Researcher Archives

Winsage

July 16, 2026

Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day

A security researcher known as Nightmare Eclipse has revealed a new unpatched vulnerability in Windows, named LegacyHive, which is a local privilege escalation flaw in the Windows User Profile Service. This vulnerability allows attackers to access and load user hives of other accounts, including administrators. Nightmare Eclipse has provided proof-of-concept exploit code that works on systems with Microsoft's July 2026 patches. The exploit initially did not require user credentials but now necessitates them for accessing other hives. Nightmare Eclipse has previously disclosed over half a dozen zero-day vulnerabilities affecting Microsoft products. Microsoft has not yet acknowledged the LegacyHive exploit.

Winsage

July 15, 2026

Windows 0-day drops the same day Microsoft releases record number of patches

Will Dormann, a senior principal vulnerability analyst at Tharros Labs, discussed a vulnerability that allows attackers to gain administrator privileges by configuring a system to execute their code upon an admin user's login. This vulnerability enables non-admin users to modify the classes registry hive of an admin user, posing a significant risk. It could be exploited without user interaction and may be combined with another vulnerability that provides direct access to an administrative account. Microsoft is aware of the issue and is investigating it, encouraging coordinated disclosure from vulnerability reporters. Independent researcher Kevin Beaumont has created a detection script to help protect against this vulnerability, along with recommendations to restrict local non-user accounts, monitor the ProfSvc for unexpected hive loads, and track activity related to NTUSER.DAT and UsrClass.dat files.

Winsage

July 15, 2026

Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday

Security researcher Chaotic Eclipse has released a proof-of-concept exploit called LegacyHive, which targets a vulnerability in the Windows User Profile Service. The exploit requires standard user credentials and a third username, potentially an administrator account. It can mount the target user hive in the current user classes root and is designed to reduce the risk of public exploitation. The exploit works across all supported desktop and server versions of Windows, including those updated with the July 2026 Patch Tuesday release. Microsoft is investigating the findings related to LegacyHive. Microsoft has patched 622 vulnerabilities, including two privilege escalation flaws in SharePoint Server (CVE-2026-56164, CVSS score: 5.3) and Active Directory Federation Services (CVE-2026-56155, CVSS score: 7.8), which are actively exploited threats. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included these vulnerabilities in its Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to implement fixes by specified deadlines. CISA has also noted active exploitation of several SharePoint Server vulnerabilities, including CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, which allow unauthorized access to vulnerable instances. CVE-2026-56164 enables attackers to send crafted network requests to access functions that should require authorization, leading to privilege escalation without prior authentication. Additionally, CVE-2026-55040 (CVSS score: 9.1) allows remote unauthenticated attackers to bypass authentication on a vulnerable SharePoint server, enabling unauthorized operations.

Winsage

July 14, 2026

Microsoft Just Patched a Record 570 Flaws in Windows

Microsoft's July Patch Tuesday update addresses 570 vulnerabilities, including three critical zero-days. The vulnerabilities include 254 elevation-of-privilege flaws, 17 security feature bypasses, 145 remote-code-execution issues, 102 information disclosures, 16 spoofing vulnerabilities, and 35 denial-of-service vulnerabilities. Among these, 59 bugs are classified as "critical." The three zero-days patched are CVE-2026-56155 (elevation of privilege in Active Directory Federation Services), CVE-2026-56164 (elevation of privilege in Microsoft SharePoint Server), and CVE-2026-50661 (security bypass in Windows BitLocker). The update is recommended to be installed as soon as possible, and users can check for updates through the Windows Update settings.

Winsage

July 12, 2026

Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in FBI Case Filing

Microsoft has confirmed the existence of the Global Device Identifier (GDID), a unique identifier assigned to Windows installations, in a federal complaint against an alleged member of the Scattered Spider hacking group. The GDID is generated when a Windows system is set up with a Microsoft Account and remains active through various Windows updates. Disabling the GDID could disrupt Windows activation and access to Microsoft Store applications. The GDID is described as "a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device." It is created during the provisioning of Windows with a Microsoft Account and is stored in the Windows registry under HKCUSOFTWAREMicrosoftIdentityCRLExtendedProperties. The GDID remains persistent through Windows updates but is not retained after a clean reinstall. A single user can possess multiple GDIDs linked through their account, OneDrive, and activation history. The FBI used the GDID to track Peter Stokes, an alleged member of the Scattered Spider group, across various VPN connections and proxy servers. The GDID was recorded visiting specific websites and was linked to Stokes's accounts on platforms like Snapchat and Facebook. Concerns have been raised regarding user privacy, as the GDID is assigned without user consent and cannot be disabled without compromising essential Windows features. Microsoft has not committed to providing user-facing controls or comprehensive documentation for everyday users regarding the GDID. Legal requests can compel Microsoft to disclose GDID activity data to law enforcement. The GDID is linked to the Microsoft Account rather than the device itself, meaning reinstalling the operating system does not sever this connection.

