RoguePlanet Zero-Day Drops as Nightmare Eclipse–Microsoft Feud Reaches New Low
A race-condition bug in Microsoft Defender can yield a SYSTEM shell on fully patched Windows 11 and 10. No patch exists. The researcher dropped it the day after June Patch Tuesday.
The pattern is almost tedious at this point. Patch Tuesday ships. Nightmare Eclipse publishes exploit code. Defenders scramble. Repeat.
The researcher's latest disclosure, dubbed RoguePlanet, targets a race condition in Microsoft Defender. The exploit works against Windows 11 (stable and Canary channels) and Windows 10 with the June 2026 cumulative update applied — meaning the patch doesn't help you. The end state is a SYSTEM-level shell.
The attack path involves a victim opening a .vhd or .vhdx file hosted on a remote SMB share. Defender then overwrites its own files processing that image, which Eclipse describes as resulting in remote code execution. In practice, this means a specially crafted virtual hard disk on an attacker-controlled SMB server can turn a phishing click into full machine ownership. The exploit is probabilistic — sub-100% success rate due to the race condition — but race conditions are rarely a meaningful barrier when you can just run the exploit again.
Eclipse noted that a mid-May Defender update closed the original attack vector by making junction attacks ineffective. So they rewrote the exploit. The current version works. Windows Server is currently out of scope only because standard users can't mount ISO images in that environment — Eclipse called the Server variant a solvable problem they were too exhausted to finish.
The PoC landed in a new GitHub repository called MSNightmare after Microsoft (which owns GitHub) and GitLab both pulled Eclipse's prior accounts. The code is public. It cannot be unpublished. Eclipse made that point explicitly.
The failure mode here is a disclosure process that produced no patch before working exploit code hit the internet. Eclipse's previous disclosures — RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, MiniPlasma — were reportedly incorporated into real attacks. Microsoft's MSRC blog called coordinated disclosure a non-negotiable, threatened legal action, and mentioned its Digital Crimes Unit. Security researcher Kevin Beaumont publicly noted that Microsoft hired a researcher called SandboxEscaper in 2019 for doing functionally the same thing Microsoft is now characterizing as criminal.
Microsoft also revoked Eclipse's MSRC portal access, which is worth flagging. Revoking access to your own bug reporting pipeline from a researcher actively finding bugs in your products is an interesting strategic choice.
One thing the post-mortem will say: organizations relying on Defender as their primary endpoint detection layer have no vendor-supplied mitigation for a SYSTEM-level privilege escalation bug that works on fully patched machines right now. If you run Windows endpoints at scale — and if you're reading this, you probably do — blocking outbound SMB (TCP 445) to untrusted external hosts and auditing .vhd and .vhdx file-open events in your EDR are the practical near-term controls available to you while Microsoft works out whatever comes next.
