Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal

Microsoft criticizes uncoordinated public disclosures of zero-day vulnerabilities affecting Windows components.

• •Researcher Chaotic Eclipse disclosed multiple unpatched vulnerabilities including BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), and YellowKey (CVE-2026-45585) without prior Microsoft notification.
• •The vulnerabilities affect Windows Defender and BitLocker, with BlueHammer, RedSun, and UnDefend actively exploited in the wild following public disclosure.
• •Microsoft advocates for Coordinated Vulnerability Disclosure (CVD) to allow vendors time to develop patches before public release.
• •The researcher's GitHub account was removed by GitHub following the disclosures, with exploit code subsequently uploaded to GitLab before that account was also blocked.

This summary was automatically generated by AI based on the original article and may not be fully accurate.