zero-day vulnerabilities Archives

Tech Optimizer

June 5, 2026

Microsoft quietly deletes Windows 11 guide that claimed you don’t need third-party antivirus

In April 2026, a blog post from Microsoft's Windows Learning Center claimed that most Windows 11 users could rely solely on Windows Security (Defender) for antivirus protection, citing features like Microsoft Defender Antivirus, SmartScreen, and ransomware mitigation. The blog was later removed without explanation, leading to speculation about its definitive claims. Microsoft stated that Windows Defender was sufficient for typical users with default settings and regular updates, while cautioning against using multiple antivirus engines. Independent testing from AV-Test consistently ranks Microsoft Defender highly, but AV-Comparatives noted limitations in offline protection and the reliance on cloud-based intelligence. The blog's removal was viewed by some as a constructive step towards realistic security guidance. Microsoft continues to provide third-party antivirus vendors with significant access to Windows, and the rise of AI-generated threats is complicating the cybersecurity landscape. Despite the controversies, Microsoft has made significant advancements in Windows Security, making it a viable option for many users.

Winsage

May 29, 2026

Microsoft 0-day feud escalates as researcher threatens another Windows exploit dump

The conflict between Microsoft and security researcher Nightmare Eclipse has intensified, with Nightmare threatening to release vulnerabilities on July 14. Nightmare has disclosed six zero-day vulnerabilities affecting Windows, including BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, and MiniPlasma. Microsoft responded by stating that these vulnerabilities were not reported through official channels before their disclosure. Following the release of exploit code for three vulnerabilities, attackers began exploiting them, raising concerns about YellowKey (CVE-2026-45585), which remains unfixed. Nightmare accused Microsoft of silencing them by deleting their MSRC account, leading to frustration over their treatment. The cybersecurity community has noted the significant damage caused by Nightmare, with comparisons to advanced persistent threat groups. Experts criticized Microsoft's handling of the situation, emphasizing the need for better communication and collaboration with researchers. They pointed out that the responsibility for vulnerabilities lies with Microsoft as the code's creator and highlighted the challenges in vulnerability disclosure practices within the industry.

Winsage

May 28, 2026

Microsoft’s GitHub bans security researcher who posted zero-day Windows exploits because company ‘ruined their life’ — expert claims action is vindictive and promises further retaliation

Researcher Nightmare-Eclipse, also known as Chaotic Eclipse, has had their GitHub account banned by Microsoft, leading them to move their operations to GitLab. Microsoft also deleted Eclipse's Microsoft account used for reporting vulnerabilities. Eclipse claims that they have not received any financial rewards from Microsoft's bug bounty program, despite having reported multiple zero-day vulnerabilities. They possess a portfolio of six zero-day exploits and have hinted at revealing more on July 14. Eclipse has criticized Microsoft for their handling of vulnerability reports and suggested that the company's recent requirement for video evidence of exploits has contributed to tensions. Microsoft has not commented on the specifics of the situation. Eclipse's zero-day exploits include BlueHammer, RedSun, UnDefend, GreenPlasma, MiniPlasma, and YellowKey, with BlueHammer, RedSun, and UnDefend confirmed as actively exploited in the wild.

Winsage

May 25, 2026

Windows zero-days expose gaps in built-in security protections

Two Windows zero-day vulnerabilities, YellowKey and GreenPlasma, have been identified. YellowKey targets the Windows Recovery Environment (WinRE) on Windows 11 and Windows Server 2025, allowing attackers with physical access to bypass BitLocker protections using a USB device. GreenPlasma affects Windows 10, Windows 11, and Windows Server environments with active Collaborative Translation Framework Monitor (CTFMON) sessions, enabling local privilege escalation from a standard user account to SYSTEM-level privileges. Both vulnerabilities require either physical or local access to exploit. Microsoft has not yet released patches for these vulnerabilities, prompting organizations to enhance their security measures and operational resilience. Recommendations include reassessing physical security, limiting local administrative access, and implementing multifactor authentication and robust credential management practices.

Tech Optimizer

May 22, 2026

Microsoft confirms two major Defender security issues — so update now or face possible attack

Microsoft has addressed two critical zero-day vulnerabilities in its Defender antivirus software: CVE-2026-41091 (privilege escalation) and CVE-2026-45498 (denial of service). The patches were delivered through Malware Protection Engine version 1.1.26040.8 and Antimalware Platform version 4.18.26040.7. Users are advised to verify their software versions to ensure they have the latest updates. Both vulnerabilities have been included in the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, requiring federal agencies to patch them or stop using the affected software by June 3.

