Windows Zero Day Exploits Released
Four days apart, two separate Windows zero-days surfaced publicly with proof-of-concept code already in the wild. The first, reported on May 13th, targets BitLocker — Microsoft's full-disk encryption feature that millions of organisations and individuals rely on precisely because it is supposed to make a stolen or compromised drive unreadable. The PoC demonstrates that the protection can be bypassed, meaning encrypted drives can be accessed without authorisation. Then, on May 17th, a second exploit emerged under the name MiniPlasma, this one delivering something even more blunt: SYSTEM-level access on Windows machines. SYSTEM is the highest privilege tier on a Windows device. That is not a foothold. That is the keys to the building.
If confirmed, here is what this means. Two unpatched, publicly available exploits targeting Windows in the same week represents a compounding problem — not just in the technical sense but in the defensive arithmetic organisations have to run. The BitLocker bypass alone undermines a foundational assumption of device security posture: that physical or remote access to a drive does not automatically mean data exposure. Enterprises running BitLocker as their primary data-at-rest protection will need to reassess that assumption immediately. The MiniPlasma exploit is the more acute operational threat. Proof-of-concept code for SYSTEM-level privilege escalation does not stay in researcher hands for long — it migrates to threat actor toolkits, ransomware operators, and nation-state groups with reliable speed. Any environment running unpatched Windows is now a more attractive target than it was a week ago. The combination of both vulnerabilities creates an attack chain that is straightforward to describe: bypass disk encryption to extract data, escalate to SYSTEM to persist and move laterally. That is a complete compromise story told in two steps.
Watch for a Microsoft out-of-band security advisory or emergency patch release — if Redmond moves outside its regular Patch Tuesday cycle, that confirms the severity is being taken seriously at the highest level. Equally telling would be any credible reporting of these exploits being used in active attacks rather than just researcher demonstrations.
Chaotic Eclipse, the security researcher behind the recently disclosed Windows flaws, YellowKey and GreenPlasma, has released a proof-of-concept (PoC) for a Windows privilege
An anonymous cybersecurity researcher who disclosed three Microsoft Defender vulnerabilities has returned with two more zero-days involving a BitLocker bypass and a privilege
A security researcher using the "Nightmare Eclipse" handle has released a Windows zero-day exploit dubbed LegacyHive that allows attackers to escalate privileges on up-to-date
Security researcher Chaotic Eclipse (aka Nightmare-Eclipse and MSNightmare) has released a new Windows BitLocker bypass dubbed GreatXML, a day after they published an exploit for
<a href="https://news.ycombinator.com/item?id=48168856">Comments</a>
An anonymous security researcher who uses the "Nightmare Eclipse" handle released a CrowdStrike Falcon zero-day exploit named "FalconFlank" that lets attackers escalate privileges
Microsoft has released security updates for a Defender vulnerability known as RoguePlanet, nearly a month after details of the flaw became public. The vulnerability, tracked as
Proof-of-concept (PoC) exploit code has now been released for a recently patched security flaw in the Linux kernel that could allow for local privilege escalation (LPE). Dubbed
NewsHive monitors these sources continuously. All signal titles above link to the original reporting.
Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →