Loading story…
Researcher Nightmare Eclipse, also known as Chaotic Eclipse/MSNightmare, publicly released HardBreacher, a proof of concept for a claimed local privilege-escalation flaw in Kaspersky Endpoint Security. The unstable PoC was reportedly tested against version 14.0.0.504 on fully patched Windows 11 25H2 and can intermittently create C:\Windows\System32\MY_SNAKE_IS_SOLID.dll with permissions granted to the invoking user. The researcher says control of a Kaspersky UI process can also destabilize the security product and affect its file-access decisions.
Kaspersky told SecurityWeek that it fixed the underlying issue and delivered the remediation through its automatic update mechanism, with a manual database update also available. No CVE, affected-version range, technical root cause, or confirmed in-the-wild exploitation has been published; other reporting had not yet identified a public vendor advisory. Organizations using Kaspersky Endpoint Security should ensure updates are applied, investigate unexpected DLL creation under System32, anomalous Kaspersky UI-process activity, and security-service failures, and avoid executing the public PoC on production endpoints.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Kaspersky told SecurityWeek that it resolved the underlying Kaspersky Endpoint Security issue and distributed the fix through its automatic update mechanism. Users can also manually trigger a database update to obtain the fix.
Nightmare Eclipse (MSNightmare/Chaotic Eclipse) publicly released HardBreacher, an unstable proof of concept alleging a local privilege-escalation zero-day in Kaspersky Endpoint Security. The PoC was reportedly tested against version 14.0.0.504 on fully patched Windows 11 25H2 and claims it can create a user-controllable DLL in System32.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
7 references tracked. Mallory keeps watching after this page renders.
meetcyber.net
Open sourcexakep.ru
Open sourcesecurityaffairs.com
Open sourcecyberveille.ch
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researcher **Chaotic Eclipse** has released a proof-of-concept exploit dubbed **ShieldBreak** that allegedly bypasses Microsoft’s fix for `CVE-2026-50656`, also known as **RoguePlanet**, in **Microsoft Defender for Windows**. The flaw affects the **Microsoft Malware Protection Engine** and has been described as a local privilege escalation race condition that can let an attacker with local access spawn a **SYSTEM-level shell** and execute arbitrary code. The researcher said the bypass works reliably on **Windows 11 25H2** and **Windows Server 2025**, and that **Windows 10** is also believed to be vulnerable. Microsoft had issued updates for the RoguePlanet zero-day after acknowledging it earlier, but the new claims suggest the patch was incomplete. The disclosure adds to ongoing scrutiny of Microsoft’s recent security fixes and follows earlier public zero-day releases by the same researcher, including **LegacyHive**, amid a broader dispute over coordinated vulnerability disclosure. Separate reporting also noted that Microsoft recently patched hundreds of flaws and that **CISA** added `CVE-2026-68820`, an actively exploited WinSock driver issue, to its **Known Exploited Vulnerabilities** catalog with a remediation deadline for U.S. federal agencies.
Aug 17, 2026
A researcher using the names Nightmare Eclipse and Chaotic Eclipse released **ShieldCrash**, a proof of concept said to bypass aspects of Microsoft’s remediation for the Microsoft Defender elevation-of-privilege flaw `CVE-2026-69414`, also called ShieldBreak. The researcher claims the exploit works on fully patched Windows 10, Windows 11, and Windows Server systems, including systems with September 2026 updates, to perform arbitrary file reads under `SYSTEM` privileges. Microsoft had said Malware Protection Engine version `1.1.26080.3`, delivered through automatic engine and malware-definition updates, fixed ShieldBreak. The claimed bypass has not been independently verified, and available reporting indicates ShieldCrash demonstrates `SYSTEM`-level file-read access rather than arbitrary writes or a complete SYSTEM compromise; the release occurred amid a dispute over Microsoft’s bug-bounty and vulnerability-disclosure practices.
Sep 11, 2026
NightmareEclipse released **ShieldBreak**, a proof-of-concept local privilege-escalation exploit claimed to bypass Microsoft’s fix for **CVE-2026-50656** (RoguePlanet). The exploit allegedly abuses improper link resolution during Windows Defender remediation, combining Cloud Files placeholders, Object Manager symbolic-link swaps, CLFS path handling, an EICAR-triggered scan, and NTFS alternate data streams to redirect a Defender process running as `SYSTEM` and plant `C:\Windows\System32\phoneinfo.dll`. A fabricated Windows Error Reporting report and the `QueueReporting` scheduled task then cause `wermgr.exe` to load the malicious DLL; the included `Warden.dll` payload reportedly duplicates a SYSTEM token and opens a SYSTEM shell in the unprivileged user’s session. Splunk published attack data and multiple disabled-by-default analytics for the ShieldBreak chain, covering Defender activity on `\globalroot\` object-manager paths (Defender Operational events 1116/1117), `MpClient.dll` loaded by non-Defender processes, ADS creation through loopback administrative SMB shares (Security event 5145), manually created `.wer` files in the Windows Error Reporting ReportQueue, creation of phantom DLLs such as `phoneinfo.dll` in system paths, and `WerMgr.exe` spawning SYSTEM-integrity children. Organizations should collect the required Sysmon, Security, and Defender Operational telemetry; enable file-share object-access auditing; investigate these signals promptly; and validate the creating process, signer, file hash, and operational need before suppressing alerts.
Aug 28, 2026