InfoSecBulletin Cybersecurity for mankind
An unnamed security expert known as “Nightmare Eclipse” shared a CrowdStrike Falcon zero-day exploit called “FalconFlank.” This tool allows hackers to gain higher access on current Windows systems.
Nightmare Eclipse reports that the new weakness, still without a CVE ID, impacts devices using the latest Windows 11 and Windows Server versions, along with CrowdStrike’s security platform.
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
Multiple European supermarket fridges got hacked: Temperatures reached high as 55°C
Apple Warns 99 Countries iPhone Users of Mercenary Spyware Attacks
Daily Cyber security update for 31.10. 2026
Successful exploitation allows attackers to spawn a command prompt with SYSTEM privileges by abusing CrowdStrike Falcon’s Office malicious macros remediation feature.
“FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in Crowdstrike Falcon Sensor, obviously by the time I drop this Crowdstrike would already have detections for it so if you want to test you either have to add it to the exclusions or obfuscate the PoC and change the dll load technique,”
Nightmare Eclipse said . “As of now it works in a fully updated windows 11 25H2 / Windows Server 2025 with Crowdstrike Falcon.”
Crowdstrike spokesperson said, “We are actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting.” “Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. We refer customers to the FalconFlank Tech Alert in the CrowdStrike support portal.”
Although the company also shared this link to the tech alert regarding the FalconFlank zero-day exploit, the advisory is not public, and customers can access it only if they have an account on CrowdStrike’s support portal.
Kaspersky, Avast, Nvidia, and Microsoft zero-days
This week, Nightmare Eclipse also shared zero-day exploits that let users gain extra control over Kaspersky Antivirus for Endpoint (called HardBreacher) and GenDigital Avast Antivirus (called PrettyPrague). They also released a zero-day for Nvidia (called GreenSection) that will crash the system.
Cybersecurity expert Kevin Beaumont confirmed on Thursday that the privilege escalation exploits released by Nightmare Eclipse this week are real and work.
Nightmare Eclipse has also disclosed multiple zero-day exploits targeting multiple Microsoft products since April, including Microsoft Defender, BitLocker, and various other Windows components.
These Microsoft zero-days are known as LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend. While the LegacyHive, RoguePlanet, YellowKey, GreenPlasma, and MiniPlasma flaws have since been fixed, the other security flaws remain zero-days and are still awaiting an official patch.
After Nightmare Eclipse disclosed the first zero-days, Microsoft responded with warnings of legal action against people engaging in “malicious activity causing real harm to our customers,” prompting many to believe that the company was directly threatening the security researcher.
Related Topic:
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
CrowdStrike publish Root Cause of Global System Outages
