InfoSecBulletin Cybersecurity for mankind
A cybersecurity researcher has shared a PoC for a Windows flaw called “MiniPlasma.” This lets attackers get SYSTEM privileges on fully updated Windows systems. The exploit was shared by a researcher called Chaotic Eclipse, or Nightmare Eclipse. They released the source code and a working file on GitHub after saying that Microsoft did not fix a 2020 vulnerability correctly.
It is supposedly a fixed security flaw from six years ago that now gives hackers a clear way to access a SYSTEM shell on updated Windows 11 and Server 2025 systems.
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
While investigating techniques used in a previous exploit known as “GreenPlasma,” Nightmare-Eclipse took a closer look at a routine called cldflt!HsmOsBlockPlaceholderAccess within the Windows Cloud Files Mini Filter Driver.
To their surprise, the routine was still vulnerable to the exact same issue discovered six years ago by James Forshaw of Google Project Zero. Microsoft supposedly fixed the flaw, tracking it as CVE-2020-17103, an Elevation of Privilege Vulnerability with a CVSS score of 7.0. However, after a tip from a fellow researcher, Nightmare-Eclipse found that the original Project Zero Proof-of-Concept (PoC) still worked straight out of the box.
“I’m unsure if Microsoft just never patched the issue or the patch was silently rolled back at some point for unknown reasons,” the researcher wrote on their GitHub repository.
Nightmare-Eclipse showed how serious the regression is by using the original Google PoC. They took advantage of the race condition, and the new MiniPlasma exploit consistently creates a high-level SYSTEM shell.
The researcher found that the new proof of concept works perfectly on fully updated Windows 11 and Windows Server 2025. Even though race condition problems can have different success rates based on CPU timing, Nightmare-Eclipse thinks all current Windows versions are probably at risk from this old vulnerability.
This new release is normal for Chaotic Eclipse, a researcher known for avoiding coordinated vulnerability disclosure. It is said that they have been unhappy with the Microsoft Security Response Center (MSRC), so in 2026, the researcher has been sharing unpatched zero-days with the public.
MiniPlasma joins a rapidly growing arsenal of publicly disclosed exploits linked to this researcher, including:
BlueHammer: A clever race-condition zero-day abusing Windows Defender’s update workflow to access sensitive registry hives and steal NTLM hashes.
RedSun: Another Defender-adjacent flaw that redirects file rewrites to execute attacker binaries with SYSTEM privileges.
YellowKey: A highly publicized BitLocker bypass triggered via a USB drive in the Windows Recovery Environment (WinRE).
GreenPlasma: A local privilege escalation vulnerability targeting the Windows CTFMON subsystem.
