- Microsoft advocates for Coordinated Vulnerability Disclosure (CVD) following the uncoordinated public release of multiple Windows zero-days.
- A researcher disclosed six high-severity vulnerabilities, including three already being exploited, after a reported breakdown in communication with Microsoft.
- The tech giant stated these disclosures put customers at “unnecessary risk” and its teams worked “around the clock” on patches.
- GitHub removed the researcher’s account, and the subsequent GitLab account was also blocked, escalating the conflict.
- The researcher, Chaotic Eclipse, has promised a further release on July 14, 2026, in retaliation.
In late May 2026, Microsoft publicly reaffirmed its stance on Coordinated Vulnerability Disclosure (CVD) following a contentious series of zero-day releases. This call to action came after a security researcher, Chaotic Eclipse, publicly disclosed several critical vulnerabilities affecting Windows components.
The researcher cited a complete breakdown in Microsoft’s handling of the disclosure process as the reason for the public releases. Microsoft responded firmly in a blog post, opposing the uncoordinated approach and stating the disclosures created “unnecessary risk.”
The vulnerabilities, including BlueHammer and RedSun, were detailed in previous reports. Consequently, three of the six flaws are now under active exploitation in the wild.
Meanwhile, the conflict escalated as GitHub removed the researcher’s account containing the exploit code. Although the code was re-uploaded to a new GitLab account, it was subsequently blocked as well.
The researcher, in a recent post, accused Microsoft of defamation and escalating the conflict. They stated, “Now you take the courtesy to flag my GitHub account and wipe it out of the public, just like that?”
Furthermore, the researcher announced an intention to release something significant on July 14, 2026. They ominously promised it “will make sure your bones are shattered that day.”
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
