Microsoft Defender Zero-Day Disclosed by Disgruntled Researcher Hours After Patch Tuesday

Nightmare Eclipse, a prolific and reportedly disgruntled ex-Microsoft employee, released proof-of-concept exploit code for 'RoguePlanet,' a race-condition flaw in Microsoft Defender that enables local privilege escalation to SYSTEM on fully patched Windows 10 and 11 systems — the seventh zero-day the researcher has publicly disclosed in a matter of months. Microsoft's June Patch Tuesday, described as record-breaking with roughly 200 CVEs, addressed two of the researcher's prior disclosures: GreenPlasma (CVE-2026-45586) and MiniPlasma (CVE-2020-17103), the latter being a regression of a six-year-old vulnerability. Three earlier disclosures — RedSun, UnDefend, and BlueHammer — were exploited in the wild before patches arrived, while YellowKey (CVE-2026-45585), a BitLocker bypass, received only manual mitigation guidance with the underlying flaw unresolved. The researcher also released a separate BitLocker bypass called GreatXML, though security researcher Will Dormann questioned its reliability, noting the prerequisites were more restrictive than described. Microsoft initially responded to the researcher's disclosures in a manner widely interpreted as threatening legal action, but later reversed course, stating it had 'no intention to pursue action against individuals conducting or publishing security research.' In parallel, Google patched CVE-2026-11645, an actively exploited out-of-bounds memory flaw in Chrome's V8 engine, as part of a 74-vulnerability update, and AMD faced criticism for denying researcher Paul LaRosa a $10,000 bounty for a remote code execution flaw in its auto-updater, retroactively changing its bounty program rules after he published his findings.