InfoSecBulletin Cybersecurity for mankind
A cybersecurity researcher has shared a PoC for a Windows flaw called “MiniPlasma.” This lets attackers get SYSTEM privileges on fully updated Windows systems. The exploit was shared by a researcher called Chaotic Eclipse, or Nightmare Eclipse. They released the source code and a working file on GitHub after saying that Microsoft did not fix a 2020 vulnerability correctly.
It is supposedly a fixed security flaw from six years ago that now gives hackers a clear way to access a SYSTEM shell on updated Windows 11 and Server 2025 systems.
FortiBleed: 70,000 Fortinet Firewalls Compromised Globally
New Rokarolla Android malware hits 217 banking and crypto apps
Phishing Campaign Exploits Legitimate Microsoft Login Flow
ALERT
Cisco SD-WAN Zero-Day, FortiSandbox and cPanel flaws exploited in attacks
“Panthalassa” builds floating AI data centers powered by ocean waves
Critical Wazuh Vuln Enables Alert Tampering and Evidence Deletion
CVE-2026-0257
Palo Alto Warns of GlobalProtect VPN Vuln Actively Exploited
BD Gov.t to set up Tk192.66cr AI hub with support from Koica
Critical Splunk Enterprise Pre-Auth RCE Chain Exposes Databases With Zero Authentication
Anthropic disables Fable 5 and Mythos 5 Access after US order limiting foreign access
While investigating techniques used in a previous exploit known as “GreenPlasma,” Nightmare-Eclipse took a closer look at a routine called cldflt!HsmOsBlockPlaceholderAccess within the Windows Cloud Files Mini Filter Driver.
To their surprise, the routine was still vulnerable to the exact same issue discovered six years ago by James Forshaw of Google Project Zero. Microsoft supposedly fixed the flaw, tracking it as CVE-2020-17103, an Elevation of Privilege Vulnerability with a CVSS score of 7.0. However, after a tip from a fellow researcher, Nightmare-Eclipse found that the original Project Zero Proof-of-Concept (PoC) still worked straight out of the box.
“I’m unsure if Microsoft just never patched the issue or the patch was silently rolled back at some point for unknown reasons,” the researcher wrote on their GitHub repository.
Nightmare-Eclipse showed how serious the regression is by using the original Google PoC. They took advantage of the race condition, and the new MiniPlasma exploit consistently creates a high-level SYSTEM shell.
The researcher found that the new proof of concept works perfectly on fully updated Windows 11 and Windows Server 2025. Even though race condition problems can have different success rates based on CPU timing, Nightmare-Eclipse thinks all current Windows versions are probably at risk from this old vulnerability.
This new release is normal for Chaotic Eclipse, a researcher known for avoiding coordinated vulnerability disclosure. It is said that they have been unhappy with the Microsoft Security Response Center (MSRC), so in 2026, the researcher has been sharing unpatched zero-days with the public.
MiniPlasma joins a rapidly growing arsenal of publicly disclosed exploits linked to this researcher, including:
BlueHammer: A clever race-condition zero-day abusing Windows Defender’s update workflow to access sensitive registry hives and steal NTLM hashes.
RedSun: Another Defender-adjacent flaw that redirects file rewrites to execute attacker binaries with SYSTEM privileges.
YellowKey: A highly publicized BitLocker bypass triggered via a USB drive in the Windows Recovery Environment (WinRE).
GreenPlasma: A local privilege escalation vulnerability targeting the Windows CTFMON subsystem.
