AI Weekly Malaysia

Security researcher Nightmare Eclipse published a new Windows zero-day, dubbed ShieldBreak, that exploits Windows Defender to escalate from low-level user to full system access. The bug affects Windows 10, Windows 11 (including 25H2), and Windows Server 2025, requires Windows Defender to be enabled, and has no patch yet. Will Dormann independently verified the exploit, which builds on an earlier bug called RoguePlanet whose patch Nightmare Eclipse says is now fully bypassed.

Why: If you run Windows Server 2025 or Windows 11 in production or dev environments, there is no patch for this local privilege escalation bug, and disabling Windows Defender is not a safe workaround since the exploit requires Defender to be enabled. The practical takeaway is to restrict what untrusted executables can run on Windows hosts and treat any local code execution as a full compromise until Microsoft patches.

A hacker known as Nightmare Eclipse published ShieldBreak, the 10th Windows zero-day in their campaign against Microsoft, a local privilege-escalation exploit that gains SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server 2025. Former Microsoft employee Kevin Beaumont confirmed it works on the latest Windows 11 and published three detection and hunting queries. The exploit bypasses Microsoft's July fix for CVE-2026-50656 (RoguePlanet) but operates differently, abusing Defender's cloud-hydration scan via the Cloud Filter API.

Why: If you run Windows Server or Windows desktops in production, apply Beaumont's hunting queries now since Microsoft has not yet patched ShieldBreak and the PoC has a claimed 100% success rate on Windows 11 25H2. Because this is a local privilege-escalation exploit (not remote), the immediate risk is to multi-tenant or shared Windows environments where an attacker already has low-level access.

A researcher going by 'Chaotic Eclipse' has published a proof-of-concept called ShieldBreak that claims to fully bypass Microsoft's patch for CVE-2026-50656 (RoguePlanet), a race condition in the Microsoft Defender Malware Protection Engine (mpengine.dll) that can grant SYSTEM-level privileges. The PoC reportedly has a 100% success rate on Windows 11 25H2 and Windows Server 2025, with Windows 10 also vulnerable but untested. Microsoft says it is investigating the patch bypass claim.

Why: If you run Windows 11 25H2 or Windows Server 2025 in production or dev environments, this PoC means the existing Defender patch for CVE-2026-50656 does not actually protect you — an attacker with local access can still escalate to SYSTEM. Treat Defender's patch as insufficient and add compensating controls (restrict local user privileges, monitor for unexpected child processes from Defender's engine) until Microsoft ships a corrected patch.

Researchers Alejandro Hernando and Borja Martinez demonstrated at DEF CON 34 that Windows 11's Plug and Play auto-install can be chained into full SYSTEM execution on a fully updated machine. The physical path emulates a Sierra Wireless device to install SwiService.exe, abuses its SetDNS primitive, then emulates a Sony FeliCa reader whose co-installer fetches config over plaintext HTTP with a path-traversal flaw to plant a DLL in System32. A remote variant forges synthetic USB traffic over RDP using a phantom Intel RealSense device and a CRYPTBASE.dll search-order hijack, though Microsoft notes RDP USB redirection is not enabled by default.

Why: If your team runs Windows 11 endpoints with RDP USB redirection enabled or allows untrusted USB devices on managed machines, this chain gives an unprivileged user or authenticated RDP user a path to SYSTEM. The practical action is to verify that low-level USB redirection over RDP is disabled (Microsoft says it is off by default) and restrict physical USB device installation on shared or kiosk-style Windows machines.