Nightmare EclipseがMicrosoft Defenderの更新を妨害する新PoC「BigDiskBuster」を公開。プラットフォームとセキュリティインテリジェンス更新を停止させると主張しています。MicrosoftのCVE・修正は未公表。過去のUnDefend、ShieldBreak、ShieldCrashとの時系列と企業の確認事項を整理

Security researcher Abdelhamid Naceri, also known as Nightmare Eclipse, released BigDiskBuster, a Microsoft Defender zero-day that can block antivirus signature and platform updates on supported Windows versions. The disclosure is part of Naceri’s ongoing series of Windows and Defender exploits, following earlier tools like UnDefend and ShieldCrash, with several flaws still unpatched by Microsoft. #BigDiskBuster #UnDefend #ShieldCrash #NightmareEclipse #MicrosoftDefender

Três vulnerabilidades no Windows estão sendo exploradas ativamente por agentes de ameaça para elevar privilégios em sistemas comprometidos — e duas delas ainda não têm correção da Microsoft. As falhas foram divulgadas publicamente por um pesquisador identificado como "Nightmare-Eclipse", em protesto à forma como o MSRC conduziu o processo de disclosure. BlueHammer e RedSun são falhas de LPE no Microsoft Defender, enquanto UnDefend permite bloquear atualizações de definições do antivírus sem permissões administrativas. A Huntress Labs confirmou o uso ativo das três técnicas. BlueHammer está sendo explorada desde 10 de abril e ganhou patch no Patch Tuesday deste mês (CVE-2026-33825). RedSun e UnDefend foram encontradas em um dispositivo invadido via SSLVPN comprometido, com evidências de operador humano ativo no sistema. O RedSun abusa de um comportamento do próprio Defender para sobrescrever arquivos de sistema e obter privilégios de administrador.

Handyvertrag bombastisch gut, Realität mies: Wer so eine Erfahrung macht, kann nun Tests für einen rechtssicheren Minderungsanspruch starten.

Bezpečnostní expert s přezdívkou Nightmare-Eclipse zveřejnil tři zranitelnosti v programu Microsoft Defender, který je výchozím antivirem ve Windows. Dvě zranitelnosti BlueHammer a RedSun způsobí lokální eskalaci práv a třetí UnDefend zabrání aktualizacím Defenderu. BlueHammer má označení CVE-2026–33825 a byl již opraven v dubnových záplatách pro  Windows. Zranitelnosti RedSun a UnDefend zatím nejsou opraveny a bylo pozorováno jejich použití v reálných útocích. V případě zranitelnosti RedSun se zneužívá zvláštní vlastnosti Defenderu: pokud najde škodlivý soubor, který má nastavený příznak cloud, tak jej z nepochopitelného důvodu přepíše na původní místo. RedSun toho zneužívá, aby přepsal systémový soubor a získal zvýšená práva. (zdroj: bleepingcomputer, upozornil Marián Miško, děkujeme)

Microsoft hat Notfall-Patches für zwei aktiv ausgenutzte Zero-Day-Schwachstellen in Defender, „RedSun“ und „UnDefend“, veröffentlicht, nachdem Huntress deren Einsatz in realen Angriffen bestätigt hatte.

Huntress is warning that threat actors are exploiting three recently disclosed security flaws in Microsoft Defender to gain elevated privileges in compromised systems. The activity involves the exploitation of three vulnerabilities that are codenamed BlueHammer (requires GitHub sign-in), RedSun, and UnDefend, all of which were released as zero-days by a researcher known as Chaotic Eclipse (

Drei kritische Zero-Day-Lücken in Defender, ein Patch-Tuesday mit 165 Schwachstellen und eine ungewollte Server-Upgrade-Welle stellen IT-Abteilungen vor enorme Herausforderungen. Besonders brisant: Zwei der Defender-Lücken sind noch immer nicht geschlossen.Kritische Zero-Day-Lücken in DefenderDie Lage spitzte sich Mitte April zu, als Sicherheitsforscher drei Zero-Day-Schwachstellen in Microsoft Defender identifizierten. Die Lücken mit den Codenamen BlueHammer, RedSun und UnDefend […] The post Microsoft: Ungepatchte Defender-Lücken und Server-Chaos belasten IT-Sicherheit appeared first on BornCity.

Now that Canadians have been given a one-month reprieve from President Trump’s threatened arbitrary 25-per-cent tariffs, it’s safe to assume media and politicians north of the world’s longest undefend...

AI has collapsed the gap between disclosure and exploitation, making traditional vulnerability management too slow for the pace of new CVEs and weaponized attacks. The article argues for proving exploitability through TTP-chaining and breach-and-attack simulation, using Nightmare-Eclipse as a worked example of how defenders can validate risk without firing real exploits. #NightmareEclipse #BlueHammer #RedSun #UnDefend #PicusPlatform

Microsoft’s dispute with security researcher Nightmare Eclipse over the public disclosure of zero-day vulnerabilities has reignited debate about coordinated vulnerability disclosure and the trust gap between vendors and researchers. The controversy also highlights how delayed patching, public threats, and escalating tensions can increase risk for customers and weaken the security community’s willingness to report flaws. #Microsoft #NightmareEclipse #RedSun #UnDefend #BlueHammer #YellowKey #GreenPlasma #MiniPlasma #VSCode