Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal
Summary: A researcher known as Chaotic Eclipse (aka Nightmare-Eclipse) publicly disclosed details of six Windows zero-day vulnerabilities over the past month, including BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), YellowKey (CVE-2026-45585), GreenPlasma, and MiniPlasma, without sharing them with Microsoft first. Microsoft said it firmly opposes such uncoordinated disclosures, and BlueHammer, RedSun, and UnDefend have since come under active exploitation in the wild, while GitHub removed the researcher's account last week and a replacement GitLab account was also blocked.
What you should know: Three of the six publicly dropped flaws are already being exploited in the wild, and the researcher has said they intend to release something on July 14, 2026 - so the dispute between Microsoft and one researcher now sits directly in front of your patching timeline.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-33825CVE-2026-41091CVE-2026-45498CVE-2026-45585
- Related