Security researcher Nightmare Eclipse has dropped a fresh zero-day exploit leading to privilege escalation on Windows.
Recent Developments in Cybersecurity
Known in the cybersecurity community as Chaotic Eclipse, this researcher has gained notoriety for releasing multiple zero-day exploits aimed at Microsoft products, often timed with the Patch Tuesday security updates. The latest addition to this portfolio is a proof-of-concept (PoC) exploit named ShieldBreak, which surfaced on the August 2026 Patch Tuesday.
ShieldBreak specifically targets a vulnerability within Microsoft Defender, enabling any user to escalate their privileges to System level. This exploit is particularly concerning as it is a RoguePlanet patch bypass, functioning on the most recent versions of Windows 11 and Windows Server 2025, with indications that it may also affect Windows 10 systems.
Designated as CVE-2026-50656, the RoguePlanet flaw is categorized as a race condition vulnerability in Defender. Nightmare Eclipse initially disclosed this zero-day on June 9, with Microsoft acknowledging the issue shortly thereafter on June 16 and rolling out fixes by July 9.
According to an analysis by Will Dormann from Tharros Labs, the mechanics of ShieldBreak involve a series of intricate steps. The process begins with the establishment of a temporary directory registered as a Cloud Sync provider, followed by the placement of an EICAR file. The exploit then manipulates Defender’s scan path to System32, utilizing Windows’ CLFS to swap identity files and hydration data to a ‘phoneinfo.dll’ file located in System32. This sequence culminates in the execution of the QueueReporting scheduled task.
“In the wer.dll code, there is explicit code to load phoneinfo.dll [which does not exist by default in Windows]. Because at this point, phoneinfo.dll exists and is our own code, this runs, spawning conhost.exe with SYSTEM privileges,” Dormann explains.
However, both Dormann and cybersecurity expert Kevin Beaumont, who has also published detection queries for the new PoC, contest Nightmare Eclipse’s claim that ShieldBreak operates as a RoguePlanet bypass, noting the distinct methodologies involved.
“RoguePlanet was a filesystem race condition vulnerability that utilized virtual disks and NT native file manipulation to deceive the quarantine process into overwriting system files. In contrast, ShieldBreak employs a user-mode callback hook to alter file contents during a Defender cloud-hydration scan via cfapi (Cloud Filter API),” Beaumont elaborates.
Dormann further emphasizes that “ShieldBreak seems to require Defender to be active to work,” a notable difference from the RoguePlanet exploit.
Related:
- SharePoint Vulnerability Exploited Shortly After PoC Release
- Chipmaker Patch Tuesday: Intel, AMD Fix Over 80 Vulnerabilities Combined
- Fresh Windows Zero-Day Exploited in North Korean Cyberattacks
- Ivanti EPM Update Patches Remotely Exploitable Flaws
