After Microsoft threatened legal action, a security researcher publishes a new Windows zero-day bug
- ID
- 13510
- Status
- summarized
- Published
- 12 Aug 2026, 11:18 PM
- Fetched
- 12 Aug 2026, 11:38 PM
- Provider
- TechCrunch
- Category
- technology
- Original URL
- https://techcrunch.com/2026/08/12/after-microsoft-threatened-legal-action-a-security-researcher-publishes-a-new-windows-zero-day-bug/
- Source URL
- https://techcrunch.com/feed/
Summary
- Score
- 5.5
- Created
- 12 Aug 2026, 11:42 PM
- Tags
- Audience
- developersvibe_coders
What happened
Security researcher Nightmare Eclipse published a new Windows zero-day, dubbed ShieldBreak, that exploits Windows Defender to escalate from low-level user to full system access. The bug affects Windows 10, Windows 11 (including 25H2), and Windows Server 2025, requires Windows Defender to be enabled, and has no patch yet. Will Dormann independently verified the exploit, which builds on an earlier bug called RoguePlanet whose patch Nightmare Eclipse says is now fully bypassed.
Why it matters
If you run Windows Server 2025 or Windows 11 in production or dev environments, there is no patch for this local privilege escalation bug, and disabling Windows Defender is not a safe workaround since the exploit requires Defender to be enabled. The practical takeaway is to restrict what untrusted executables can run on Windows hosts and treat any local code execution as a full compromise until Microsoft patches.
Discussion angle
The tension between Microsoft's legal threats against researchers and the researcher's decision to publish unpatched zero-days — does publishing proof-of-concept code force better patching or just put more users at risk?