Nightmare Eclipse on HackingPassion.com : root@HackingPassion.com-[~]

LegacyHive Reopens a Windows Privilege Hole Microsoft Closed 11 Years Ago

Sun, 19 Jul 2026 12:01:44 +0200

For weeks he promised that July 14 would shatter Microsoft’s bones. Patch Tuesday came, Microsoft closed a record 622 holes, and hours later he dropped LegacyHive, a Windows zero-day that lets a normal user break into the administrator’s account. No patch, no CVE yet, and far quieter than he promised. 🧐

If you have followed my posts this year, you know who this is. Nightmare-Eclipse, the researcher who has spent 2026 dropping working Windows exploits on Microsoft after what he says was the company taking his credit and paying him nothing for it. Microsoft did delete the account he reported bugs through. I laid out that full story when the count first hit six, so this post stays on the new bug.

GreatXML Turns Windows Defender's Offline Scan Into a BitLocker Bypass

Fri, 12 Jun 2026 10:51:38 +0200

Nightmare-Eclipse is back again, this time with a BitLocker bypass called GreatXML that runs straight through Microsoft’s own antivirus. On a Windows machine that has run a Defender offline scan even once, the recovery mode hands over a command shell with full access to the encrypted drive, while BitLocker still reports the disk as locked and protected. Microsoft has no patch for it. He published GreatXML the day after RoguePlanet, right after the June Patch Tuesday where Microsoft had just fixed his first BitLocker bypass, the largest Patch Tuesday yet at close to 200 fixes in a single day.

RoguePlanet Windows Defender Zero Day Hands Any User Full SYSTEM Control

Wed, 10 Jun 2026 12:01:36 +0200

Nightmare-Eclipse is back, with a new exploit called RoguePlanet. Windows 10 and 11 have a new zero-day that lets a user with no rights take complete control of a fully updated machine, and Microsoft has no patch for it. He dropped it on Patch Tuesday, June 9th, a few hours after Microsoft shipped its largest Patch Tuesday yet, nearly 200 fixes in a single day.

Some of those fixes closed his own earlier bugs. So while Microsoft was busy sealing the gaps he had already found, he opened a new one in public. For weeks he had been vague about whether anything was coming in June, switching between yes and no, and then he just did it.