Stay On the Cutting Edge: Get the Tom's Hardware Newsletter
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
You are now subscribed
Your newsletter sign-up was successful
Join the club
Get full access to premium articles, exclusive features and a growing list of member rewards.
An account already exists for this email address, please log in.
Microsoft's bug-hunting nemesis extends vendetta with more zero-day attacks — Nightmare Eclipse publishes RoguePlanet and GreatXML local privilege escalation exploits
Ever since appearing on the cybersecurity scene, Nightmare-Eclipse (aka Chaotic-Eclipse) has probably been the largest thorn in the side of the MicrosoftSecurity Response Center. The long-running saga between Redmond and the disgruntled cybersecurity expert got a couple of new chapters this week, thanks to the release of the RoguePlanet and GreatXML exploits.
RoguePlanet is probably the nastiest one, as it takes advantage of yet another vulnerability in Windows Defender to gain SYSTEM user access privileges, letting an attacker execute commands at a privilege level even higher than the standard Administrator. The practical mechanism is simple: just fool a user into running a script, and said script will get full access to the machine, granting the ability to syphon all data, keep exfiltration malware installed, or any other number of malicious activities.
It's worth noting that RoguePlanet is dependent on a race condition seemingly between ISO mounting and Volume Shadow Copy, meaning that it's timing-based, and the exact conditions under which it can be triggered aren't guaranteed to happen every time in the victim machine. Eclipse themselves say that while they had a 100% success rate on certain installs, the exploit "struggled to work on others."
They do remark that RoguePlanet operates on a fully patched Windows system that includes the recently released June 2026 update, and that they're fairly certain that Windows Server is likewise vulnerable, necessitating a redesign of the proof-of-concept code to work around the fact that users on Server editions can't mount ISOs by default.
As for GreatXML, it's yet another BitLocker bypass. It's far less scary than YellowKey, as the exploit conditions are much more strict, but it's still somewhat of an egg-on-face moment for Microsoft. To run the bypass, an attacker needs to write a specially crafted "unattend.xml" and a "Recovery" directory to Windows' recovery partition. Then, if a Windows Defender Offline Scan is run or has been run in the past, rebooting into the recovery environment will open the BitLocker-protected drive just fine.
The requirements are a pretty high bar to clear for an attacker, but the validity of the approach still raises questions about which backdoor-looking behaviors are still present in BitLocker and the Windows Recovery Environment (WinRE). Eclipse believes that it may be possible to trigger a Defender Offline Scan without logging in, but that's not a certain thing at this point. Having said that, it wouldn't be surprising if tomorrow they came up with a way to do just that.
Given that Eclipse's spat with Microsoft has resulted in Redmond banning their GitHub account, the researcher has since moved their proof-of-concept to Church of Malware, a somewhat unrestricted community and code repository for exploits. Amusingly enough, though, a secondary GitHub account of theirs remains online.
Stay On the Cutting Edge: Get the Tom's Hardware Newsletter
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
The firm previously threatened legal action against Eclipse, too, but has since backed down. From their side, Eclipse had previously threatened to mass-disclose zero-day Windows vulnerabilities on July 14. They too have since then relented, stating that writing RoguePlanet took more time than expected, and that they may take a break and seemingly won't make the July 14 date the Windowspocalypse Day after all.
Bruno Ferreira is a contributing writer for Tom's Hardware. He has decades of experience with PC hardware and assorted sundries, alongside a career as a developer. He's obsessed with detail and has a tendency to ramble on the topics he loves. When not doing that, he's usually playing games, or at live music shows and festivals.
Popping some more popcorn and laughing at Microslop's recent statement on X. Turns out much of the security community is having a field day with MS over this.
Popping some more popcorn and laughing at Microslop's recent statement on X. Turns out much of the security community is having a field day with MS over this.
We did just hear from the Xbox CEO about the need to be "more efficient" and "do more with less". I'm sure this is an MS theme across the board (minus Co-Pilot), so why not do "more with less" and just skip paying security researchers who help improve security and threaten legal action with layers already on the payroll instead? That's "more efficient"
We did just hear from the Xbox CEO about the need to be "more efficient" and "do more with less". I'm sure this is an MS theme across the board (minus Co-Pilot), so why not do "more with less" and just skip paying security researchers who help improve security and threaten legal action with layers already on the payroll instead? That's "more efficient"
Brilliant! Microsoft and their competitors already have gamers perform QA on games instead of properly staffing, paying, and allotting time for an internal QA process. They've been adopting a similar approach with Windows over the past couple years too. It'll save even more money to get rid of the paid cybersecurity professionals and crowdsource them from the internet. Just think of all that shareholder cheddar and executive bonuses! Microsoft stock will be going to the moon!
/sarcasm
On a more serious note, the Steam Machine can't launch fast enough. I think its success or failure is less important than the impact of introducing a whole new audience to the concept of a PC OS that's not Windows or MacOS. The idea of having a positive experience on Linux is nothing special to readers of Tom's, but it'll be a whole new experience for other people. I don't advocate for a big cybersecurity incident that affects millions of people and I want the next version of Windows to be better, but the antagonistic relationship between Microsoft and Nightmare Eclipse needs to be giving Windows users a lot of anxiety.
