Microsoft criticized for threatening a security researcher
A researcher known as Nightmare Eclipse published unpatched Defender and BitLocker bugs; Microsoft threatened a criminal investigation and the researcher's accounts were banned.
What happened
A researcher known as Nightmare Eclipse published unpatched bugs in Windows Defender and BitLocker:
- BlueHammer (CVE-2026-33825)
- RedSun (CVE-2026-41091)
- UnDefend (CVE-2026-45498)
- YellowKey (CVE-2026-45585)
Microsoft's response
- A Microsoft blog post threatened a criminal investigation.
- The researcher's GitHub and GitLab accounts were banned.
- Per Microsoft and CISA, some flaws were used in real attacks.
Why the backlash
Security experts warn that threatening researchers can discourage disclosure and leave bugs hidden.
Tip
Keep Windows and Defender up to date.
Founder and editor-in-chief of Kurd Developers. Phone and tech news on YouTube, Instagram and TikTok.
More stories
One text can break your phone: Android's 'SMS of Death' explained
A flaw in Android 12 and later lets a specially crafted SMS drop calls and even make a phone unusable. The fix is in October's security patch.
GTA VI lands November 19: prices, editions and what to know
Rockstar has locked the date: Thursday, November 19 on PS5 and Xbox Series X|S. Standard costs $79.99 and Ultimate $99.99.
Apple's first touchscreen MacBook Pro brings OLED and Dynamic Island
The new PROLED XDR display responds to touch, the notch is gone and Dynamic Island takes its place. Prices start at $2,899.
The $1,999 iPhone Duo Has a Black-Bar Problem, and Fixing It Is Harder Than It Looks
Apple's first foldable is a hardware flex. But unfold it and many of your apps shrink into a phone-shaped window floating in black. Here's why the app world wasn't ready, and why developers can't just hit "stretch".