Nightmare Eclipse, also known as Chaotic Eclipse, has released a proof-of-concept exploit called HardBreacher that targets a privilege escalation flaw in Kaspersky Endpoint Security. Kaspersky says the underlying issue has already been fixed through an automatic or manual database update. #NightmareEclipse #ChaoticEclipse #HardBreacher #KasperskyEndpointSecurity...

MiniPlasma raises fresh doubts about Microsoft's Windows 11 fix for CVE-2020-17103 after a new proof of concept claimed patched systems can reach SYSTEM.

Chaotic Eclipse (also known as Nightmare Eclipse) released RoguePlanet, a Windows local privilege escalation proof of concept that abuses a TOCTOU race in Windows Defender remediation to plant code as System32wermgr.exe and execute it as SYSTEM through Windows Error Reporting. The article also outlines related detections in Sysmon and Guardsix SIEM, including staging in , named pipe activity on RoguePlanet, and suspicious wermgr.exe-to-conhost.exe process chains. #RoguePlanet #ChaoticEclipse #NightmareEclipse #WindowsDefender #wermgr.exe #WindowsErrorReporting

In May 2026, Chaotic Eclipse disclosed three Windows zero-days—YellowKey, GreenPlasma, and MiniPlasma—with PoCs published days after Microsoft’s Patch Tuesday to delay a fix window. YellowKey bypasses BitLocker through WinRE, while GreenPlasma and MiniPlasma achieve SYSTEM privileges by abusing Windows Cloud Files and related trust relationships. #YellowKey #GreenPlasma #MiniPlasma #ChaoticEclipse

LevelBlue SpiderLabs tracked a series of public zero-day disclosures by the anonymous actor Chaotic Eclipse / Nightmare Eclipse, including YellowKey, GreenPlasma, and MiniPlasma, affecting Windows security, WinRE, BitLocker, and privilege escalation paths. Microsoft assigned CVE-2026-45585 to the YellowKey BitLocker bypass and released mitigation guidance, while the report details PoC mechanics, detection opportunities, and attacker artifacts tied to the disclosed techniques. #ChaoticEclipse #NightmareEclipse #YellowKey #GreenPlasma #MiniPlasma #CVE-2026-45585 #WinRE #BitLocker

A researcher known as Chaotic Eclipse has released the MiniPlasma proof-of-concept exploit, claiming it can still gain SYSTEM privileges on fully patched Windows 11 systems through the cldflt.sys Cloud Filter driver. The disclosure adds to a series of recent Windows zero-days from the same researcher, including BlueHammer, RedSun, YellowKey, and GreenPlasma. #MiniPlasma #ChaoticEclipse #cldfltsys #GoogleProjectZero #Microsoft

A researcher known as Chaotic Eclipse or Nightmare Eclipse has released proof-of-concept exploits for two unpatched Windows flaws, YellowKey and GreenPlasma, affecting BitLocker and privilege escalation. The leaks follow earlier disclosures of BlueHammer and RedSun, and the researcher says more Windows exploit releases may come before the next Patch Tuesday. #YellowKey #GreenPlasma #BlueHammer #RedSun #ChaoticEclipse #NightmareEclipse

Exploit code was released for an unpatched Windows local privilege escalation flaw dubbed BlueHammer that can grant SYSTEM or elevated administrator permissions. The proof-of-concept was published by a researcher using the aliases Chaotic Eclipse and Nightmare-Eclipse after a disclosure dispute with Microsoft, and researchers confirm it can access the SAM database and enable full system compromise despite bugs and no official patch. #BlueHammer #ChaoticEclipse

Tom's Hardware article on the matter. And here is the hacker's blog. This person has a vendetta against Microsoft? And has been dropping some serious zero days. This post is of interest for the short contents and the top reply two months later, when the YellowKey bypass drop: > > I never wanted to reopen a blog and a new github account to drop code... >> >> But someone violated our agreement and left me homeless with nothing. They knew this will happen and they still stabbed me in the back anyways, this is their decision not mine. > You’re a smart guy. Maybe a savant. Just wondering if you’re BiPolar (like me) and see a different reality than what is real. Been there. > > If you take this comment the wrong way, don’t hack me. It would be way too easy for you anyway, not worth your time. > > Just want to let you know that I hope life works out for you. > > The NSA is probably interested and reach out to you. I would recommend that you get treated for BiPolar and be normal again so that you can work for them. > > Such a brilliant mind shouldn’t go to waste. > > I’m a computer guy. Can’t work anymore after my brain got fried from working in a very stressful situation. > > The bitlocker hack had an easier route. The hash key is stored in a disk location. That is how you even boot into a working environment. Very strange comment! * * * Anyways, so far they have dropped: * BlueHammer, a LPE * UnDefend, which disables Microsoft Defender * RedSun, another LPE * GreenPlasma, * YellowKey, the cool new one which allows an attacker with physical access to completely bypass disk encryption. The developer says this looks like a backdoor. Anyways, this is a big one, what the hell