Informa TechTarget | SearchSecurity Cybersecurity Dive InformationWeek Channel Dive Explore our brands An Informa TechTarget Publication Dark Reading Resource Library Black Hat News Omdia Cybersecurity Advertise Newsletter Sign-Up Newsletter Sign-Up Cybersecurity Topics Related Topics Application Security Cybersecurity Careers Cloud Security Cyber Risk Cyberattacks & Data Breaches Cybersecurity Analytics Cybersecurity Operations Data Privacy Endpoint Security ICS/OT Security Identity & Access Mgmt Security Insider Threats IoT Mobile Security Perimeter Physical Security Remote Workforce Threat Intelligence Vulnerabilities & Threats Recent in Cybersecurity Topics Cyber Risk Anthropic to Open Mythos AI to EU's ENISA Anthropic to Open Mythos AI to EU's ENISA by Jai Vijayan Jun 1, 2026 4 Min Read Application Security Microsoft's Zero-Day Legal Threats Spark Backlash Microsoft's Zero-Day Legal Threats Spark Backlash by Rob Wright Jun 1, 2026 5 Min Read World Related Topics DR Global Middle East & Africa Asia Pacific Latin America See All The Edge DR Technology Events Related Topics Upcoming Events Podcasts Webinars SEE ALL Resources Related Topics Resource Library White Papers Reports Webinars Newsletters Podcasts Heard It From a CISO Reporters' Notebook Dark Reading's 20th Videos Dark Reading Polls Partner Perspectives Meet the Editors Advertise With Us About Us Dark Reading Resource Library Application Security Cyber Risk Cybersecurity Operations Vulnerabilities & Threats News Microsoft's Zero-Day Legal Threats Spark Backlash After a disgruntled security researcher published several zero-day exploits in recent weeks, Microsoft seemingly indicated criminal charges were in order. Rob Wright , Senior News Director , Dark Reading June 1, 2026 5 Min Read Source: Drew Angerer via Getty Images Microsoft is facing an onslaught of criticism from the cybersecurity community after the company said it would seek criminal prosecution against a disgruntled security researcher who published several zero-day exploits in recent weeks. In a blog post last week, the Microsoft Security Response Center (MSRC) addressed the recent flurry of zero-day vulnerabilities and exploits published by an anonymous researcher who goes by "Chaotic-Eclipse" or "Nightmare-Eclipse." It started in early April, when the researcher published a proof-of-concept (PoC) exploit on GitHub for " BlueHammer, " a privilege-escalation flaw in Windows Defender tracked as CVE-2026-33825. "I was not bluffing Microsoft and I'm doing it again," Nightmare-Eclipse wrote on their blog at the time. The researcher then followed through on their threat later that month and published exploits for two other vulnerabilities, dubbed "RedSun" and "Undefend," which along with BlueHammer were quickly exploited in the wild by threat actors . In a series of blog posts, Nightmare-Eclipse slammed MSRC's response to the reported bugs, claiming Microsoft refused to address them. Related: Agentic AI Isn't Risky; the Way Orgs Deploy It Is Nightmare-Eclipse continued publishing zero-days this month too, with exploits for vulnerabilities known as "YellowKey," "GreenPlasma," and "MiniPlasma." Apparently fed up, in a blog post on Wednesday, MSRC said the six vulnerabilities "were not responsibly disclosed," and condemned the researcher's actions. "Uncoordinated disclosures that put proof-of-concept code for unpatched vulnerabilities into the hands of bad actors are never justifiable and have real-world consequences," MSRC said in the post . "Our Digital Crimes Unit will continue bringing cases against these actors and those that enable their criminal activity — coordinating as needed with law enforcement around the world." That last part was widely viewed by infosec professionals across the board as Microsoft threatening to pursue criminal charges against Nightmare-Eclipse, as well as other researchers who publish zero-days. And unsurprisingly, it did not go over well with the security research community. Cybersecurity Experts Take Issue With MSRC Post Many infosec professionals took to social media to call out Microsoft's response to Nightmare-Eclipse. Katie Moussouris, founder and CEO of Luta Security and pioneer in vulnerability disclosure programs, said in a post on social media platform BlueSky that publishing zero-days "isn't the worst thing a researcher can do," and that non-disclosure of vulnerabilities is far worse. Related: Feeding Frenzy: 'Megalodon' Malware Infects Thousands of GitHub Repos And "what drives researchers toward non-disclosure? Threats from vendors," said Moussouris. Concealing vulnerabilities carries considerable risk, because instead of giving the vendors an opportunity to fix the flaw, it leaves open the possibility of threat actors independently discovering the bug and covertly exploiting it. Disgruntled researchers may also opt to sell their findings to zero-day brokers , spyware companies, or cybercriminal groups for a profit. BugCrowd founder Casey John