Technology and Science12 August, 20263 min read
Nightmare Eclipse Releases ShieldBreak Windows Defender Zero-Day, Bypassing Microsoft RoguePlanet Fix
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Nightmare Eclipse released ShieldBreak, a Windows Defender zero-day that bypasses the RoguePlanet patch. It enables SYSTEM-level privileges despite Microsoft August 2026 Patch Tuesday fix.
ShieldBreak bypasses patch
A security researcher known as Nightmare Eclipse, also tracked as Chaotic Eclipse, has released a new Windows Defender zero-day exploit called ShieldBreak that it says can bypass Microsoft’s fix for RoguePlanet and let an attacker escalate to the highest “system” level. PCMag Australia reported that on Tuesday Nightmare Eclipse announced “ShieldBreak,” describing it as a zero-day vulnerability, and said the proof-of-concept code can exploit the bug in Windows Defender in Windows 11 25H2 and Windows Server 2025. TechCrunch said ShieldBreak is the latest disclosure by Nightmare Eclipse and that a successful attack allows hackers to escalate permissions from a low-level user to full access to the device and its data, even though Microsoft has not yet released a patch for ShieldBreak.
Will Dormann verified that the bug works and that Windows Defender must be enabled for the exploit to work, according to TechCrunch, while PCMag Australia said two security researchers, Will Dormann and Kevin Beaumont, tried the proof-of-concept code and said it works. PCMag Australia also said ShieldBreak arrives after Nightmare Eclipse disclosed a separate privilege escalation flaw called Rogue Planet in June and that about a week later Microsoft patched the threat, which Nightmare Eclipse now claims it has effectively circumvented through ShieldBreak.
Legal threats and validation
The dispute between Microsoft and Nightmare Eclipse has included legal warnings, with PCMag Australia quoting Microsoft’s tweet: "To be clear about our approach to legal matters, we have no intention to pursue action against individuals conducting or publishing their security research." PCMag Australia said Microsoft dialed back its original threat following backlash from the cybersecurity community, while TechCrunch described the earlier legal threat as coming weeks before ShieldBreak’s publication. Kevin Beaumont said the result “gets you SYSTEM privileges from any user account,” and PCMag Australia reported that he added “I've tried it, it works on the latest Windows 11.”
TechCrunch reported that a spokesperson for Microsoft did not immediately comment when contacted by TechCrunch, and that the bug is considered a zero-day because Microsoft was given no time to patch before public disclosure. TechCrunch also framed ShieldBreak as requiring the user to run the proof-of-concept exploit app, while PCMag Australia said the vulnerability can’t remotely hack a Windows PC and instead can let an attacker who already has access elevate privileges.
What’s at risk next
The published claims center on Defender’s remediation gap for RoguePlanet, with TechCrunch saying Microsoft rolled out a patch for RoguePlanet but that the researcher implied the fix was not sufficient and that ShieldBreak demonstrates a full bypass. PCMag Australia reported that ShieldBreak can exploit the bug in Windows Defender in Windows 11 25H2 and Windows Server 2025, and that Defender needs to be enabled for the proof-of-concept to work. TechCrunch said ShieldBreak works on Windows 10, Windows 11 (including the latest 25H2 version), and Windows Server 2025, and it described the exploit as a way for hackers to gain system-wide access to the user’s device and data.
PCMag Australia added that the big question is whether Microsoft will retaliate against Nightmare Eclipse, who also discovered another zero-day privilege escalation flaw called BlueHammer, while TechCrunch said ShieldBreak lands a day after Microsoft’s regularly scheduled monthly security patch releases, dubbed Patch Tuesday. With no patch for ShieldBreak yet, the immediate consequence described by TechCrunch is that organizations running Defender on affected Windows versions may face a new local privilege escalation path, even as Microsoft has not responded to a request for comment in PCMag Australia’s account.