InfoSecBulletin Cybersecurity for mankind
A cybersecurity researcher has shared a PoC for a Windows flaw called “MiniPlasma.” This lets attackers get SYSTEM privileges on fully updated Windows systems. The exploit was shared by a researcher called Chaotic Eclipse, or Nightmare Eclipse. They released the source code and a working file on GitHub after saying that Microsoft did not fix a 2020 vulnerability correctly.
It is supposedly a fixed security flaw from six years ago that now gives hackers a clear way to access a SYSTEM shell on updated Windows 11 and Server 2025 systems.
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
While investigating techniques used in a previous exploit known as “GreenPlasma,” Nightmare-Eclipse took a closer look at a routine called cldflt!HsmOsBlockPlaceholderAccess within the Windows Cloud Files Mini Filter Driver.
To their surprise, the routine was still vulnerable to the exact same issue discovered six years ago by James Forshaw of Google Project Zero. Microsoft supposedly fixed the flaw, tracking it as CVE-2020-17103, an Elevation of Privilege Vulnerability with a CVSS score of 7.0. However, after a tip from a fellow researcher, Nightmare-Eclipse found that the original Project Zero Proof-of-Concept (PoC) still worked straight out of the box.
“I’m unsure if Microsoft just never patched the issue or the patch was silently rolled back at some point for unknown reasons,” the researcher wrote on their GitHub repository.
Nightmare-Eclipse showed how serious the regression is by using the original Google PoC. They took advantage of the race condition, and the new MiniPlasma exploit consistently creates a high-level SYSTEM shell.
The researcher found that the new proof of concept works perfectly on fully updated Windows 11 and Windows Server 2025. Even though race condition problems can have different success rates based on CPU timing, Nightmare-Eclipse thinks all current Windows versions are probably at risk from this old vulnerability.
This new release is normal for Chaotic Eclipse, a researcher known for avoiding coordinated vulnerability disclosure. It is said that they have been unhappy with the Microsoft Security Response Center (MSRC), so in 2026, the researcher has been sharing unpatched zero-days with the public.
MiniPlasma joins a rapidly growing arsenal of publicly disclosed exploits linked to this researcher, including:
BlueHammer: A clever race-condition zero-day abusing Windows Defender’s update workflow to access sensitive registry hives and steal NTLM hashes.
RedSun: Another Defender-adjacent flaw that redirects file rewrites to execute attacker binaries with SYSTEM privileges.
YellowKey: A highly publicized BitLocker bypass triggered via a USB drive in the Windows Recovery Environment (WinRE).
GreenPlasma: A local privilege escalation vulnerability targeting the Windows CTFMON subsystem.
