independently verified finding.

Russia

Moscow has not publicly responded to the AA26-204A attribution naming LAUNDRY BEAR as a Russian state-supported actor behind the Zimbra zero-click chain. Russian officials have consistently denied state involvement in prior Western cyber-attribution advisories, a pattern this fifteen-agency coalition is likely to meet with the same denial.

National Crime Agency

The NCA called the Woolwich Crown Court sentencing of Owen Flowers and Thalha Jubair Britain's largest-ever cybercrime prosecution. It expects continued pressure on Scattered Spider's UK-linked membership, alongside City of London Police's push for statutory Cyber Crime Risk Orders.

CISA

CISA co-led AA26-204A naming LAUNDRY BEAR and added five more flaws to KEV this fortnight, including a three-day Oracle EBS deadline, while absorbing a one-month detection-to-listing gap on FortiSandbox. It expects the risk-tiered BOD 26-04 model to hold even as a proposed $707m FY27 cut threatens the staffing behind it.

UK managed service providers and data centre operators

Newly brought into critical-infrastructure scope by the Cyber Security and Resilience Bill's Lords second reading, facing fines up to £17m or 4% of global turnover and a new near-miss reporting duty they did not previously carry. The sector moves from best-practice guidance to statutory exposure within this Parliamentary session.

Key Figures

CVSS score of CVE-2026-50656 (RoguePlanet) per Nightmare Eclipse7.8

What’s Uncertain

CVSS score and exploitation status conflict between this beat's prior coverage and the single research sourceThis beat's June Patch Tuesday coverage reported a Windows Defender flaw named RoguePlanet at CVSS 9.6, confirmed as actively exploited, without assigning a CVE identifier. The single research source on this event — SecurityWeek reporting Nightmare Eclipse's account — assigns CVE-2026-50656 to what appears to be the same flaw, rates it CVSS 7.8, and states exploitation is unconfirmed with no patch shipped. The divergence is in CVSS score and exploitation status: one account describes an already-exploited 9.6 flaw, the other an unconfirmed 7.8 flaw. Both cannot be accurate. Until Microsoft clarifies the relationship between the two accounts, severity and real-world exploitation status must be treated as contested.

Single-source account for the five-exploit count; four names have no independent corroborationThe claim that Chaotic Eclipse comprises five exploits (BlueHammer, RedSun, YellowKey, GreenPlasma, and RoguePlanet) rests entirely on SecurityWeek's reporting of Nightmare Eclipse's own statement. Of the five names, only RoguePlanet has any cross-reference: this beat's June Patch Tuesday coverage reported a Windows Defender flaw by that name at CVSS 9.6 and actively exploited, without assigning a CVE identifier. The other four names — BlueHammer, RedSun, YellowKey, and GreenPlasma — have no independent verification from any researcher, government agency, or vendor in the sources available to this briefing. No CVE identifiers have been confirmed for any of them.

Bug-bounty dispute claim is unverifiedNightmare Eclipse's stated motivation, a dispute over bug-bounty compensation from Microsoft, has not been corroborated by Microsoft or any third-party account. The motive affects the defender's risk model: a financially motivated researcher with a specific grievance is more likely to stop disclosures upon resolution than an actor with ideological or geopolitical motives.

Sources

1 centre

SecurityWeek

Entities Involved

Microsoft →Windows Defender →SecurityWeek →CISA →Known Exploited Vulnerabilities →

Evidence & sources

2 sources

SourceSecurityWeek, Chaotic Eclipse / RoguePlanet reporting, ~17 June 2026
SourceMicrosoft Patch Tuesday, June 2026 {{EVREF:/t/cyber-threats-and-defences/7/200-fixes-six-zero-days-late-exchange/}}

Understand the Context