Microsoft has released patches for two high-severity zero-days disclosed by a researcher who has been locked in a testy beef with the software giant. The vulnerabilities, tracked as CVE-2026-45586 and CVE-2020-17103, were part of a series of six Windows zero-days publicly disclosed by Nightmare Eclipse, a pseudonym used by the researcher.
What Happened
The saga between Microsoft and Nightmare Eclipse began when the researcher released proof-of-concept code for several high-severity vulnerabilities in recent months. The disclosures included RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma. According to sources, Nightmare Eclipse had been working with Microsoft on a vulnerability disclosure program but claimed that the company reneged on an agreement regarding the vulnerabilities they had discussed.
Microsoft responded by criticizing Nightmare Eclipse for publicly disclosing the bugs without attempting to report them first. The company argued that this could have aided malicious hackers and put its customers at risk. However, Nightmare Eclipse maintained that they had no choice but to release the vulnerabilities publicly due to Microsoft's alleged mistreatment of them.
Background and Context
Nightmare Eclipse has been a thorn in Microsoft's side for some time, releasing several Windows zero-days in protest of the company's handling of vulnerability reports. The researcher has claimed that they have been working with Microsoft on a vulnerability disclosure program but felt mistreated by the company.
Microsoft's Digital Crimes Unit has stated that it will continue to bring cases against actors who exploit vulnerabilities and those that enable their criminal activity, coordinating as needed with law enforcement around the world. However, Nightmare Eclipse has threatened to release more zero-days if Microsoft does not change its approach to vulnerability disclosure.
Why It Matters to the Industry
The dispute between Microsoft and Nightmare Eclipse highlights the complex issues surrounding vulnerability disclosure in the tech industry. The debate centers on whether researchers have a responsibility to disclose vulnerabilities to companies before releasing them publicly, potentially allowing malicious hackers to exploit them first.
This issue is particularly relevant to the adult-industry trade audience, where cybersecurity and vulnerability management are critical components of platform operations. Adult-industry platforms must balance the need for security with the risk of being targeted by malicious actors who exploit vulnerabilities in software and systems.
What Comes Next
The release of patches for CVE-2026-45586 and CVE-2020-17103 is a significant development in this ongoing saga. However, it remains to be seen whether Nightmare Eclipse will follow through on their threat to release more zero-days if Microsoft does not change its approach to vulnerability disclosure.
Key Facts
- Mircosoft has released patches for two high-severity zero-days disclosed by Nightmare Eclipse: CVE-2026-45586 and CVE-2020-17103.
- The vulnerabilities were part of a series of six Windows zero-days publicly disclosed by Nightmare Eclipse in recent months.
- Nightmare Eclipse has claimed that they had been working with Microsoft on a vulnerability disclosure program but felt mistreated by the company.
- Microsoft has criticized Nightmare Eclipse for publicly disclosing the bugs without attempting to report them first.
- The dispute highlights the complex issues surrounding vulnerability disclosure in the tech industry.
The outcome of this dispute will have significant implications for the adult-industry trade audience, where cybersecurity and vulnerability management are critical components of platform operations. As the situation continues to unfold, it remains to be seen whether Microsoft will change its approach to vulnerability disclosure or whether Nightmare Eclipse will follow through on their threat to release more zero-days.
