{
  "id": 9163615,
  "title": "NightmareEclipse's latest zero-day leaves Microsoft Defender stuck in the past",
  "url": "https://urgent.news/2026/09/22/nightmareeclipses-latest-zero-day-leaves-microsoft-defender-stuck-in",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-22T16:36:00.000Z",
  "source": {
    "name": "The Register",
    "slug": "the-register",
    "url": "https://www.theregister.com/security/2026/09/22/nightmareeclipses-latest-zero-day-leaves-microsoft-defender-stuck-in-the-past/5298320"
  },
  "original_language": "en",
  "account": "In a recent development, security researcher NightmareEclipse has discovered a new method to disrupt Windows Defender's update process, leaving the antivirus software stuck with outdated security intelligence. Dubbed \"BigDiskBuster,\" the proof-of-concept tool prevents Microsoft Defender Antivirus from installing platform and security updates, effectively forcing users to remain on their current version. NightmareEclipse described the tool as similar to their earlier \"UnDefend\" tool and noted that it works on all supported versions of Windows, though they acknowledged the PoC is buggy and requires rewriting. Unlike traditional methods that disable Defender, BigDiskBuster waits for an update to begin, then consumes the drive's free space by creating hidden temporary files and utilizing additional threads. Once the update fails, the tool removes the files, allowing Defender to continue running but with outdated threat definitions. While this may not provide a direct route to SYSTEM privileges, it does leave the antivirus vulnerable to newly detected malware. The researcher's actions stem from a dispute with Microsoft over their vulnerability disclosure process, with NightmareEclipse releasing zero-days and PoC code in April, accusing Microsoft of mistreatment and cutting off their access to the vulnerability reporting system. Microsoft responded with criticism and threats, but later backed off, although NightmareEclipse's GitHub account was taken down. BigDiskBuster is a unique tool as it does not aim to provide SYSTEM privileges but rather interferes with the basic update functionality of antivirus software, leaving its usage in real-world attacks unverified.",
  "summary": "BigDiskBuster leaves Microsoft's antivirus running but unable to install updates",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register Science",
        "title": "NightmareEclipse's latest zero-day leaves Microsoft Defender stuck in the past",
        "url": "https://urgent.news/2026/09/22/nightmareeclipses-latest-zero-day-leaves-microsoft-defender-stuck-in-9167894",
        "published": "2026-09-22T16:36:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}