Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal
Microsoft defended coordinated disclosure after a researcher published multiple Windows zero-days, some now seen exploited in the wild.
Intelligence analysis by GPT-5.4 Mini
Microsoft says public zero-day dumps left customers at unnecessary risk and forced its teams into around-the-clock response. The dispute followed a researcher’s disclosures, GitHub account removal, and reports that some flaws are already being exploited.
A security researcher found a bunch of weak spots in Windows and shared them in public. Microsoft says that is risky because bad people can copy the details before everyone is protected.
Think of it like finding a hole in a fence. If the finder tells the fence owner first, the hole can be fixed. If the hole is shouted about on a street corner, more people may try to climb through it before the repair is done.
The story also says some of the weak spots are already being used by attackers. That is why this matters: once a bad trick is public, the race to patch it becomes much more urgent.
Analysis
What Microsoft is arguing
Microsoft says it strongly supports coordinated vulnerability disclosure, where researchers privately share findings first so vendors can assess impact and ship fixes before details go public. In this case, the company said several zero-days were disclosed publicly without first being shared with Microsoft, which it says put customers at unnecessary risk.
What was disclosed
The article says the researcher Chaotic Eclipse, also known as Nightmare-Eclipse, released details over the past month about multiple Windows-related flaws affecting components such as Defender and BitLocker. The named vulnerabilities include BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, and MiniPlasma. Microsoft said it worked "around the clock" to understand the impact, protect customers, and build updates.
The story also says BlueHammer, RedSun, and UnDefend are now under active exploitation in the wild. That makes the disclosure dispute more than a policy argument: once exploit code is available, attackers can move quickly, especially against systems that have not yet been patched.
Fallout
According to the article, GitHub removed the researcher’s account after the disclosures, and a later account was also blocked. The researcher responded angrily in a public post and claimed they intended to release something on July 14, 2026, that would escalate the conflict further. Microsoft, meanwhile, framed the issue as one of protecting users and keeping security research productive through dialogue rather than surprise public drops.
Key points
- Microsoft said it supports coordinated vulnerability disclosure and opposed public release of unshared zero-day details.
- The article says multiple Windows flaws were disclosed, including issues affecting Defender and BitLocker.
- Microsoft said BlueHammer, RedSun, and UnDefend are already being exploited in the wild.
- GitHub reportedly removed the researcher’s account after the disclosures, and a later account was also blocked.
- The dispute highlights the risk that public exploit details can accelerate real-world attacks before fixes land.
