Researcher Publishes New Windows 0-Day Despite Microsoft's Threats to Sue

A security researcher known by the handle Nightmare Eclipse has published the details of a new vulnerability affecting current versions of Windows — despite the fact that just weeks earlier Microsoft had publicly threatened legal action over the disclosure of previously unknown flaws.

The vulnerability has been named ShieldBreak and, according to the researcher, it exploits a flaw in Windows Defender — the antivirus and protection engine built into Windows. A successful attack lets an attacker escalate privileges from those of an ordinary user to full access to the device and its data. The proof-of-concept has been published as a Windows application: for the vulnerability to trigger, the user has to run the program themselves. The author claims the exploit works on Windows 10, Windows 11 (including the recent 25H2 build) and Windows Server 2025.

Security researcher Will Dormann confirmed that the vulnerability works and clarified an important detail: the exploit triggers only when Windows Defender is enabled. ShieldBreak builds on an earlier exploit by the same author called RoguePlanet. Microsoft had released a fix for RoguePlanet, but Nightmare Eclipse made clear that the patch was inadequate and that the new exploit bypasses it entirely.

Microsoft has yet to release a patch for ShieldBreak, and a company representative did not immediately respond to TechCrunch's request. The vulnerability is considered a “zero-day” precisely because the developer had no time to close it before its public disclosure.

A drawn-out conflict

The publication is the latest episode in a long-running standoff between the researcher and the corporation. In a series of posts, Nightmare Eclipse claimed that Microsoft had treated him dismissively and failed to handle his reports properly — the implication being that he supposedly had no choice left but to go public. Vulnerabilities in Windows he had disclosed previously were later used in real-world attacks on organizations.

In May, Microsoft published a blog post threatening lawsuits against researchers who disclose 0-days in violation of its policy. The community's reaction was sharply critical: many specialists shared similar experiences dealing with the company. Microsoft later softened its wording on social media, but the original blog text has remained unchanged.

ShieldBreak surfaced the day after the monthly “Patch Tuesday.” For the second month in a row, the number of fixes has held at around 500 — a rise Microsoft attributes to its increasingly active use of AI to find and screen out security flaws.

Source: TechCrunch