commentary

An anonymous researcher known as Chaotic Eclipse has released a proof-of-concept exploit called RoguePlanet, targeting a zero-day vulnerability in Microsoft Defender. The exploit, which is a race condition, has a variable success rate, achieving 100% success on some machines while being less effective on others. When successful, it grants attackers SYSTEM-level privileges on Windows 10 and 11 systems with the June 2026 Patch Tuesday updates. The exploit does not work on Windows Server due to restrictions on mounting ISO images. Chaotic Eclipse has criticized Microsoft's defenses against path redirection attacks and claims to have found multiple vulnerabilities within Defender and other Microsoft software components. The researcher has expressed dissatisfaction with Microsoft's handling of vulnerability disclosures, particularly after losing access to the Microsoft Security Response Center account. Microsoft has condemned the public disclosure of vulnerabilities as unjustifiable, stating it puts customers at unnecessary risk, and has removed Chaotic Eclipse's GitHub and GitLab accounts. Microsoft clarified that it does not intend to pursue legal action against individuals conducting security research but will collaborate with law enforcement against malicious activities.