InfoSecBulletin Cybersecurity for mankind
A cybersecurity researcher has shared a PoC for a Windows flaw called “MiniPlasma.” This lets attackers get SYSTEM privileges on fully updated Windows systems. The exploit was shared by a researcher called Chaotic Eclipse, or Nightmare Eclipse. They released the source code and a working file on GitHub after saying that Microsoft did not fix a 2020 vulnerability correctly.
It is supposedly a fixed security flaw from six years ago that now gives hackers a clear way to access a SYSTEM shell on updated Windows 11 and Server 2025 systems.
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
“PentesterFlow” AI Automation Tool for Penetration Testers and Bug Hunters
Jailbreak works against AI Models GPT-5.6, Claude Opus 5, and Fable, Claims Researcher
Researchers found security flaws in every script generated by ChatGPT, Copilot, and Gemini
While investigating techniques used in a previous exploit known as “GreenPlasma,” Nightmare-Eclipse took a closer look at a routine called cldflt!HsmOsBlockPlaceholderAccess within the Windows Cloud Files Mini Filter Driver.
To their surprise, the routine was still vulnerable to the exact same issue discovered six years ago by James Forshaw of Google Project Zero. Microsoft supposedly fixed the flaw, tracking it as CVE-2020-17103, an Elevation of Privilege Vulnerability with a CVSS score of 7.0. However, after a tip from a fellow researcher, Nightmare-Eclipse found that the original Project Zero Proof-of-Concept (PoC) still worked straight out of the box.
“I’m unsure if Microsoft just never patched the issue or the patch was silently rolled back at some point for unknown reasons,” the researcher wrote on their GitHub repository.
Nightmare-Eclipse showed how serious the regression is by using the original Google PoC. They took advantage of the race condition, and the new MiniPlasma exploit consistently creates a high-level SYSTEM shell.
The researcher found that the new proof of concept works perfectly on fully updated Windows 11 and Windows Server 2025. Even though race condition problems can have different success rates based on CPU timing, Nightmare-Eclipse thinks all current Windows versions are probably at risk from this old vulnerability.
This new release is normal for Chaotic Eclipse, a researcher known for avoiding coordinated vulnerability disclosure. It is said that they have been unhappy with the Microsoft Security Response Center (MSRC), so in 2026, the researcher has been sharing unpatched zero-days with the public.
MiniPlasma joins a rapidly growing arsenal of publicly disclosed exploits linked to this researcher, including:
BlueHammer: A clever race-condition zero-day abusing Windows Defender’s update workflow to access sensitive registry hives and steal NTLM hashes.
RedSun: Another Defender-adjacent flaw that redirects file rewrites to execute attacker binaries with SYSTEM privileges.
YellowKey: A highly publicized BitLocker bypass triggered via a USB drive in the Windows Recovery Environment (WinRE).
GreenPlasma: A local privilege escalation vulnerability targeting the Windows CTFMON subsystem.
