InfoSecBulletin Cybersecurity for mankind
An unknown security expert called Nightmare Eclipse has drops a new Microsoft Defender flaw called “ShieldCrash” right after Microsoft released its security updates in September 2026. ShieldCrash is described as a bypass for the ShieldBreak Defender privilege escalation flaw patched on Thursday, which itself bypassed RoguePlanet, another Defender flaw disclosed in June and patched by Microsoft in July.
Nightmare Eclipse says that the ShieldCrash proof-of-concept exploit allows attackers to get SYSTEM privileges on updated Windows 10, Windows 11, and Windows Server systems, but they cannot write to those systems.
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
“Microsoft has failed to properly patch ShieldBreak CVE-2026-69414, under specific conditions it is still possible to trigger the exact same problem that was caused by ShieldBreak. While Microsoft fixed several things to prevent re-exploiting the issue, they missed a spot where ShieldBreak can still be exploited,” they said.
“This PoC demonstrates an arbitrary file read as SYSTEM with September 2026, all supported windows versions are affected. I might rework this later into a full SYSTEM PoC but for now I’m dropping this skeleton PoC because I’m feeling a bit lazy.”
Nightmare Eclipse shared these zero-day exploits as part of a fight with Microsoft about the company’s bug bounty and how they handle reporting vulnerabilities.
Microsoft responded with warnings of legal action against anyone engaging in “malicious activity causing real harm” to its customers, prompting many to believe that the company was directly threatening the security researcher.
Since April, a secret security researcher has revealed many zero-day problems. These include ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend. They target Microsoft Defender, BitLocker, and other Windows parts.
Microsoft fixed the ShieldBreak, RoguePlanet, YellowKey, GreenPlasma, and MiniPlasma issues, but there is still no official fix for the other problems shared by Nightmare Eclipse.
Related news:
New Windows Defender ‘RoguePlanet’ zero-day grants SYSTEM privileges
Security Update: RoguePlanet, BitLocker Bypass, Chromium Zero-Day, and More Critical Threats Uncovered
