Microsoft Backs Down on Threats Against Zero-Day Researcher

Microsoft just backed off threatening a security researcher with law enforcement over six Windows zero-day drops. The cybersec community pushed back hard, and Microsoft retreated. The July 14th threat from the researcher is still on the calendar. The researcher posts as Nightmare-Eclipse on GitHub and Chaotic Eclipse on their blog. Between April 3rd and May 17th they published proof-of-concept exploits for six Windows zero-days: BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, and MiniPlasma. Microsoft has patched three: BlueHammer in April, then RedSun and UnDefend in the May 21st Defender update. YellowKey has a workaround but no full patch. GreenPlasma and MiniPlasma are still unfixed. On May 27th, Microsoft's Security Response Center published a blog post titled "A shared responsibility." It names all six vulnerabilities and accuses the researcher of skipping advance disclosure, putting customers at unnecessary risk. Microsoft said its Digital Crimes Unit would pursue actors weaponizing the exploits and "those that enable their criminal activity," putting the researcher squarely in scope. GitHub, which Microsoft owns, banned the researcher's account around May 23rd. GitLab suspended them on May 26th. The Register reported Microsoft had gone to law enforcement. In a signed post, the researcher said MSRC dismissed their bug report and humiliated them, and threatened another drop on July 14th — July's Patch Tuesday — saying "I will make sure your bones are shattered that day." TechCrunch reported the wider security research community pushed back, with many researchers citing similar bad experiences with MSRC. Microsoft then issued a follow-up statement: "We have no intention to pursue action against individuals conducting or publishing their security research." Microsoft also acknowledged that "some interactions have fallen short." The July 14th threat remains. Sources: https://www.microsoft.com/en-us/msrc/blog/2026/05/a-shared-responsibility-protecting-customers-through-coordinated-vulnerability-disclosure https://therecord.media/microsoft-says-it-will-not-pursue-security-researchers-disclosure https://www.theregister.com/security/2026/05/28/microsoft-0-day-feud-escalates-as-researcher-threatens-another-windows-exploit-dump/5248085 https://techcrunch.com/2026/05/29/microsoft-under-fire-for-threatening-security-researcher-with-criminal-investigation/ https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-mitigation-for-yellowkey-windows-zero-day/ https://cybernews.com/security/microsoft-responds-to-nightmare-eclipse-zero-days/ More on cybersecurity, privacy, scams, and homelab on Hake Hardware. New shorts every weekday. #cybersecurity #microsoft #zeroday #windows #infosec