Disgruntled security researcher just dropped another Windows zero-day, right on schedule

Disgruntled researcher NightmareEclipse has released yet another zero-day flaw targeting all supported versions of Windows. In a recurring pattern, Microsoft has threatened legal action but will now have to deal with the new vulnerability unveiled just before Patch Tuesday. The new flaw, dubbed ShieldBreak, exploits a vulnerability in Windows Defender, allowing attackers to gain full, unrestricted access to a device and its data.

Although Microsoft released a fix for a related flaw in July, NightmareEclipse claims the patch does not adequately address the issue in the antivirus engine. The proof-of-concept (POC) demonstration for ShieldBreak successfully bypasses the Microsoft patch, granting complete user control over the compromised Windows machine. External researchers have verified the POC's legitimacy, although they might not be directly related to the previously disclosed RoguePlanet vulnerability.

The researcher tested the POC on the latest Windows 11 25H2 and Windows Server 2025 builds, achieving a 100% success rate. While the flaw works against unsupported operating systems, Microsoft is investigating the issue, but has not yet confirmed NightmareEclipse's claims. The ongoing dispute between NightmareEclipse and Microsoft over security vulnerabilities in Windows has been ongoing for months, with the researcher alleging that the company may have planted a backdoor in its OS.

Microsoft has denied these accusations, but has threatened legal action in response to NightmareEclipse's disclosures. Despite negative feedback from the security community, Microsoft has not officially credited NightmareEclipse for his contributions.