Microsoft condemns uncoordinated Windows zero-day releases, researcher threatens further disclosures

Summary

Microsoft has responded to a campaign of uncoordinated Windows zero-day vulnerability releases by a pseudonymous researcher known as Nightmare Eclipse, calling such disclosures "never justifiable" and hinting at potential legal action. The researcher published multiple zero-day exploits with working proof-of-concept code on GitHub (a Microsoft-owned platform) starting in April, making them available to both attackers and defenders. Microsoft condemned the practice, arguing it enables cybercrime, while the researcher threatened to release more vulnerabilities. The incident highlights ongoing tensions between security researchers and software vendors over responsible disclosure practices.