InfoSecBulletin Cybersecurity for mankind
A cybersecurity researcher has shared a PoC for a Windows flaw called “MiniPlasma.” This lets attackers get SYSTEM privileges on fully updated Windows systems. The exploit was shared by a researcher called Chaotic Eclipse, or Nightmare Eclipse. They released the source code and a working file on GitHub after saying that Microsoft did not fix a 2020 vulnerability correctly.
It is supposedly a fixed security flaw from six years ago that now gives hackers a clear way to access a SYSTEM shell on updated Windows 11 and Server 2025 systems.
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
Thousands of MCP Servers Exposed to File Access and Injection Attacks
CERT/CC Alerts to Hidden Admin Backdoor in Tenda Router Firmware
Daily Cyber security update for 6. 07. 2026
“Bad Epoll” 0-Day Vulnerability Allows Root Access on Linux Servers, Android Devices
An AI performed a cyber attack without any human help for the first time
While investigating techniques used in a previous exploit known as “GreenPlasma,” Nightmare-Eclipse took a closer look at a routine called cldflt!HsmOsBlockPlaceholderAccess within the Windows Cloud Files Mini Filter Driver.
To their surprise, the routine was still vulnerable to the exact same issue discovered six years ago by James Forshaw of Google Project Zero. Microsoft supposedly fixed the flaw, tracking it as CVE-2020-17103, an Elevation of Privilege Vulnerability with a CVSS score of 7.0. However, after a tip from a fellow researcher, Nightmare-Eclipse found that the original Project Zero Proof-of-Concept (PoC) still worked straight out of the box.
“I’m unsure if Microsoft just never patched the issue or the patch was silently rolled back at some point for unknown reasons,” the researcher wrote on their GitHub repository.
Nightmare-Eclipse showed how serious the regression is by using the original Google PoC. They took advantage of the race condition, and the new MiniPlasma exploit consistently creates a high-level SYSTEM shell.
The researcher found that the new proof of concept works perfectly on fully updated Windows 11 and Windows Server 2025. Even though race condition problems can have different success rates based on CPU timing, Nightmare-Eclipse thinks all current Windows versions are probably at risk from this old vulnerability.
This new release is normal for Chaotic Eclipse, a researcher known for avoiding coordinated vulnerability disclosure. It is said that they have been unhappy with the Microsoft Security Response Center (MSRC), so in 2026, the researcher has been sharing unpatched zero-days with the public.
MiniPlasma joins a rapidly growing arsenal of publicly disclosed exploits linked to this researcher, including:
BlueHammer: A clever race-condition zero-day abusing Windows Defender’s update workflow to access sensitive registry hives and steal NTLM hashes.
RedSun: Another Defender-adjacent flaw that redirects file rewrites to execute attacker binaries with SYSTEM privileges.
YellowKey: A highly publicized BitLocker bypass triggered via a USB drive in the Windows Recovery Environment (WinRE).
GreenPlasma: A local privilege escalation vulnerability targeting the Windows CTFMON subsystem.
