The Register - Security • 4w
Microsoft Conflict with Nightmare Eclipse: Vulnerability Disclosure and Legal Retaliation
A breakdown in communication between Microsoft’s Security Response Center (MSRC) and researcher "Nightmare Eclipse" escalated into the uncoordinated public release of zero-day vulnerabilities, including CVE-2026-45585 and other unpatched system-level exploits. The incident involved the dissemination of Proof-of-Concept (PoC) code and AI-generated malicious payloads, bypassing the standard Coordinated Vulnerability Disclosure (CVD) process. This conflict highlights a critical friction point between vendor patching rhythms and AI-accelerated discovery, while Microsoft's initial implication of criminal investigations sparked an industry-wide debate over the legal risks faced by independent security researchers.