Tech Optimizer

July 11, 2026

Microsoft closes RoguePlanet vulnerability in Defender: SYSTEM privileges via the antivirus engine

A vulnerability known as RoguePlanet was identified in Microsoft Defender, tracked as CVE-2026-50656. This flaw allows local privilege escalation to the NT AUTHORITYSYSTEM account, requiring an attacker to have local code execution capabilities. It can be exploited through methods such as opening malicious email attachments. The vulnerability is categorized under CWE-59: “Improper Link Resolution Before File Access” and involves a race condition that affects the Defender engine's operations. RoguePlanet was disclosed by security researcher Nightmare-Eclipse on June 10, 2026, and confirmed by various security firms. Microsoft released a fix in version 1.1.26060.3008 of the Microsoft Malware Protection Engine, which should be installed automatically in standard Windows configurations. Users can verify their engine version using PowerShell. The vulnerability affects both Windows 10 and Windows 11 systems with the June 2026 security updates, and disabling real-time protection does not reliably mitigate it.

Winsage

July 10, 2026

You can’t fully disable Microsoft’s GDID Windows 11 tracker, but these settings limit what it captures

A 19-year-old named Peter Stokes was detained at Helsinki airport in April 2026 while traveling to Japan, carrying two 2TB hard drives. He was subject to an Interpol Red Notice and faced a federal complaint from U.S. prosecutors by July for his alleged involvement in the Scattered Spider hacking group, which breached a U.S. luxury jewelry retailer in May 2025, leading to a ransom demand. The Global Device Identifier (GDID), developed by Microsoft, is a persistent identifier that uniquely identifies a Windows installation on a device. It links online activities back to a single identity, which law enforcement can use to trace a device's owner. The GDID is generated when a user signs into Windows with a Microsoft Account and remains through updates but does not survive a clean reinstall. Stokes' use of the same Windows device allowed investigators to trace his activities through the GDID, which linked him to the hacking incident. Privacy advocates have raised concerns about the lack of consent for GDID assignment and the potential for surveillance.

Winsage

July 10, 2026

Patch for Windows Defender 0-day could allow attackers to fill hard disk

A recent Microsoft patch addressing the RoguePlanet vulnerability (CVE-2026-50656) in its Defender security engine has raised concerns about disk space issues for Windows users. The vulnerability allows remote attackers to gain administrative control over Windows 10 and 11 systems. The patch, which updates the Microsoft Malware Protection Engine, is automatically installed without user action. However, it may enable attackers to fill a hard drive by writing excessive data due to changes in the mpengine.dll driver. These changes can cause a data leak of 8 bytes when opening a file and involve new functionalities in SpyNet, which could lead to mass file-writing behavior. Typically, Defender limits file sizes during scanning, but the spynet functions may maintain a local copy of the Zone.Identifier Alternate Data Stream file, potentially exhausting disk space.

Winsage

June 30, 2026

A critical Windows 11 and Windows 10 flaw turns Microsoft Defender into a hacker’s best friend

Chaotic Eclipse, also known as Nightmare-Eclipse, bypassed Windows 11's BitLocker security using a USB stick and claimed Microsoft left a backdoor in the system. Following this, Microsoft patched three zero-day exploits named YellowKey, GreenPlasma, and MiniPlasma. Nightmare-Eclipse then revealed another zero-day vulnerability called RoguePlanet, which affects Microsoft Defender on Windows 10 and 11, potentially allowing attackers full control over compromised systems. Microsoft is tracking this vulnerability as CVE-2026-50656 and is working on a security update. Nightmare-Eclipse provided a proof-of-concept exploit and described it as a race condition with variable success rates. Microsoft has promoted Windows Defender as adequate for most users but acknowledged that third-party tools can offer additional protection. The company initially threatened legal action against Nightmare-Eclipse but later decided not to pursue lawsuits against researchers sharing their findings.

Winsage

June 30, 2026

A critical exploit bypasses Microsoft Defender in Windows 11 and Windows 10 — so much for “everyday risk protection without additional software”

Security researcher Chaotic Eclipse, known as Nightmare-Eclipse, bypassed Windows 11's BitLocker security using a USB stick and claimed Microsoft intentionally included a backdoor in the feature. Microsoft responded by patching three zero-day exploits disclosed by Nightmare-Eclipse: YellowKey, GreenPlasma, and MiniPlasma, and is monitoring another exploit called RoguePlanet, cataloged as CVE-2026-50656. The RoguePlanet exploit is a race condition with varying success rates on different machines, achieving a 100% success rate on some devices. Microsoft acknowledged that while Windows 11's Defender is generally sufficient for most users, third-party tools can offer additional security features. Tensions between Nightmare-Eclipse and Microsoft have risen, with the company previously considering legal action but now indicating it will not pursue lawsuits against researchers sharing their findings.