Researcher Discloses Windows Flaws, Sparks Microsoft Feud

A security researcher has publicly released details for six previously unknown vulnerabilities in core Microsoft Windows components over the past month, a campaign that has escalated into a public feud and left enterprise customers exposed to active cyberattacks. The researcher, who uses the pseudonyms Nightmare Eclipse and Chaotic Eclipse, published proof-of-concept exploit code for the flaws without first notifying Microsoft, a practice the company has condemned as irresponsible.

The vulnerabilities, named BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, and MiniPlasma, affect critical security features including Windows Defender and BitLocker encryption. According to Microsoft, three of the flaws—BlueHammer, RedSun, and UnDefend—have already been exploited in real-world intrusions following their public release. The U.S. Cybersecurity and Infrastructure Security Agency has added these three to its catalog of known exploited vulnerabilities. Patches have been issued for some of the vulnerabilities, but others, including YellowKey, GreenPlasma, and MiniPlasma, remained unpatched as of late May.

Microsoft responded publicly this week, stating that its security teams have...