[CVE-2026-50656]

August 13, 2026

• The "ShieldBreak" zero-day PoC bypasses Microsoft's fix for CVE-2026-50656 (RoguePlanet), a Defender flaw, and grants SYSTEM from any user account. The researcher — going by Nightmare Eclipse / Chaotic Eclipse / MSNightmare — published working code, and where RoguePlanet was a quarantine filesystem race condition, ShieldBreak instead abuses a user-mode callback hook, per BleepingComputer and The Hacker News. Kevin Beaumont has already published a ShieldBreak hunting KQL query; the PoC is on GitHub. (discussion) · Offensive & Exploitation

in ShieldBreak Turns a "Patched" Defender Bug Back Into SYSTEM

July 10, 2026

• Microsoft patched RoguePlanet (CVE-2026-50656), a CVSS 7.8 privilege-escalation flaw in the Malware Protection Engine (mpengine.dll) that can grant SYSTEM, nearly a month after researcher "Nightmare-Eclipse" published a PoC following June Patch Tuesday. The same researcher separately detailed additional Defender mpengine.dll behavior allowing data leakage and system hangs via malicious SMB/WebDAV servers abusing ADS caching. BleepingComputer · The Hacker News · PNC Blog · Malware & Endpoint Evasion

in Signed Drivers and Kernel Rootkits Push the Malware Beat Down to Ring 0

June 21, 2026

• Microsoft confirmed RoguePlanet (CVE-2026-50656, CVSS 7.8), a privilege-escalation zero-day in the Defender Malware Protection Engine, with a patch in development (The Hacker News). · Vulnerabilities & Exploits

in FortiBleed Exposes 86,000 FortiGate Devices as North Korea's Sapphire Sleet Poisons the Mastra npm Catalog

June 18, 2026

• Microsoft Defender "RoguePlanet" (CVE-2026-50656) zero-day remains unpatched, with Microsoft confirming a patch is in development. Public PoC exploits a race condition in the Malware Protection Engine to spawn a SYSTEM shell (SecurityWeek, BleepingComputer). · Vulnerabilities & Exploits

in ShinyHunters Burns a PeopleSoft Zero-Day Through Higher Ed as Copilot "SearchLeak" Shows AI Is the New Exfil Channel