Less than an hour after Microsoft's July Patch Tuesday, the researcher known as Nightmare Eclipse published a proof-of-concept for LegacyHive, a Windows privilege-escalation flaw that works on fully updated systems. It abuses the Windows User Profile Service to let a standard user load another user's registry hive, including an administrator's, into their own profile, a useful stepping stone for an attacker who already has a foothold. There is no CVE, advisory, or patch. The public proof-of-concept was deliberately stripped down, needing extra credentials, but the researcher says the original had no such limits. Given this researcher's flaws have been weaponized quickly before, defenders should not wait for a fix.
Microsoft has come out strongly against uncoordinated zero-day disclosures after researcher Chaotic Eclipse (also Nightmare-Eclipse) dropped technical details of six Windows zero-days over the past month, citing a breakdown in Microsoft's disclosure process. The CVEs include BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), YellowKey (CVE-2026-45585), GreenPlasma, and MiniPlasma; BlueHammer, RedSun, and UnDefend are now under active exploitation. GitHub removed the researcher's account; a GitLab re-upload account was also blocked. Microsoft is urging coordinated vulnerability disclosure but the researcher publicly disputes Microsoft's responsiveness, citing months of waiting for fixes. The incident highlights ongoing friction between solo researchers and large vendor PSIRTs.
TrustStrike Labs