After Microsoft's legal threat, researcher publishes new Windows bug

A security researcher has published details of a new vulnerability in the latest versions of Windows that lets hackers gain system-wide access to a device and its data — despite facing a legal threat from Microsoft weeks earlier over the release of previously unknown software flaws. The bug, dubbed ShieldBreak, is the latest disclosure from researcher Nightmare Eclipse, who has published details of several bugs affecting Microsoft products, including Windows, in recent months.

According to Nightmare Eclipse’s post, ShieldBreak exploits a flaw in Windows Defender, the anti-malware and security engine built into Windows, allowing an attacker to escalate their permissions from a low-level user to full access to the device and its data. Nightmare Eclipse published the proof-of-concept exploit as a Windows app that requires the user to run it, and said the bug works on Windows 10, Windows 11 (including the latest 25H2 version), and Windows Server 2025. Security researcher Will Dormann verified that the bug works and that Windows Defender must be enabled for the exploit to succeed.

The latest exploit builds on an earlier one Nightmare Eclipse developed called RoguePlanet, according to the researcher. Microsoft rolled out a patch for RoguePlanet, but Nightmare Eclipse implied the fix wasn’t sufficient, saying the new exploit demonstrates a full bypass of that earlier patch. Microsoft has not yet released a patch for ShieldBreak; because the company was given no time to fix it before public disclosure, the bug is considered a zero-day. An unnamed Microsoft spokesperson said the company is “aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims.”

The disclosure is the latest round in a long-running back-and-forth between the researcher and Microsoft over the company’s handling of bug reports. In blog posts, Nightmare Eclipse has claimed Microsoft mistreated them and didn’t handle their reports adequately, implying they had no choice but to disclose the bugs publicly; several bugs the researcher previously released in Windows were later exploited in real-world attacks against organizations. In May, Microsoft published a blog post threatening legal action against security researchers who release zero-day details outside its disclosure policies, drawing heavy rebuke from the security community, many of whom described similar experiences. Microsoft later walked back the comments in a social media post, though the original blog post remains published and unchanged.

ShieldBreak lands a day after Microsoft’s regularly scheduled monthly Patch Tuesday release — the second month in a row in which the number of patches reached around 500 or so bugs, driven by the company’s growing use of AI to find and weed out security flaws.

Why it matters

The clash shows Microsoft’s disclosure-policy threats haven’t deterred at least one researcher from going public, and each new bypass of a patched flaw raises the stakes for how Microsoft manages independent security research going forward.