Loading story…
A researcher known as Chaotic Eclipse, Nightmare-Eclipse, MSNightmare, and INFINITE NIGHTMARE released FalconFlank, a public proof of concept claiming a zero-day local privilege-escalation flaw in the CrowdStrike Falcon Sensor. The technique allegedly abuses Falcon’s privileged remediation workflow for Microsoft Office files identified as containing malicious macros, potentially allowing a low-privileged local Windows user to execute in a more privileged—potentially SYSTEM—context.
The researcher reported successful testing on fully updated Windows 11 25H2 and Windows Server 2025 systems running Falcon with Phase 3 – Optimal Protection and the Office macro-removal capability enabled. CrowdStrike had not published an advisory, CVE, patch, or confirmation at the time of reporting; affected versions, exploit reliability, prerequisites, and mitigations remain unverified. Organizations using the specified Falcon configuration should monitor for vendor guidance and investigate whether local-access threats could abuse the remediation feature.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
In early September 2026, Nightmare Eclipse released PrettyPrague, targeting Avast and potentially other GenDigital products, and GreenSection, targeting Nvidia user-mode components. GenDigital said it fixed the Avast-related local privilege-escalation issue, while Nvidia had not responded regarding GreenSection.
Nightmare-Eclipse released HardBreacher, an unstable proof of concept for code execution in Kaspersky Endpoint Security 14.0.0.504 via NT Object Manager namespace manipulation. Kaspersky resolved the issue with a database update rather than a new product build; no CVE was assigned.
CrowdStrike said it was actively investigating the FalconFlank claims and advised customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy while retaining Cloud Anti-malware for Microsoft Office Files protections. Researcher Kevin Beaumont reported confirming that the exploit works.
A researcher known as Chaotic Eclipse, Nightmare-Eclipse, and MSNightmare publicly released FalconFlank, a proof-of-concept project claiming a local privilege-escalation flaw in the CrowdStrike Falcon Sensor. The PoC allegedly abuses Falcon's high-privileged remediation process for Microsoft Office files identified as containing malicious macros.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
18 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyderes.com
Open sourcesecurityweek.com
Open sourceinfosecurity-magazine.com
Open sourcesecurityaffairs.com
Open sourceinfosec.pub
Open sourcecybersecuritynews.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A proof-of-concept exploit for a new Microsoft Defender local privilege escalation flaw dubbed **RedSun** was published by researcher **Chaotic Eclipse**, with reports saying it works on fully patched **Windows 10**, **Windows 11**, and **Windows Server 2019 and later** when Defender is enabled. The zero-day allows an unprivileged local user to gain **SYSTEM** privileges by abusing Defender’s handling of files tagged by cloud detection, and Microsoft had not released a patch at the time of reporting. Independent researcher **Will Dormann** reportedly validated the exploit chain, which uses the **Windows Cloud Files API**, opportunistic locks, and **NTFS junctions/reparse points** to redirect Defender into overwriting a protected binary under `C:\Windows\System32` and then executing it as SYSTEM. The disclosure followed an earlier Defender privilege-escalation exploit, **BlueHammer**, which Microsoft patched as `CVE-2026-33825`, while defenders were urged to watch for anomalous Defender file writes, `cldapi.dll` activity, and oplock-assisted redirection behavior pending a vendor fix.
Jun 29, 2026
Microsoft said it is preparing a security update for **RoguePlanet**, a publicly disclosed Microsoft Defender zero-day tracked as `CVE-2026-50656`. The flaw affects fully patched **Windows 10** and **Windows 11** systems and allows local privilege escalation to **SYSTEM** by exploiting a race condition in the **Microsoft Malware Protection Engine**. Researcher **Nightmare Eclipse** released a public proof-of-concept exploit, and reports said the issue can be triggered whether Defender real-time protection is enabled or disabled, with possible impact in passive mode as well. The researcher said the bug may originally have supported remote code execution before Microsoft hardening changes in May blocked some attack paths, after which the exploit was reworked to bypass mitigations. Microsoft acknowledged the vulnerability and said it is investigating while developing a patch. The disclosure comes amid an ongoing dispute between Nightmare Eclipse and Microsoft over bug bounty and coordinated disclosure practices, and follows several other Windows flaws the researcher has publicly exposed, including **BlueHammer**, **RedSun**, **UnDefend**, **GreenPlasma**, and **YellowKey**.
Jul 13, 2026
Security researcher **Chaotic Eclipse** has released a proof-of-concept exploit dubbed **ShieldBreak** that allegedly bypasses Microsoft’s fix for `CVE-2026-50656`, also known as **RoguePlanet**, in **Microsoft Defender for Windows**. The flaw affects the **Microsoft Malware Protection Engine** and has been described as a local privilege escalation race condition that can let an attacker with local access spawn a **SYSTEM-level shell** and execute arbitrary code. The researcher said the bypass works reliably on **Windows 11 25H2** and **Windows Server 2025**, and that **Windows 10** is also believed to be vulnerable. Microsoft had issued updates for the RoguePlanet zero-day after acknowledging it earlier, but the new claims suggest the patch was incomplete. The disclosure adds to ongoing scrutiny of Microsoft’s recent security fixes and follows earlier public zero-day releases by the same researcher, including **LegacyHive**, amid a broader dispute over coordinated vulnerability disclosure. Separate reporting also noted that Microsoft recently patched hundreds of flaws and that **CISA** added `CVE-2026-68820`, an actively exploited WinSock driver issue, to its **Known Exploited Vulnerabilities** catalog with a remediation deadline for U.S. federal agencies.
Aug 17, 2026