Disgruntled 0-day hunter 'humiliated' by Microsoft pledges 'bone shattering drop' as Redmond calls cops

A security researcher released six Windows zero-days and promised a major drop on July 14. Microsoft responded with a blog stating that none of the bugs—RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma—were reported through official channels before becoming public. Attackers began exploiting BlueHammer, RedSun, and UnDefend soon after working proof-of-concept exploit code was published on now-banned GitHub and GitLab accounts. YellowKey, GreenPlasma, and MiniPlasma still lack fixes. Microsoft assessed exploitation as more likely for YellowKey because a working proof-of-concept exists. Microsoft opposed uncoordinated disclosure and warned that such actions can harm customers and the digital ecosystem, while its Digital Crimes Unit would pursue cases and coordinate with law enforcement as needed.

"Microsoft, for its part, finally responded to the security researcher and their weaponized Windows flaws with a blog post on (un)coordinated vulnerability disclosure about the now-public bugs: RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma. Redmond says that none of these were reported via its official channels prior to being made public."

"Attackers began hammering three of the six - BlueHammer, RedSun, and UnDefend - soon after Nightmare published working proof-of-concept exploit code for each on now-banned GitHub (owned by Microsoft) and GitLab accounts. YellowKey, GreenPlasma, and MiniPlasma still don't have fixes, and Microsoft has deemed "exploitation more likely" for YellowKey, aka CVE-2026-45585, citing a working POC."

""We remain firmly opposed to these actions, and any disclosure outside proper coordination that could harm our customers and the digital ecosystem," Microsoft wrote in a Wednesday blog, and then seemingly threatened legal action against Nightmare: "Uncoordinated disclosures that put proof-of-concept code for unpatched vulnerabilities into the hands of bad actors are never justifiable and have real-world consequences.""

""Our security teams across the company work tirelessly tracking threat actors who look for weaknesses just like these to attack Microsoft and our customers. Our Digital Crimes Unit will continue bringing cases against these actors and those that enable their criminal activity - coordinating as needed with law enforcement around the world.""

Read at theregister