Zero-Day

Overview Attribute CVE-2026-41091 CVE-2026-45498 Type Local Privilege Escalation Denial of Service Component Malware Protection Engine Antimalware Platform Affected Engine ≤ 1.1.26030.3008 Platform ≤ 4.18.26030.3011 CWE CWE-59 (Link Following) — Impact Standard user → SYSTEM Defender disabled / system unresponsive Exploit ✅ Active in the wild ✅ Active in the wild Patch Engine 1.1.26040.8 Platform 4.18.26040.7 CISA KEV ✅ Added 2026-05-20 ✅ Added 2026-05-20 FCEB Deadline June 3, 2026 June 3, 2026 Microsoft has started rolling out patches for two actively exploited zero-day vulnerabilities in Microsoft Defender. Both were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on May 20, with federal agencies ordered to patch within two weeks. ...

TL;DR MiniPlasma is a Windows local privilege escalation exploit that achieves standard user → SYSTEM on fully patched Windows 11 systems (including the May 2026 Patch Tuesday updates). The jaw-dropper? It targets the exact same vulnerability that Google Project Zero reported in September 2020 and Microsoft claimed to fix in December 2020. CVE: CVE-2020-17103 (CVSS 7.0) — supposedly patched Component: cldflt.sys — Windows Cloud Files Minifilter driver Flaw: TOCTOU race condition in HsmOsBlockPlaceholderAccess Impact: Full SYSTEM shell from standard user Affected: All Windows versions (confirmed on Win11 with May 2026 updates) Not affected: Latest Windows 11 Insider Preview Canary builds (suggests a fix may be incoming) Researcher: Chaotic Eclipse / Nightmare-Eclipse Public PoC: github.com/Nightmare-Eclipse/MiniPlasma The Ghost Patch Problem In cybersecurity, few things are more unsettling than a patch that never actually landed. That’s exactly what happened here. ...

TL;DR GreenPlasma (SB2026051378) is an unpatched Windows privilege escalation that chains a ctfmon.exe section creation bug with registry symlink hijacking and DACL relaxation to go from standard user → SYSTEM with zero interaction. No CVE assigned yet. No patch available. Affected: Windows 11, Windows Server 2022/2026 Not affected: Windows 10 (different ctfmon implementation) Requires: Standard user, interactive session Impact: Full SYSTEM shell Researcher: Chaotic Eclipse / Nightmare-Eclipse Public PoC: github.com/Nightmare-Eclipse/GreenPlasma The Context: Chaotic Eclipse’s Disclosure Campaign This is the fifth zero-day from the researcher Chaotic Eclipse (aka Nightmare-Eclipse), who has been publicly releasing Windows vulnerabilities after disputes with Microsoft’s MSRC over bug bounty responses. ...

Overview Attribute Value CVE ID CVE-2026-43121 Related CVE-2026-23263 (page array leak, same subsystem) CVSS Score ~7.8 (est., NVD enrichment pending) Vendor Linux Kernel Component io_uring/ZCRX (zero-copy receive) Vulnerability Type Missing bounds check → OOB heap write; Race condition → double-free Affected Linux kernel 6.12–6.19 (CONFIG_IO_URING_ZCRX=y) Patched ✅ Commit 770594e (bounds check) + 003049b1c4fb (atomic race fix), backported to v6.18.16 Exploit Status ⚠️ PoC demonstrated (kernel module + userspace harness) KEV Added Not yet What Is ZCRX? io_uring’s ZCRX (zero-copy receive) is a subsystem new to Linux 6.15 that lets userspace receive network packets directly into a registered memory region — no kernel copy needed. The NIC DMAs into the region, the kernel posts a completion event, and the user returns the slot when done via a refill queue. ...

