3AUG

Microsoft ends the Nightmare Eclipse run

2 min read

16:08UTC

Microsoft shipped an out-of-band Defender update on 9 July patching RoguePlanet, the seventh and final zero-day from the researcher known as Nightmare Eclipse.

← Back to KEV deadlines fell from 14 days to three Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Nightmare Eclipse's seven-drop run against Microsoft is closed, but the disclosure breakdown leaves defenders exposed in each gap.

Microsoft shipped an out-of-band (OOB) Malware Protection Engine update, version 1.1.26060.3008, on Thursday 9 July, patching RoguePlanet (CVE-2026-50656) ¹. The flaw let a local attacker escalate to SYSTEM, the highest account on a Windows machine, through improper link resolution in Windows Defender, a local privilege escalation (LPE). The fix ships silently through the normal Defender signature channel, so administrators need take no action.

RoguePlanet was the seventh and final zero-day from the researcher known as Nightmare Eclipse since April, closing the series rather than extending it. The fifth in that run landed in June still unpatched. RoguePlanet itself sat public with proof-of-concept code for roughly a month before the fix arrived.

Nightmare Eclipse released working exploits before patches existed, and Microsoft answered with legal threats and account takedowns while the code stayed live on public mirrors ². Coordinated disclosure depends on both sides trusting the process, and a month of public exploit code against Defender, seven times since April, shows that trust fraying. Defenders absorb the exposure in the gap between drop and patch, which pushes the burden onto compensating controls like application allow-listing and endpoint tamper protection.

Deep Analysis

In plain English

Windows Defender is Microsoft's built-in antivirus tool. RoguePlanet was a flaw in Defender itself that let an attacker who already had limited access to a machine grant themselves full administrator control, known as privilege escalation. Microsoft fixed it by pushing an updated "engine", the core scanning software inside Defender, rather than waiting for its usual monthly round of security patches. This was the seventh and last flaw in a series found by a researcher going by the handle Nightmare Eclipse, so this update closes out that whole run of bugs.

Deep Analysis

Root Causes

RoguePlanet is a local privilege-escalation flaw, which exploits a trust boundary inside Defender's own scanning engine rather than a network-facing surface, so Microsoft could fix it by shipping a new engine build (1.1.26060.3008) instead of waiting for a full security update. That distinction, engine-level versus OS-level patching, is why this fix reached endpoints faster than a typical CVE on Patch Tuesday.

Nightmare Eclipse's run of seven disclosures against the same component over one series points to systematic fuzzing of that trust boundary rather than independent, unrelated discoveries.

Source Landscape

This story draws on neutral-leaning sources from United Kingdom

United Kingdom

Primary parallel: Google Project Zero's 90-day disclosure policy forced a sustained run of rapid vendor patches through the 2010s; Microsoft's response to the seven-flaw Nightmare Eclipse series follows the same pattern of one research relationship generating a repeated patch cadence rather than a single fix.

Counter-parallel: The Follina zero-day (CVE-2022-30190) sat unpatched for weeks despite public proof-of-concept code, showing Microsoft's response speed for local-privilege-escalation and logic-flaw bugs is inconsistent even within its own product lines.

Consensus view: SANS Institute's patch-management guidance holds that out-of-band Defender engine updates close the exposure window fastest for signature-based flaws like RoguePlanet, because engine builds like 1.1.26060.3008 ship independently of Microsoft's monthly cumulative cycle.

Counter-view: Forrester's endpoint-security research argues the out-of-band model still leaves unmanaged and air-gapped endpoints exposed for weeks, since engine auto-update depends on live telemetry connections that many regulated environments deliberately block.

Key tension: Whether Microsoft's engine-level patch channel is a genuine acceleration or simply shifts the same latency onto a smaller population of disconnected machines.

Sources:The Register

Mentions:Microsoft →RoguePlanet →CVE-2026-48172 →Windows Defender →Forrester →Google →

First Reported In

Update #10 · One operator worked both ransomware brands

The Register· 14 Jul 2026

Read original →

Causes and effects

Caused by

A handle keeps dropping MS zero-days

The unpatched fifth zero-day from June is closed out by RoguePlanet as the seventh and final drop in the series.

Occurred 17 Jun 2026

Read story →

This Event

Microsoft ends the Nightmare Eclipse run

A month of public Defender exploit code, seven times since April, shows coordinated disclosure fraying between Microsoft and an adversarial researcher.

Different Perspectives

Group-IB

Group-IB, headquartered in Singapore, documented on 19 March that The Gentlemen began inside Qilin's own affiliate programme and split from it over a payment dispute. Its analysis makes this window's leak-site tally readable as a fracture inside one ransomware operation rather than the arrival of an unknown crew.

ENISA

ENISA placed EU drinking water and wastewater in its cyber risk zone for the first time on 28 May, finding one in three water entities had never run a risk assessment. CISA's 30 July advisory to American operators reads as the operational sequel to a gap European regulators had already documented two months earlier.

House of Lords and NCSC

The Cyber Security and Resilience Bill sits at House of Lords committee stage, its amendment paper running to 23 July. Separately, the NCSC guidance CISA cited when directing water operators to disconnect controllers is version 1.0 from March 2024, a two-year-old British document doing operational work in an American alert published last week.

heise online

heise online reported on 27 July that Russian state attackers, named as APT28, ran the hotel WiFi credential-harvesting campaign. Its attribution is firmer than ReliaQuest's own hedged low-to-medium confidence assessment of the same intrusion, a difference in national reporting posture rather than a settled dispute over who is responsible.

CISA and ReliaQuest

CISA compressed remediation deadlines under BOD 26-04 while, in the same window, telling water and wastewater operators to disconnect internet-exposed controllers rather than patch them. ReliaQuest, investigating the hotel WiFi campaign, held its assessment of the intrusion route at low-to-medium confidence and declined to name a state sponsor.

AIVD

AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.