Safety researcher Nightmare Eclipse has dropped a contemporary zero-day exploit resulting in privilege escalation on Home windows.
Also called Chaotic Eclipse, the disgruntled researcher launched a number of zero-day exploits focusing on Microsoft merchandise over the previous a number of months, often proper after the Patch Tuesday safety updates.
Proper on cue, the brand new proof-of-concept (PoC) exploit, dubbed ShieldBreak, was revealed on August 2026 Patch Tuesday. It targets a vulnerability in Microsoft Defender, permitting any consumer to achieve System privileges.
In line with Nightmare Eclipse, the exploit is a RoguePlanet patch bypass, works on the newest Home windows 11 variations and on Home windows Server 2025, and certain impacts Home windows 10 machines as properly.
Tracked as CVE-2026-50656, RoguePlanet is a race situation flaw in Defender that Nightmare Eclipse dropped as a zero-day on June 9. Microsoft acknowledged the exploit on June 16 and released fixes for it on July 9.
Per the analysis of Tharros Labs’s Will Dormann, ShieldBreak includes organising a brief listing registered as a Cloud Sync supplier, planting an EICAR file, controlling Defender’s scan path to System32, utilizing Home windows’ CLFS to swap the id file and hydration knowledge to a ‘phoneinfo.dll’ file in System32, then operating the QueueReporting scheduled activity.
“Within the wer.dll code, there may be express code to load phoneinfo.dll [which does not exist by default in Windows]. As a result of at this level, phoneinfo.dll exists and is our personal code, this runs, spawning conhost.exe with SYSTEM privileges,” Dormann says.
Each Dormann and cybersecurity professional Kevin Beaumont, who published detection queries for the contemporary PoC, disagree with Nightmare Eclipse’s assertion that ShieldBreak is a RoguePlanet bypass, as they work otherwise.
“RoguePlanet was a filesystem race situation vuln that makes use of digital disks and NT native file manipulation to trick the quarantine course of into overwriting system recordsdata. ShieldBreak user-mode callback hook to alter file contents throughout a Defender cloud-hydration scan by way of cfapi (Cloud Filter API),” Beaumont said.
Dormann additionally factors out that “ShieldBreak appears to require Defender to be energetic to work,” whereas RoguePlanet didn’t.
Associated: SharePoint Vulnerability Exploited Shortly After PoC Release
Associated: Chipmaker Patch Tuesday: Intel, AMD Fix Over 80 Vulnerabilities Combined
Associated: Fresh Windows Zero-Day Exploited in North Korean Cyberattacks
Associated: Ivanti EPM Update Patches Remotely Exploitable Flaws
