Microsoft is threatening criminal referrals and legal action against an independent security researcher who publicly disclosed a series of unpatched vulnerabilities in its products, reigniting a long-running debate over researcher responsibilities and corporate accountability in cybersecurity.
On Wednesday, May 29, 2026, Microsoft published a blog post criticizing the researcher, known by the handle “Nightmare Eclipse,” for releasing details of three bugs — BlueHammer, RedSun UnDefend, and YellowKey — along with code to exploit them. The flaws affected Windows Defender, Microsoft’s built-in antivirus engine, and BitLocker, its disk-encryption tool. Microsoft’s Digital Crimes Unit, which handles civil legal actions, criminal referrals, and law enforcement coordination, was cited in the post as a vehicle for pursuing action against the researcher.
Microsoft’s central complaint is that Nightmare Eclipse did not attempt to report the bugs privately before publishing them, bypassing the coordinated disclosure process that allows companies to issue patches before vulnerabilities become public. Some of the disclosed flaws have since been exploited in real-world attacks, according to both Microsoft and the U.S. cybersecurity agency CISA. Nightmare Eclipse, however, claims to have contacted Microsoft previously, alleging the company revoked access to their Microsoft Security Response Center account — the portal used to report vulnerabilities — leaving them with no official channel to report the bugs.
The researcher’s accounts on GitHub and GitLab, where the bugs were published, have since been banned. Neither Nightmare Eclipse nor Microsoft responded to requests for comment.
The dispute has drawn sharp criticism from cybersecurity professionals. Katie Moussouris, founder of Luta Security and a former Microsoft employee who helped establish the company’s bug bounty program, told TechCrunch that Microsoft’s threat of prosecution “will only result in security researchers distrusting Microsoft” and may create a chilling effect that reduces vulnerability reporting, making software less secure overall. Security researcher and former Microsoft employee Kevin Beaumont called the company’s stance “a dumpster fire of its own making,” arguing that framing proof-of-concept exploit distribution as criminal activity sets a troubling precedent.
Source: TechCrunch