[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$futTvQ5Th6CGCsYlLR4ZT1gj6ilHaDWNpZmCMrvRwqjE":3},{"article":4,"iocs":56},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":33,"category":34,"article_tags":38},"857842e1-7ce4-42ab-ab24-fe9e0794c9bf","Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’","nightmare-eclipse-drops-windows-zero-day-exploit-shieldbreak-5688fd","Dropped on Patch Tuesday, the exploit allows any user to spawn a shell with System privileges. The post Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’ appeared first on SecurityWeek.","Security researcher Nightmare Eclipse has released a new zero-day exploit called 'ShieldBreak' that allows any user to gain System privileges on Windows. The exploit targets a vulnerability in Microsoft Defender and bypasses previous patches for the 'RoguePlanet' flaw. While Nightmare Eclipse claims it's a bypass, other researchers note differences in its mechanism and require Defender to be active.","Nightmare Eclipse releases 'ShieldBreak,' a Windows zero-day exploit for privilege escalation.","Security researcher Nightmare Eclipse has dropped a fresh zero-day exploit leading to privilege escalation on Windows. Also known as Chaotic Eclipse, the disgruntled researcher released multiple zero-day exploits targeting Microsoft products over the past several months, usually right after the Patch Tuesday security updates. Right on cue, the new proof-of-concept (PoC) exploit, dubbed ShieldBreak, was published on August 2026 Patch Tuesday. It targets a vulnerability in Microsoft Defender, allowing any user to gain System privileges. According to Nightmare Eclipse, the exploit is a RoguePlanet patch bypass, works on the latest Windows 11 versions and on Windows Server 2025, and likely impacts Windows 10 machines as well. Tracked as CVE-2026-50656, RoguePlanet is a race condition flaw in Defender that Nightmare Eclipse dropped as a zero-day on June 9. Microsoft acknowledged the exploit on June 16 and released fixes for it on July 9. Per the analysis of Tharros Labs’s Will Dormann, ShieldBreak involves setting up a temporary directory registered as a Cloud Sync provider, planting an EICAR file, controlling Defender’s scan path to System32, using Windows’ CLFS to swap the identity file and hydration data to a ‘phoneinfo.dll’ file in System32, then running the QueueReporting scheduled task.Advertisement. Scroll to continue reading. “In the wer.dll code, there is explicit code to load phoneinfo.dll [which does not exist by default in Windows]. Because at this point, phoneinfo.dll exists and is our own code, this runs, spawning conhost.exe with SYSTEM privileges,” Dormann says. Both Dormann and cybersecurity expert Kevin Beaumont, who published detection queries for the fresh PoC, disagree with Nightmare Eclipse’s assertion that ShieldBreak is a RoguePlanet bypass, as they work differently. “RoguePlanet was a filesystem race condition vuln that uses virtual disks and NT native file manipulation to trick the quarantine process into overwriting system files. ShieldBreak user-mode callback hook to change file contents during a Defender cloud-hydration scan via cfapi (Cloud Filter API),” Beaumont said. Dormann also points out that “ShieldBreak seems to require Defender to be active to work,” while RoguePlanet did not. Related: SharePoint Vulnerability Exploited Shortly After PoC Release Related: Chipmaker Patch Tuesday: Intel, AMD Fix Over 80 Vulnerabilities Combined Related: Fresh Windows Zero-Day Exploited in North Korean Cyberattacks Related: Ivanti EPM Update Patches Remotely Exploitable Flaws Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Over 2,500 Organizations Impacted by LiteLLM Supply Chain AttackFresh Windows Zero-Day Exploited in North Korean CyberattacksIvanti EPM Update Patches Remotely Exploitable FlawsSonicWall Patches Critical Vulnerabilities in Discontinued GMS PlatformAugust 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-DayAdobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic FlawsZoom Patches Zero-Click Code Execution VulnerabilitySAP Patches Critical Code Injection, Memory Corruption Vulnerabilities Latest News White House Mobilizes Security Firms for Operations Against Foreign Cybercrime GangsCritical VMware vCenter Vulnerability in Attackers’ CrosshairsSharePoint Vulnerability Exploited Shortly After PoC ReleaseMindgard Raises $30 Million to Protect AI SystemsStealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom ToolsetWhatsApp Unveils New Scam Alert FeatureCeva Logistics Operations Disrupted by CyberattackChipmaker Patch Tuesday: Intel, AMD Fix Over 80 Vulnerabilities Combined Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveErika Dean has been appointed Chief Information Security Officer at Tricentis.C1 has named Jeff St. Clair Chief Revenue Officer.John Opala has joined Ralph Lauren as Chief Information Security Officer.More People On The MoveExpert Insights The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. (Steve Durbin) Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email","https:\u002F\u002Fwww.securityweek.com\u002Fnightmare-eclipse-drops-windows-zero-day-exploit-shieldbreak\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F06\u002Fzero-day-e1772721069481.jpg","2026-08-13T08:38:03+00:00","2026-08-13T10:00:05.099458+00:00",9,[18,21,24,26,28,30],{"name":19,"type":20},"Nightmare Eclipse","threat_actor",{"name":22,"type":23},"Microsoft Defender","product",{"name":25,"type":23},"Windows 11",{"name":27,"type":23},"Windows Server 2025",{"name":29,"type":23},"Windows 10",{"name":31,"type":32},"RoguePlanet","campaign","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":33,"icon":35,"name":36,"slug":37},null,"Zero-day","zero-day",[39,41,46,51],{"category":40},{"id":33,"icon":35,"name":36,"slug":37},{"category":42},{"id":43,"icon":35,"name":44,"slug":45},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[57],{"type":58,"value":59,"context":60},"cve","CVE-2026-50656","CVE for the RoguePlanet vulnerability exploited by ShieldBreak."]