Jun 17 – September 12, 2026 · 3 reports
- ShieldCrash — Dark Reading reports that Nightmare-Eclipse published another claimed Windows Defender zero-day exploit. This establishes public exploit availability, not active exploitation, and is distinct from ShieldBreak/CVE-2026-69414 (earlier coverage). · Sep 12 · demonstrated · New Tools & Releases
- A published PoC bypasses Microsoft's patch for the Windows Defender flaw CVE-2026-69414 ("ShieldBreak"). Researcher Nightmare Eclipse released ShieldCrash, demonstrating arbitrary file read as SYSTEM on supported Windows versions with the September 2026 updates applied; he calls it a "skeleton PoC" and says a full SYSTEM exploit may follow (@IntCyberDigest, repo, Microsoft advisory). The repo was empty when first spotted and populated later, so check what you pull. No in-the-wild exploitation of the bypass has been reported. · Sep 9 · demonstrated · Exploits & Vulnerability Research
- The "ShieldBreak" zero-day PoC bypasses Microsoft's fix for CVE-2026-50656 (RoguePlanet), a Defender flaw, and grants SYSTEM from any user account. The researcher — going by Nightmare Eclipse / Chaotic Eclipse / MSNightmare — published working code, and where RoguePlanet was a quarantine filesystem race condition, ShieldBreak instead abuses a user-mode callback hook, per BleepingComputer and The Hacker News. Kevin Beaumont has already published a ShieldBreak hunting KQL query; the PoC is on GitHub. (discussion) · Aug 13 · demonstrated · Offensive & Exploitation