Ellis tells Dark Reading that while the situation with Nightmare-Eclipse is complicated, Microsoft's decision to threaten a researcher with criminal prosecution was "an insanely myopic move, especially after all of the investment they've made into presenting a secure, transparent, and research-friendly face to the market." Andrew Case, director of threat research at Volexity, said in an X post that by publishing the blog post, MSRC "decided to kill off all the goodwill it has built up over the last decade." And VX-Underground, a research community focused on malware analysis, echoed that sentiment in its own X post last week. "I think Microsoft has really pissed off security researchers and we're approaching the tipping point," VX-Underground said in the post . Related: Shai-Hulud Hackers TeamPCP: Lucky or Skilled? Infosec professionals also took to social media to vent about their own negative experiences with MSRC in the past. For example, Gabriel Landau, security researcher and former principal software engineer at Elastic, wrote a lengthy post on X about a frustrating encounter in which he reported a Microsoft Device Guard bypass. Even though the software giant patched the flaw in a Patch Tuesday update, Landau said he was told by Microsoft that it did meet its threshold for serving and the company didn't issue a CVE for the vulnerability. "The interaction left such a bad taste in my mouth that I don’t really feel like interacting with them again," he wrote. Microsoft clearly got the message after the backlash: The company issued a statement Sunday night on X that walked back the hardline approach of the blog post. "To be clear about our approach to legal matters, we have no intention to pursue action against individuals conducting or publishing their security research," Microsoft said. "When an individual breaks the law and engages in malicious activity causing real harm to our customers, we will work with law enforcement as appropriate." Is AI Putting a Strain on the Vulnerability Reporting Process? The Nightmare-Eclipse episode comes at a time when many vendors and open source organizations are drowning under waves of " AI slop " — bad bug reports with faulty PoCs that were seemingly created through large language models (LLMs). Additionally, new frontier models like Anthropic's Mythos and OpenAI's Daybreak have experts predicting an exploit storm of new flaws discovered through AI. Ellis says AI is "certainly" contributing to the frustrations between researchers and vendors these days. "We're in the middle of the slopdemic right now, but we're also in a place where it is legitimately easier to find vulnerabilities — and the reality is that there is still a lot of vulnerable code out there," he says. "I see the main symptom that we're dealing with here as triage stress, and the baby is at risk of getting thrown out with the bathwater." Meanwhile, Microsoft customers could be facing additional risks from more zero-day drops. On Friday, Nightmare-Eclipse announced on their blog that several other researchers had contacted them and "literally gave me free vulnerabilities," which they indicated would be published in the future. A week earlier, Nightmare-Eclipse published a cryptic post in which they accused Microsoft of humiliating and defaming them and swore retribution. "Mark this date July 14th, I will make sure your bones are shattered that day," the researcher wrote. Dark Reading contacted Microsoft for comment, but the company declined to comment further. About the Author Rob Wright Senior News Director, Dark Reading Rob Wright is a longtime reporter with more than 25 years of experience as a technology journalist. Prior to joining Dark Reading as senior news director, he spent more than a decade at TechTarget's SearchSecurity in various roles, including senior news director, executive editor and editorial director. Before that, he worked for several years at CRN, Tom's Hardware Guide, and VARBusiness Magazine covering a variety of technology beats and trends. Prior to becoming a technology journalist in 2000, he worked as a weekly and daily newspaper reporter in Virginia, where he won three Virginia Press Association awards in 1998 and 1999. At TechTarget and Dark Reading, he has won several Azbee awards, including the 2026 National Silver Award for a series on vibe coding. At Dark Reading, Rob currently covers security operations, cloud security, and Internet infrastructure. He has a keen interest in malvertising activity and the certificate authority industry, and has written extensively on both topics. He graduated from the University of Richmond in 1997 with a degree in journalism and English. A native of Massachusetts, he lives in the Boston area. See more from Rob Wright Want more Dark Reading stories in your Google search results? Add Us Now More Insights Industry Reports How Organizations Are Managing Incident Response How Enterprises Are Developing Secure Applications Inside RSAC 2026: secur