Microsoft 0-day feud escalates as researcher threatens another exploit dump

Microsoft’s bug war just turned deeply personal — and commenters are grabbing popcorn

TLDR: A furious researcher says Microsoft ignored and embarrassed them, then dumped six serious Windows flaws online, with another release threatened for July 14. Commenters are split between calling the researcher reckless and saying Microsoft’s response makes the company look arrogant, secretive, and badly out of touch.

This story has officially left computer security drama and entered full-blown public meltdown territory. A furious researcher called Nightmare Eclipse has already dumped six serious Windows flaws into the wild, three of them are reportedly being abused already, and now they’re teasing an even nastier release on July 14. Microsoft fired back with a stern blog post condemning the leaks and hinting that its crime-fighting unit and police friends are paying attention. But in the comments, that corporate scolding landed less like strength and more like panic in a blazer.

A huge chunk of the community is siding with the researcher — or at least saying Microsoft looks terrible here. One commenter said Microsoft is behaving like a “colossal dick,” while another mocked the company as “Microslop” and accused it of clumsy damage control. People keep circling one key point: if Microsoft says there’s a proper bug-report process, why does the researcher claim they got ignored, humiliated, and even lost the account they used to report problems? That’s why security veteran Dustin Childs’ quote hit hard: coordinated disclosure is a two-way street, and commenters loved that line.

There’s also fear under the memes. One LinkedIn post making the rounds said a single person caused more enterprise damage in weeks than many state-backed hacking groups do in a year. Meanwhile, commenters are swapping workarounds and whispering that one flaw may rely on a built-in Microsoft “management” feature, which only poured gasoline on the paranoia. The vibe is equal parts rage, schadenfreude, and popcorn.gif.

Key Points

  • The article reports that security researcher Nightmare Eclipse publicly released six Windows zero-days and threatened another release on July 14.
  • Microsoft said none of the six vulnerabilities were disclosed through its official channels before becoming public.
  • BlueHammer, RedSun, and UnDefend were reportedly exploited soon after proof-of-concept code was posted online.
  • Microsoft said YellowKey, GreenPlasma, and MiniPlasma remained unpatched, and it assessed YellowKey (CVE-2026-45585) as more likely to be exploited.
  • The article includes expert commentary that coordinated vulnerability disclosure is a shared responsibility between researchers and vendors.

Hottest takes

"behaving like a colossal dick" — rekabis
"This is poor damage control by Microslop" — 45ahgd
"CVD is a two-way street" — 8cvor6j844qw_d6
Made with <3 by @siedrix and @shesho from CDMX. Powered by Forge&Hive.