Microsoft has revised its legal strategy regarding the independent security researcher known as Nightmare Eclipse. Following widespread negative feedback from the global cybersecurity community, the company removed recent statements that had equated uncoordinated vulnerability disclosures with malicious intent. This move aims to improve relations with external threat analysts and security experts, who play a crucial role in today’s software protection ecosystems.

Course of the Conflict

The conflict began after Nightmare Eclipse published working proof-of-concept code for several critical Windows vulnerabilities, bypassing traditional corporate reporting channels. The campaign involved zero-day vulnerabilities in core security systems, including privilege escalation chains like BlueHammer (CVE-2026-33825), as well as the RedSun tool designed to evade Microsoft Defender. Microsoft’s initial response included legal threats from its Digital Crimes Unit and mass account bans on code-sharing platforms such as GitHub and GitLab. These actions drew widespread criticism from corporate security professionals, who warned that such policies could weaken defenses and increase network vulnerabilities.

Changes in Vulnerability Disclosure Policy

In its latest policy update, Microsoft announced it would not pursue legal action against individuals engaged in legitimate vulnerability research. The company has dropped the term “responsible disclosure” from its official communications and returned to the classic “coordinated vulnerability disclosure” model. Microsoft also acknowledged that some recent automated bans on platforms did not meet professional community standards and promised to engage more constructively with researchers in the future.

Ongoing Threats and New Exploits

Despite the policy shift, the main architectural threat vector remains unresolved. Nightmare Eclipse has ignored Microsoft’s attempts at dialogue and stated that several independent exploit developers are now directly providing him with unpatched vulnerabilities, completely bypassing corporate reporting channels. The researcher has already announced the upcoming release of a June exploit targeting legacy vulnerabilities in the Secure Boot lifecycle. It is claimed that the new code will allow full circumvention of BitLocker hardware encryption on virtual machines before the so-called “summer retribution” deadline.