Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
- ID
- 27379
- Status
- summarized
- Published
- 23 Sep 2026, 12:14 AM
- Fetched
- 23 Sep 2026, 2:56 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/researcher-drops-bigdiskbuster-zero-day.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 5.0
- Created
- 23 Sep 2026, 3:02 AM
- Tags
- Audience
- developerssaas_startups
What happened
A zero-day PoC called BigDiskBuster was published on GitHub on September 19 by Abdelhamid Naceri, a former Microsoft Security Response Center researcher who was dismissed in 2024. The tool blocks Microsoft Defender from installing platform and signature updates by creating hidden files that fill all remaining disk space whenever Defender begins downloading updates. There is no patch, no CVE, and no Microsoft advisory yet, and no independent researcher has confirmed the behavior.
Why it matters
If you rely on Microsoft Defender as your primary endpoint protection on Windows, this tool can silently stale its detection signatures with no clear alert. Naceri's three previous Defender exploits were all used in live intrusions before patching, so this warrants monitoring. Consider whether your monitoring stack checks Defender update success logs, not just whether Defender is running.
Discussion angle
Naceri's track record of exploits being used in real intrusions before patching raises the question: do you actively monitor whether Defender updates succeed, or just whether the service is alive?