Story perspectives

Microsoft Threatens Lawsuit Over Six Defender, BitLocker Flaws

5/31/2026

Summary

Microsoft Threatens Lawsuit

Microsoft threatened legal action against researcher Nightmare Eclipse after he disclosed six vulnerabilities.
Vulnerabilities—RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma and MiniPlasma—affect Windows Defender and BitLocker.
Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA) say some flaws have already been used in real-world attacks.
The Digital Crimes Unit warned it will pursue civil and criminal cases.
Security researchers Katie Moussouris and Kevin Beaumont said Microsoft’s approach could chill bug reporting.

Summary

Microsoft Hires Hackers

Microsoft hired researchers who admitted selling exploits to Russia and Iran despite prior hacking convictions.
After the disclosures, Microsoft removed Nightmare Eclipse from GitHub and GitLab, disabled his portal account, and posted his details on Twitter.
Analysts link Microsoft’s large market cap and earnings pressure to security shortcuts, while former senior analyst Kevin Beaumont says the firm’s threat to criminalize non-conformity with its “responsible disclosure” policy may be legally untenable.

Summary

Microsoft Patches Zero-Days

Microsoft released patches for six zero-day flaws within days of disclosure.
CISA added the CVEs—BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), YellowKey (CVE-2026-45585), GreenPlasma and MiniPlasma—to its Exploited Vulnerabilities catalog.
Three exploits grant SYSTEM-level escalation, while the other three bypass BitLocker encryption.
The flaws were disclosed between April and mid-May 2026, with code posted on GitHub and GitLab before the accounts were disabled, and CVEs were assigned in a six-week cadence.

History

Historical Context

After the Blaster worm began spreading on August 11 2003, Microsoft issued emergency patches and the CERT/CC warned of the RPC vulnerability, reporting more than 400,000 infections by August 15. The outbreak prompted Microsoft to release a stand-alone removal tool in January 2004. The episode still shapes Microsoft’s approach to security research, as seen in today’s dispute with researcher Nightmare Eclipse.

1 of 4

Microsoft Threatens Lawsuit

Microsoft threatened legal action against researcher Nightmare Eclipse after he disclosed six vulnerabilities.
Vulnerabilities—RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma and MiniPlasma—affect Windows Defender and BitLocker.
Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA) say some flaws have already been used in real-world attacks.
The Digital Crimes Unit warned it will pursue civil and criminal cases.
Security researchers Katie Moussouris and Kevin Beaumont said Microsoft’s approach could chill bug reporting.

1 / 4