Researcher Publishes FalconFlank — a 0day Exploit for CrowdStrike Falcon

A researcher known by the handles Chaotic Eclipse (as well as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse) has published a new 0day called FalconFlank — a privilege-escalation vulnerability in the CrowdStrike Falcon sensor.

According to the author, as laid out in the README file on GitHub, FalconFlank abuses the mechanism Falcon Sensor uses to neutralize malicious Office macros. The same author warns that, by the time of publication, the company probably already has detection for this attack in place: to test the PoC, you'll have to either add it to the exclusions or obfuscate the code and change the DLL-loading technique. The exploit, it's claimed, works on a fully updated Windows 11 25H2 and Windows Server 2025 with CrowdStrike Falcon installed. The Hacker News has reached out to CrowdStrike for comment.

A Series of Blows Against Security Products

FalconFlank is no isolated jab. Shortly before it, Chaotic Eclipse released a PoC for a similar vulnerability in Kaspersky's product for Windows (version 14.0.0.504), which he named HardBreacher. The author himself describes it without any gloss: the code is “held together with duct tape,” it launches only every other time and crashes out with an error, so you have to restart it again and again. But when it does work, the researcher says, Kaspersky “completely loses its mind”: hijacking control over the UI process lets you shut down protection, allow or block access to files you shouldn't have touched, and ultimately turn the whole operating system “into hot chaos.”

A month earlier came ShieldBreak (CVE-2026-69414) — a 0day for Microsoft Defender that allows arbitrary code execution with NT AUTHORITY\SYSTEM privileges. It's considered a bypass of the patch for an earlier vulnerability, RoguePlanet. According to a description by LevelBlue, ShieldBreak combines the Cloud Files API, manipulation of the Object Manager namespace, a direct call to the Defender API and a timing race in the threat-remediation path — as a result, the “clean” Defender engine is redirected into writing an attacker-planted DLL into System32, which is then executed as SYSTEM.

A Conflict with Vendors

The author publicly complains that Microsoft “ignores” him and refuses any communication, allegedly trying to paint him as an “insane criminal.” Because of the restrictions imposed on him, he says, he can't even report vulnerabilities to the relevant vendors. Hence the tactics he's chosen: publishing bugs in third-party products in the window before the next Patch Tuesday drops. “I just want to live like a normal person for once — is that really too much to ask?” he wrote in a message dated August 14, 2026.

Source: The Hacker News