GitHub Archives

Winsage

June 11, 2026

Nightmare Eclipse drops claimed BitLocker bypass for Microsoft Windows

Nightmare Eclipse has released a new zero-day vulnerability exploit called GreatXML, which allows unrestricted access to BitLocker volumes on Windows systems that have previously run a Microsoft Defender Offline scan. This discovery was made in four hours and adds to Nightmare Eclipse's total of eight zero-day vulnerabilities. Microsoft is investigating the claims related to another exploit, RoguePlanet, but has not commented on GreatXML or provided a patch timeline. Nightmare Eclipse, rumored to be a former Microsoft employee, has faced backlash from the security community for previous disclosures and has vowed to continue releasing vulnerabilities. Security expert Will Dormann has raised concerns about the practicality of the GreatXML exploit, noting that it requires administrative access and questioning the accuracy of the instructions provided by Nightmare.

Winsage

June 11, 2026

New Windows Zero-Day Exploit ‘RoguePlanet’ Released

A new zero-day exploit named RoguePlanet has been discovered targeting Microsoft’s Windows operating system, disclosed by security researcher Nightmare Eclipse. The exploit allows local privilege escalation (LPE) by exploiting a race condition in Microsoft Defender and can facilitate remote code execution (RCE) through deceptive .vhd(x) files. RoguePlanet may also bypass BitLocker encryption. The proof-of-concept has been tested on Windows 10 and Windows 11 systems but does not function on Windows Server, although the researcher believes all Windows Server versions are vulnerable. Following its release, RoguePlanet was confirmed by other researchers to spawn a command prompt with SYSTEM privileges on patched computers. This disclosure comes after Microsoft released patches for earlier exploits by Nightmare Eclipse, including GreenPlasma and YellowKey. The researcher has expressed dissatisfaction with Microsoft’s vulnerability disclosure process, alleging legal action against them and the suspension of their GitHub account, leading to the publication of RoguePlanet under a new account.

Winsage

June 11, 2026

Microsoft is killing the Copilot+ PC advantage, brings Windows 11’s local AI to RTX 30+ PCs with 6GB vRAM

Microsoft has made its local Language Model APIs for Windows 11 accessible on non-Copilot+ PCs, requiring an NVIDIA RTX 30 series GPU with at least 6GB of VRAM. Copilot+ PCs, which debuted on June 18, 2024, require 16GB of RAM, an SSD, and a minimum of 40 TOPS NPU. The new APIs allow broader access to AI functionalities, including AI-powered text formatting, summarization, text rewriting, text-to-table conversion, and general prompt generation, through a compact language model called "Phi Silica." Users with compatible NVIDIA GPUs can utilize these features locally, enhancing privacy compared to cloud-based models. However, some features remain exclusive to devices with NPU chips.

Winsage

June 10, 2026

Windows 11’s June update shuts down an intentional BitLocker backdoor with full file access

Microsoft addressed three zero-day vulnerabilities identified by security researcher Nightmare-Eclipse, named YellowKey, GreenPlasma, and MiniPlasma. The YellowKey vulnerability allows access to BitLocker-protected drives on Windows 11 using a USB key, leading to allegations that Microsoft may have left a backdoor in BitLocker. Microsoft implemented a mitigation strategy included in the June 2026 Patch Tuesday updates, which addressed over 200 security flaws. Tensions arose between Microsoft and Nightmare-Eclipse regarding vulnerability reporting protocols and researcher compensation, with Microsoft initially threatening legal action against the researcher. Following backlash, Microsoft retracted the threat but tensions persisted. Nightmare-Eclipse claimed retaliation from Microsoft, including the banning of their GitHub account and deletion of their Microsoft account, which Microsoft denied. The situation highlights the ongoing challenges in cybersecurity and the relationship between tech companies and security researchers.

Winsage

June 10, 2026

Intel XPU Manager 2.0 Overhauls Windows & Linux Management For Arc Pro GPUs

Intel has released XPU Manager 2.0, enhancing software for monitoring and managing data center GPUs on Windows and Linux. Key improvements include a streamlined codebase, enhanced support for network interface cards (NICs), a revamped dashboard for the xpu-smi command, and a complete rewrite of the XPU Manager daemon in Go. The software now supports the OpenTelemetry data format but has retired the REST API and does not include the XPU Manager C API in this release. Officially supported graphics cards are the Intel Arc Pro B50, B60, B65, and B70. Compatibility is provided for Ubuntu 24.04 LTS and 26.04 LTS, with limited support for Microsoft Windows Server 2022.

