Nightmare Eclipse released six Windows zero-days in six weeks before GitHub and GitLab pulled the plug
A pseudonymous security researcher operating under the name Nightmare Eclipse spent six weeks systematically dropping working Windows zero-day exploits on GitHub. Six exploits. Six weeks. All targeting different parts of the Windows security architecture. Two code-hosting platforms eventually banned the account. The exploits are still out there.
The campaign started April 3 with BlueHammer, a Windows Defender local privilege escalation flaw. The PoC gave attackers a SYSTEM shell via a TOCTOU and path confusion bug. Will Dormann from Tharros confirmed it worked. Within a week, Huntress Labs spotted BlueHammer being used in real attacks. Microsoft patched it in April Patch Tuesday as CVE-2026-33825.
Next came RedSun and UnDefend. RedSun exploited another Defender behavior: when Defender flags a malicious file with a cloud tag, it rewrites the file back to its original location. Nightmare Eclipse’s PoC abused this to overwrite system files for privilege escalation, also granting SYSTEM. UnDefend blocked Defender definition updates entirely, causing denial of service. Both got CVEs (CVE-2026-41091 and CVE-2026-45498). CISA added them to the Known Exploited Vulnerabilities catalog. Federal agencies had two weeks to patch. Huntress confirmed all three were being deployed together in the wild.
Then things escalated. On May 13, Nightmare Eclipse released YellowKey, a BitLocker encryption bypass. Plug in a USB stick, reboot to Windows Recovery Environment, hold a key combination, and the PoC spawns a command prompt with access to the encrypted volume. The researcher called it “the most insane discovery I’ve ever found. It almost feels like a backdoor.” Security researchers Kevin Beaumont and Will Dormann both confirmed it works against current Windows 11 builds. YellowKey only affects Windows 11, Server 2022, and Server 2025. Not Windows 10. Microsoft issued CVE-2026-45585 and published mitigations: remove autofstx.exe from the BootExecute registry and switch BitLocker to TPM+PIN mode. Full patch lands June 9.
Alongside YellowKey came GreenPlasma, targeting the CTFMON process that runs as SYSTEM. Nightmare Eclipse deliberately released an incomplete version as a “capture-the-flag challenge.” The full exploit could manipulate kernel-mode drivers via arbitrary memory section objects planted through registry tricks. No CVE assigned yet. No patch.
The sixth and final release was MiniPlasma on May 18. This one was different. It targeted CVE-2020-17103, a CVSS 7.0 privilege escalation in the Windows Cloud Filter driver that Google Project Zero reported to Microsoft in 2020. Nightmare Eclipse’s discovery: the original Google Project Zero PoC code still works without modification on Windows 11 with May 2026 updates installed. Either the vulnerability was never properly patched or the patches were rolled back at some point. Will Dormann confirmed it fails on the latest Insider Preview Canary build, suggesting Microsoft is aware and working on it. But six years is a long time for a publicly reported flaw to sit unpatched.
The stated motivation is personal. Nightmare Eclipse claims Microsoft “violated our agreement and left me homeless with nothing.” The researcher expressed frustration with MSRC’s handling of vulnerability reports, specifically the requirement to submit video proof of exploits. Each release came with taunting messages aimed at Microsoft. “I was not bluffing Microsoft, and I’m doing it again.” “The fire will go as long as you want, unless you extinguish it or until there is nothing left to burn.”
On April 25, the researcher posted about a “dead man’s switch” that took “forever to deploy.” The implication: if something happens to Nightmare Eclipse, additional exploits release automatically. “It will take you a lot of time to patch what will be published,” the post warned.
GitHub terminated the account on May 23. Within hours, Nightmare Eclipse migrated to GitLab and continued posting. GitLab banned the account on May 26, three days later. Both platforms wiped all repositories. The bans had an immediate side effect: multiple users had already cloned the exploits and rehosted them across other platforms. The code is not going away.
Following the bans, Nightmare Eclipse threatened further releases and pointed to July 14 as a potential next date. “I will make sure your bones are shattered that day.” The researcher also warned that “recent actions made me take the difficult decision to drag other companies into this.”
Three of the six exploits remain unpatched. YellowKey has a mitigation but no full patch until June 9 Patch Tuesday. GreenPlasma has no CVE and no patch timeline. MiniPlasma exploits a flaw Microsoft has apparently left unaddressed since 2020. Federal agencies are under CISA mandate to patch the Defender flaws by June 3.
The vulnerability disclosure ecosystem has no good answer for this scenario. A motivated researcher with working zero-day code can publish to a global audience in minutes. Platform bans just scatter the code further. Legal threats from Microsoft add a new dimension but do not retroactively unpublish exploit code that has already been cloned. Nightmare Eclipse is becoming something of a folk hero among researchers who feel tech companies mistreat vulnerability disclosers, which makes the situation harder to de-escalate, not easier.
Sources: BleepingComputer, Cybernews, SecurityWeek, Hackread, CISA KEV catalog