Windows Defender Is the Target Now This week’s headline isn’t about some exotic exploit kit. It’s about the security tool itself getting owned. Three zero-days targeting Microsoft Defender — BlueHammer, RedSun, and UnDefend — have shifted from proof-of-concept to active in-the-wild exploitation. All three come from the same researcher (Nightmare-Eclipse / Chaotic Eclipse), who released exploit code publicly in protest over Microsoft’s handling of the disclosure process. Huntress Labs has confirmed hands-on-keyboard attackers combining these with compromised SSL VPN credentials for real intrusions. ...

Overview Same researcher, same target, new weapon. Nightmare-Eclipse — the security researcher behind the BlueHammer Windows Defender LPE zero-day — has released UnDefend, a tool that can completely disable Windows Defender from a standard user account with no administrative privileges. Where BlueHammer escalates privileges through Defender, UnDefend simply kills Defender’s ability to protect you — and does it without needing admin rights at all. Attribute Value Tool UnDefend Author Nightmare-Eclipse (Chaotic Eclipse) Repository github.com/Nightmare-Eclipse/UnDefend Language C++ License MIT Stars 32 (as of Apr 13, 2026) Requires Admin ❌ No CVE Pending / Not assigned Patch ❌ None Related BlueHammer (LPE zero-day, same researcher) How It Works UnDefend operates in two modes: ...

Overview Attribute Value CVE ID CVE-2026-33825 CVSS Score 7.8 Vendor Microsoft Product Windows Defender Antivirus (Windows 10/11, Server 2016+) Vulnerability Type TOCTOU + Path Confusion → Local Privilege Escalation Status ✅ Patched (April 14, 2026 Patch Tuesday) CWE CWE-367 (Time-of-check Time-of-use Race Condition) KEV Added Not yet Exploitation Status ⚠️ PoC public, no confirmed in-the-wild attacks yet Patch Status ❌ Unpatched (as of April 12, 2026) Affected Versions Version Status Windows 10 (1709+) ❌ Vulnerable Windows 11 ❌ Vulnerable Windows Server 2016+ ⚠️ Partial (elevated admin, not full SYSTEM) Windows 10 (pre-1709) ✅ Not affected (no Cloud Files API) Description BlueHammer is a local privilege escalation vulnerability in Microsoft Defender Antivirus that chains a TOCTOU race condition with path confusion in Defender’s signature update workflow. A standard user can exploit Defender’s own privileged update mechanism to leak the SAM hive, decrypt credentials, and achieve SYSTEM privileges. ...

It’s been nine days since Chaotic Eclipse published the BlueHammer exploit on GitHub. Here’s what’s changed — and what hasn’t. Current Status: Still Zero-Day Attribute Status CVE Assigned ❌ No Microsoft Patch ❌ None Official Mitigation ❌ None PoC Available ✅ Original + Reimplementation Actively Exploited ⚠️ No confirmed in-the-wild attacks (yet) Detection Coverage 8/72 vendors on VirusTotal Microsoft’s last public statement (April 7) reaffirmed commitment to coordinated disclosure without addressing the MSRC communication breakdown or providing a timeline. ...

Since my initial coverage of BlueHammer, the security community has produced excellent technical analysis. This post consolidates the deep-dive details you need to understand how this exploit actually works — and why it’s more sophisticated than most LPEs. The Big Picture BlueHammer isn’t your typical privilege escalation. It doesn’t exploit a single bug — it chains seven distinct stages, weaponizing Windows Defender’s own trusted update mechanism against the system. Key insight: The exploit abuses Defender’s signature update workflow to leak the SAM hive, decrypt credentials, and achieve SYSTEM — all from a standard user context. ...

Another day, another zero-day — but this one comes with a twist. A frustrated security researcher has gone full rogue and dropped working exploit code for an unpatched Windows local privilege escalation (LPE) vulnerability on GitHub. There is no patch. There are no workarounds. And the code works. Here’s the full breakdown. The Vulnerability: BlueHammer Researcher Alias: Chaotic Eclipse / Nightmare-Eclipse Disclosure Date: April 3, 2026 (exploit code published) Type: Local Privilege Escalation (LPE) ...