Winsage

June 10, 2026

Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows

An anonymous researcher known as Chaotic Eclipse has released a proof-of-concept exploit called RoguePlanet, targeting a zero-day vulnerability in Microsoft Defender. The exploit, which is a race condition, has a variable success rate, achieving 100% success on some machines while being less effective on others. When successful, it grants attackers SYSTEM-level privileges on Windows 10 and 11 systems with the June 2026 Patch Tuesday updates. The exploit does not work on Windows Server due to restrictions on mounting ISO images. Chaotic Eclipse has criticized Microsoft's defenses against path redirection attacks and claims to have found multiple vulnerabilities within Defender and other Microsoft software components. The researcher has expressed dissatisfaction with Microsoft's handling of vulnerability disclosures, particularly after losing access to the Microsoft Security Response Center account. Microsoft has condemned the public disclosure of vulnerabilities as unjustifiable, stating it puts customers at unnecessary risk, and has removed Chaotic Eclipse's GitHub and GitLab accounts. Microsoft clarified that it does not intend to pursue legal action against individuals conducting security research but will collaborate with law enforcement against malicious activities.

Winsage

June 10, 2026

Windows 11’s CPU performance boost released today, enable it using these steps

Microsoft's June 2026 Patch Tuesday update, KB5094126, introduced the Low Latency Profile feature in Windows 11, aimed at improving responsiveness of core shell experiences like the Start menu and Action Center. This feature optimizes CPU performance by allowing it to quickly reach maximum frequency for one to three seconds during user interactions, enhancing the speed of actions such as opening the Start menu. Users must install the update and may need to enable the feature manually using ViVeTool if it is not activated automatically. The Low Latency Profile is designed to work without significantly impacting battery life or thermal performance. Other enhancements in the update include Shared Audio for Bluetooth headphones, Multi-App Camera functionality, and improved Task Manager capabilities.

Winsage

June 9, 2026

Microsoft Makes Windows 11 an Agentic Platform

Microsoft announced a suite of agent-centric features for Windows 11 at the Build 2026 conference, introducing the Microsoft Agent Platform for local AI agents. This includes enhanced integration with Microsoft Foundry, GitHub, and the M365 suite. The developer documentation covers local agent runtimes and isolation patterns, highlighting the Microsoft Execution Containers SDK and Entra Agent ID. Enterprise controls like Intune and Agent 365 are also featured. The upcoming Copilot Actions will allow agents to interact with local files and applications, aimed at improving workflows. Microsoft is addressing security concerns with resources outlining strategies to mitigate risks such as cross-prompt injection. Industry commentary indicates a growing discussion about privacy and security in relation to these changes.

AppWizard

June 8, 2026

NFCShare Android malware spreads via fake banking app updates on GitHub

New variants of the NFCShare Android malware are disguised as fake updates for legitimate banking applications and are targeting customers of various banks in Europe through a phishing campaign to steal sensitive payment card data. The malware prompts victims to place their cards near the NFC chip of their mobile devices, using Android’s IsoDep interface to read card information, including card number, type, expiry date, and a 4-digit PIN. The stolen data is exfiltrated to the attacker’s command-and-control host via a WebSocket channel. Recent attacks began on May 14, with victims directed to a phishing site that impersonates a legitimate bank and then to a GitHub repository hosting a malicious APK file. The repository has hosted 56 unique APKs impersonating banking applications primarily from Italy and Spain. The malware has evolved from initially targeting Deutsche Bank in Germany to a broader range of banks. The latest version features malformed APK packaging to complicate automated analysis. Users are advised to download banking applications only from Google Play and to be cautious of verification requests that ask for NFC card scans.

AppWizard

June 8, 2026

‘This looks awesome’: there’s now an unofficial, open source app for reading Whoop data that doesn’t need a subscription

An independent developer has released an open-source application called Noop for Whoop bands, allowing users to access their Whoop data without a subscription fee. The app is available for free on Android and macOS and is compatible with Whoop 4.0, 5.0, and MG bands. Users need to sideload the app on Android devices, with installation instructions provided on GitHub. The app offers a cloud-free experience, appealing to those looking to avoid ongoing costs associated with Whoop subscriptions. Feedback on Reddit has been positive, although some users have requested help with installation. The developer has created algorithms to interpret raw data from Whoop devices, but it is uncertain how Whoop will respond to this app. Noop is part of a trend of alternative fitness applications, including Goose and Whoof.