Winsage

May 21, 2026

Microsoft Defender Zero-Day Vulnerabilities RedSun and UnDefend Actively Exploited on Windows 10, 11, and Server (April 2026 CVE Analysis)

In April 2026, two zero-day vulnerabilities, RedSun and UnDefend, were discovered in Microsoft Defender, affecting Windows 10, Windows 11, and Windows Server platforms. These vulnerabilities allow attackers to escalate privileges to SYSTEM and bypass Defender’s protections. RedSun exploits a flaw in Defender's remediation process, enabling low-privileged users to overwrite critical system files. UnDefend allows attackers to disrupt Defender’s updates, keeping it outdated and ineffective. Both vulnerabilities are actively being exploited, with attackers leveraging them to gain persistent access and deploy ransomware. The primary targets are organizations using Windows systems with Defender enabled, particularly in sectors like finance, healthcare, and government. Mitigation strategies include applying updates for related vulnerabilities, monitoring for suspicious activities, and implementing additional security measures.

Winsage

May 20, 2026

Microsoft shares mitigation for YellowKey Windows zero-day

Microsoft has addressed the YellowKey vulnerability, a zero-day flaw in Windows BitLocker identified as CVE-2026-45585. This vulnerability allows unauthorized access to BitLocker-protected drives through a specific exploitation process involving 'FsTx' files. The flaw was disclosed by an anonymous researcher known as 'Nightmare Eclipse.' Microsoft has released mitigation strategies, including removing the autofstx.exe entry from the Session Manager's BootExecute REGMULTISZ value and reestablishing BitLocker trust for WinRE. Additionally, users are advised to change BitLocker settings from "TPM-only" to "TPM+PIN" mode, requiring a pre-boot PIN for drive decryption, and to enable "Require additional authentication at startup" for unencrypted devices.

Winsage

May 19, 2026

Windows Still Vulnerable Despite Microsoft Patch

A vulnerability known as "MiniPlasma," identified as CVE-2020-17103 by Google Project Zero, allows attackers to gain system privileges by exploiting a flaw in the cloud filter driver cldflt.sys. Despite Microsoft's announcement of a fix, independent tests, including simulations on fully patched systems, have confirmed that the exploit remains effective. Security researcher "Chaotic Eclipse" has reported that the vulnerability still operates, while another researcher, Nightmare Eclipse, aims to highlight flaws in Microsoft's security policies. There are indications that a newer insider version of Windows 11 may have resolved the issue, and Microsoft is investigating the matter.

Winsage

May 17, 2026

New Windows ‘MiniPlasma’ zero-day exploit gives SYSTEM access, PoC released

A cybersecurity researcher, known as Chaotic Eclipse, has released a proof-of-concept exploit for a Windows privilege escalation zero-day vulnerability called "MiniPlasma," which allows attackers to gain SYSTEM privileges on fully patched Windows systems. The vulnerability affects the cldflt.sys Cloud Filter driver and was reported by Google Project Zero in September 2020, assigned the identifier CVE-2020-17103, and claimed to be resolved by Microsoft in December 2020. However, Chaotic Eclipse asserts that the vulnerability remains unpatched. Testing confirmed that the exploit works on Windows 11 Pro, enabling command prompt access with SYSTEM privileges from a standard user account. Will Dormann, a vulnerability analyst, verified the exploit's effectiveness but noted it did not work in the latest Windows 11 Insider Preview Canary build. The exploit leverages the undocumented CfAbortHydration API to manage registry key creation improperly. Chaotic Eclipse has previously disclosed other Windows zero-day vulnerabilities and claims their actions are a protest against Microsoft's handling of vulnerabilities.

Winsage

May 16, 2026

Windows 11 and Microsoft Edge Hacked at Pwn2Own Berlin 2026

On May 14, Pwn2Own Berlin 2026 began, where researchers earned ,000 for 24 unique zero-day vulnerabilities. Cheng-Da Tsai, also known as Orange Tsai, achieved a significant Edge sandbox escape, earning ,000, and later exploited Microsoft Exchange for remote code execution, earning an additional ,000. Tsai accumulated 17.5 Master of Pwn points, contributing to DEVCORE's lead with ,000 in total earnings. Other researchers, including Angelboy and TwinkleStar03, earned ,000 for an Improper Access Control vulnerability, while Marcin Wiązowski and Kentaro Kawane also contributed successful exploits. By the end of Day One, DEVCORE led with ,000, and the event featured a prize pool exceeding ,000,000 across 31 targets. As of Day Two, a total of ,750 had been awarded for 39 unique vulnerabilities, with DEVCORE leading at 40.5 points and ,000 in earnings.