Mastodawn

EVERYONE GETS AN LPE

Windows:
#BlueHammer (#CVE_2026_33825)
#RedSun (#CVE_2026_41091)
#UnDefend (#CVE_2026_45498)
#WindowsInstaller (#CVE_2026_27910):

Linux:
#CopyFail (#CVE_2026_31431)
#SSHKeysignPwn (#CVE_2026_46333)

FreeBSD:
#FatGid (#CVE_2026_45250)
#ExecveBug (#CVE_2026_7270)

clacke: exhausted pixie dream boy 🇸🇪🇭🇰💙💛Apr 30

We'll install MS Defender on your VMs, they said.
It will make them more secure, they said.

#infosec #Defender #MicrosoftDefender
#RedSun #BlueHammer #UnDefend

Marcel SIneM(S)US Apr 22

Ungepatchte #Windows

-Zero-Days #RedSun, #UnDefend und #BlueHammer werden attackiert | Security https://www.heise.de/news/Ungepatchte-Windows-Zero-Days-RedSun-UnDefend-und-BlueHammer-werden-attackiert-11263691.html #exploit #ZeroDay #0day

Ungepatchte Windows-Zero-Days RedSun, UnDefend und BlueHammer werden attackiert

Die Zero-Day-Lücken im Windows Defender mit den Namen BlueHammer, RedSun und UnDefend werden offenbar attackiert.

heise online

maniabel Apr 17

UnDefend: noch ein ZeroDay-PoC von Chaotic Eclipse/Nightmare‑Eclipse. Und das war bestimmt noch nicht alles.

Mehr: https://maniabel.work/archiv/1462

#ChaoticEclipse #NightmareEclipse #PoC #UnDefend #Windows #ZeroDay #infosec #up2date

Noch ein PoC: UnDefend von Chaotic Eclipse/Nightmare‑Eclipse – maniabel

Entdecken Sie, was Sie für die Sicherheit und den Schutz Ihrer Daten selbst tun können: Digitale Daten selbst schützen & sichern <meta charset=

kevlar_sec Apr 17

Chaotic Eclipse dropped a third Defender zero-day today. No admin required.

Four independent locking mechanisms block all signature updates. The one they withheld: a way to lie to the EDR console so the dashboard shows green while signatures go stale.

The sync provider name changed from "SERIOUSLYMSFT" (RedSun) to "IHATEMICROSOFT" (BlueHammer). UnDefend drops the Cloud Files trick entirely — just file locks. Standard user.

BlueHammer patched Tuesday. RedSun unpatched. UnDefend no CVE.

Line-by-line: https://nefariousplan.com/posts/undefend/

#infosec #WindowsDefender #CVE #UnDefend

UnDefend: What Chaotic Eclipse Held Back This Time — nefariousplan.com

The third zero-day from the same researcher makes Defender permanently blind from a standard user account — no elevation required. A line-by-line walk of UnDefend.cpp, and the one mechanism that didn't ship.

nefariousplan.com