Locked in heated rivalry with researcher, Microsoft fixes 0-day they disclosed
A separate zero-day also disclosed by Nightmare Eclipse appears to be patched as well.
A separate zero-day also disclosed by Nightmare Eclipse appears to be patched as well. This report comes from Ars Technica. The story centres on Lock
Read Full Story at Ars Technica →Why This Matters
The escalating tension between Microsoft and security researchers over zero-day disclosures has now spilled into a public race to patch vulnerabilities before they’re weaponized. This incident underscores how the disclosure process—already a delicate balance between transparency and risk—can fracture when rivalries between industry and independent researchers take center stage.
Background Context
Zero-day vulnerabilities are prized commodities in both cybersecurity and cybercrime, with nation-state actors often exploiting them before patches are available. The rivalry between Microsoft and Nightmare Eclipse suggests a shift toward more adversarial disclosure practices, where researchers may push for quicker fixes—or public shaming—to pressure vendors into action.
What Happens Next
The patching of these vulnerabilities marks a temporary reprieve, but the underlying tension between researchers and vendors could intensify. Observers should watch whether Microsoft formalizes a more transparent disclosure policy—or if Nightmare Eclipse escalates tactics, such as releasing partial details to force Microsoft’s hand.
Bigger Picture
This episode reflects a growing trend of researchers bypassing traditional disclosure channels, opting for public pressure when they feel vendors move too slowly. It also highlights the increasing role of independent researchers in shaping security standards, even as corporate giants resist perceived encroachment on their timelines.
