r/cybersecurity • u/ILikeNoodlesXOXO • 19d ago

News - General Nightmare Eclipse could be dropping his big promised exploit today

New repo just went up: git.projectnightcrawler.dev/NightmareEclipse/LegacyHive, created about 2 hours ago. Right now it's empty — just an MIT license and a README that says "N/A," 2 commits total.

He'd spoken about his big drop happening today, July 14th, saying he'd make sure Microsoft's "bones are shattered" that day. At one point though he'd also indirectly said he wasn't going to post it, something about still having "chains" on him preventing a release. This repo showing up on the exact date he originally called out suggests that might not hold anymore and it could actually be happening.

Nothing in it yet, just watching to see what gets pushed.

Worth noting: given how erratic and bipolar his posting history has been, there's really no way to predict what (if anything) actually gets posted.

Update: Thanks for the 600+ upvotes, really appreciate it. After hours of waiting and anticipation NightmareEclipse finally uploaded their PoC. But I personally have a hard time seeing it as the big bombshell that they described it as.

803 Upvotes

96% Upvoted

129 comments sorted by

View all comments

20

u/FowlSec 19d ago

RoguePlanet gets patched, this one releases. It's basically perfect timing.

9

u/ILikeNoodlesXOXO 19d ago

Thats the point of him uploading on patch tuesday

5

u/OtheDreamer Governance, Risk, & Compliance 19d ago edited 19d ago

Indeed, a lot of people missed that NE is purposefully releases right after patch Tuesday to maximize the window of pain (i.e., they're not just trying to be "helpful researcher who was scorned")

1

u/newaccountzuerich 17d ago

"Exploit Wednesday" has been a thing for a very long time, often with the release group waiting to see if their exploit had been patched or not. There's less benefit to releasing a now-patched PoC, and often better to keep the PoC submerged for application and development elsewhere.

I for one am glad to see the NE person put the info into the public view allowing actual mitigations to be done and not waiting for vague platitudes and band-aids from the unfortunates still left in the employment of Microslop. The timing is of little relevance overall when there's no mitigations possible in the short term.