Microsoft threatens legal action against researcher Nightmare Eclipse for exploit disclosure
·2 min read
Compiled by KHAO Editorial
— aggregated from 1 source + 10 references discovered via search.
See llms.txt for citation guidance.
◌ Single Source
The tech giant is weighing criminal charges against a security researcher who dumped six Windows zero-day exploits in six weeks, three of which were exploited in real-world attacks.
Key facts
The vulnerabilities carry names that read like a cyberpunk novel: BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), YellowKey (CVE-2026-45585), GreenPlasma
Nightmare Eclipse’s GitHub account was disabled around May 23, followed by their GitLab account between May 26 and 27
On May 28, 2026, Microsoft published a statement on its MSRC blog emphasizing the importance of coordinated vulnerability disclosure
Nightmare Eclipse has threatened another significant disclosure scheduled for July 14, 2026
Summary
Microsoft’s Digital Crimes Unit is considering criminal action against a security researcher who has been publicly releasing proof-of-concept exploit code for unpatched Windows vulnerabilities. Three of those exploits were confirmed as being used in real-world attacks shortly after going public. The vulnerabilities carry names that read like a cyberpunk novel: BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), YellowKey (CVE-2026-45585), GreenPlasma, and MiniPlasma. Nightmare Eclipse posted the exploit.